Active security defense method based on network traffic time pattern and data volume analysis

Abstract

The invention relates to the technical field of information data processing, particularly provides an active security defense method based on a network traffic time mode and data volume analysis, and solves the problem of poor security and reliability of network security defense. The method comprises the following steps: a network traffic capturing tool is used for acquiring a time mode and a data volume of network traffic corresponding to a network node; obtaining a model data set containing a time pattern and a data volume attack pattern, and segmenting the model data set to obtain a training set, a test set and a verification set; training the active security defense model by using the training set to obtain a trained active security defense model; and laying the active security defense model to a regional position, establishing communication with specific equipment, analyzing network traffic, obtaining an evaluation result of potential network attacks, and if the network attacks exist, adopting security protection measures for protection. According to the invention, the identification and defense efficiency of various network attacks can be improved, and the security and stability of the network are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of information data processing, and in particular to an active security defense method based on network traffic time pattern and data volume analysis. Background Art

[0002] The main purpose of network security defense is to protect computer systems, networks and data from unauthorized access, use, disclosure, destruction, modification or interference. General measures for network security defense include firewalls, intrusion detection systems, intrusion prevention systems, antivirus software, encryption technology, identity authentication and access control. These measures can effectively defend against conventional network attacks to a certain extent, but with the continuous evolution of network threats, they also face some challenges and defects. For example, traditional firewalls and intrusion detection systems and intrusion prevention systems usually rely on predefined rules and signatures, and are difficult to deal with new and complex attacks. They are mainly passive defenses, relying on detection and response after the attack occurs, and lack active prediction and defense capabilities.

[0003] Prior art 1, Chinese patent, application number: 202010188489.5 discloses a cloud-based active immune security defense method and device, the main steps include the immune library management module establishing a mirror virtual machine system in the cloud that is completely consistent with the instance system outside the cloud in the initial state; the immune cleaning module pushes the mirror system in the cloud to the instance system outside the cloud to replace it, keeping the operation and maintenance instance system and the mirror system in the cloud completely consistent, and identifying inconsistent heterogeneous software; the immune update module performs a security upgrade on the mirror system in the cloud; the immune agent module runs in the hardware remote boot state in the instance system outside the cloud, receives the cleaning instructions issued by the cloud immune cleaning module, and executes the cleaning action. Although it can achieve high security of the system, reduce the risk of continuous penetration and intrusion of advanced threats to the system attack surface exposed to the network environment and operating environment for a long time, identify abnormal programs such as backdoors and Trojans, periodically restore the system to the initial state, and isolate the cloud and the end in one direction to achieve the characteristics of active immunity; however, the number of devices required to be deployed is large, which increases the cost of defense; at the same time, the passive defense method is adopted, resulting in poor defense effect and full response.

[0004] Prior art 2, Chinese patent, application number: 202110026307.9 discloses a method, device, storage medium and electronic device for dynamic security protection, including obtaining visitor information and access device information in response to a first access request; the first access request is used to access the target resource set; judging whether the visitor is allowed to access the target resource set according to the visitor information and the access device information; if the visitor is allowed to access, generating access evaluation information according to the visitor information and the access device information; the access evaluation information changes dynamically according to the visitor's access behavior; obtaining a second access request, responding to the second access request according to the access evaluation information; the second access request is used to access resources in the target resource set. Although the purpose of active security defense can be achieved; however, its defense process is relatively complex, the degree of intelligence is low, and it lacks defense autonomy, which affects the efficiency of network security defense to a certain extent.

[0005] Prior art three, Chinese patent, application number 202110651977.X discloses a website security defense system and method with active defense function, the system includes an input end, a processing end, an output end and a feedback end; the input end includes N parallel data receiving channels and feedback data input channels; the processing end includes multiple data encoding channels, which are used to perform data encoding on the network input data received by the data receiving channel to generate encoding channel data; multiple encoding prediction models at the processing end use the encoding channel data as the input of the encoding prediction model, and the encoding prediction model outputs multiple security prediction results and sends them to the output end; the output end performs screening on multiple security prediction results according to preset conditions, and sends at least one screened security prediction result to the feedback end; when the screened security prediction result meets the preset conditions, the processing end updates the encoding prediction model. Although it can efficiently realize the active defense of the website and realize dynamic feedback update at the same time; it is mainly passive network security defense, lacks initiative, and the technology of network security defense needs to be further improved.

[0006] At present, the existing technologies 1, 2 and 3 lack active technical means for network security defense, which not only affects the security of network security defense, but also affects the reliability. Therefore, the present invention provides an active security defense method based on network traffic time pattern and data volume analysis. Summary of the invention

[0007] In order to achieve the above object, the present invention adopts the following technical scheme:

[0008] In one aspect of the present invention, an active security defense method based on network traffic time pattern and data volume analysis is provided, which uses an active security defense model to realize the process of capturing abnormal patterns, and obtains data of local abnormal points and global abnormal points;

[0009] Align the local outlier points and the global outlier points according to the timestamps, calculate their respective weights according to their outlier degrees, perform weighted fusion on the local outlier points and the global outlier points according to their respective weights, and generate a comprehensive outlier point. The outlier degree of the comprehensive outlier point is the weighted sum of the outlier degrees of the local outlier points and the global outlier points.

[0010] Local anomaly points and global anomaly points are used as initial cluster centers for hierarchical clustering. Hierarchical clustering is performed based on the feature similarity between anomaly points to generate multiple anomaly clusters, each of which represents a similar anomaly pattern. The mean is used to perform a comprehensive evaluation on each anomaly cluster to calculate its degree of anomaly. Based on the characteristics of the anomaly cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final anomaly pattern is generated, each of which contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly, and an analysis of the possible causes of the anomaly.

[0011] An active security defense model is used to analyze network traffic and obtain the evaluation results of all network attacks. The active security defense model dynamically sets the anomaly detection threshold at the anomaly detection layer based on the prediction results of its time series prediction layer. In the anomaly detection layer of the active security defense model, real-time traffic data and prediction results are compared and analyzed at multiple levels to identify traffic behaviors that obviously deviate from the prediction results, and time series analysis is performed on traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are clustered and classified into different categories of abnormal behaviors to distinguish different types of abnormal behaviors.

[0012] In an optional implementation, the future traffic prediction results generated by the time series prediction layer of the active security defense model are converted into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependency and periodicity characteristics of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model.

[0013] In the anomaly detection layer, real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type, and then fused with the high-dimensional feature vector transmitted by the time series prediction layer to form a comprehensive feature space;

[0014] Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the anomaly detection threshold; in the anomaly detection layer, the real-time traffic data and the prediction results are compared and analyzed at multiple levels to identify the traffic behavior that obviously deviates from the prediction results, and the traffic data is analyzed in time series to capture abnormal patterns; the identified abnormal traffic behavior is clustered and classified into different categories of abnormal behavior to distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning.

[0015] In an optional implementation, the process of identifying traffic behavior that significantly deviates from the prediction result comprises the following steps:

[0016] The anomaly detection layer makes a preliminary comparison between the real-time traffic data and the prediction results of the time series prediction layer, and determines whether the traffic data significantly deviates from the normal range based on the preset threshold. Then, the traffic data is locally compared by sliding the time window to identify abnormal fluctuations in a short period of time. Combined with historical traffic data, a global comparison is made to capture abnormal changes in long-term trends.

[0017] Extract time series features. Through time series analysis of network traffic data, the size, rate of change and fluctuation range of network traffic are extracted to reflect the current state of network traffic, and also include the time dependence and periodicity characteristics of historical traffic patterns. Through feature extraction, network traffic data is converted into high-dimensional time series feature vectors.

[0018] Perform local pattern recognition on time series features to capture local anomalies in network traffic data; perform global pattern recognition on time series features to capture long-term abnormal trends in network traffic data and capture abnormal patterns.

[0019] In an optional implementation, the process of capturing the abnormal pattern includes the following steps:

[0020] Obtain data on local outliers, including timestamps, degree of anomaly, and features of the outliers; and simultaneously obtain data on global outliers, including timestamps, degree of anomaly, and features of the outliers;

[0021] Align the local outlier points and the global outlier points according to the timestamps, calculate their respective weights according to their outlier degrees, perform weighted fusion on the local outlier points and the global outlier points according to their respective weights, and generate a comprehensive outlier point. The outlier degree of the comprehensive outlier point is the weighted sum of the outlier degrees of the local outlier points and the global outlier points.

[0022] Local anomaly points and global anomaly points are used as initial clustering centers for hierarchical clustering. Hierarchical clustering is performed based on the feature similarity between anomaly points to generate multiple anomaly clusters, each of which represents a similar anomaly pattern. The mean is used to perform a comprehensive evaluation on each anomaly cluster to calculate its degree of anomaly. Based on the characteristics of the anomaly cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final anomaly pattern is generated, and each anomaly pattern contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly, and an analysis of the possible causes of the anomaly.

[0023] In an optional implementation, the active security defense model is constructed in a multi-level manner, including the following steps:

[0024] The autoregressive integrated moving average model is used to capture the autocorrelation and moving average characteristics of the time series to predict future traffic trends; the historical traffic data is cleaned, normalized and differentiated, and the parameters of the autoregressive integrated moving average model are optimized using grid search; the performance of the autoregressive integrated moving average model on different data subsets is evaluated by using K-fold cross validation; the rolling prediction method is used to continuously update the autoregressive integrated moving average model using the latest historical traffic data to generate traffic prediction results for a period of time in the future;

[0025] The isolation forest model is used to randomly divide the data space, identify anomalies, extract DDoS attack traffic and malicious scanning traffic anomaly samples from historical data, and build a training set for the anomaly detection model; extract traffic size, packet length distribution and protocol type features from traffic data as input for the anomaly detection model; use anomaly samples for training and optimize model parameters; input real-time collected network traffic data into the anomaly detection model to perform real-time anomaly detection, generate anomaly scores, and evaluate the severity of abnormal behavior in real-time traffic data;

[0026] The multi-level model is divided into a time series prediction layer and anomaly detection layer to form a bottom-up hierarchical structure; the time series prediction model and the anomaly detection model are designed as independent modules, and the prediction results of the time series prediction model are used as the input of the anomaly detection model to achieve data flow between the layers; in the anomaly detection layer, the real-time traffic data is compared with the prediction results to identify abnormal traffic behaviors that do not match the prediction results; the anomaly detection results are fed back to the time series prediction layer to update the prediction model;

[0027] Use the training set to jointly train the multi-level model and optimize the parameters of each level model; based on the real-time analysis results, continuously update the parameters of the multi-level model.

[0028] In an optional implementation, the training process of the active security defense model includes the following steps:

[0029] Based on time series analysis, dynamic features including traffic change rate and data volume growth rate are generated to capture short-term and long-term change trends of network traffic;

[0030] A multi-level model is used to integrate the active security defense model, and a time series prediction model and anomaly detection model are combined to build a multi-level active security defense model. The time series prediction model is used to predict the future trend of normal network traffic. The anomaly detection model is used to identify abnormal traffic behaviors that do not match the prediction results. The training set is used to train the multi-level model and optimize the parameters of the active security defense model.

[0031] Deploy the trained active security defense model to network nodes, analyze network traffic in real time, and generate evaluation results of potential network attacks; dynamically adjust security protection strategies based on real-time analysis results; feed back real-time analysis results to the active security defense model training layer to dynamically update the parameters of the active security defense model.

[0032] In an optional implementation, the process of obtaining the training set includes the following steps:

[0033] Through intelligent perception network, the time pattern and data volume of network traffic are captured in real time, and potential attack patterns are identified and recorded. Through the fusion of multi-source data, a dynamic and comprehensive model data set is built;

[0034] Analyze the model data set according to the time series, automatically identify and divide the time windows with similar characteristics; identify different traffic patterns on weekdays and weekends, and segment them; for the same attack type in the same area, concentrate the data in one slice; automatically identify and cluster similar attack patterns, identify and classify them;

[0035] Automatically detect outliers and missing values ​​in the dataset and use generative adversarial networks to generate alternative data; adaptively adjust the segmentation strategy based on the verification results.

[0036] In an optional implementation, the process of adaptively adjusting the segmentation strategy includes the following steps:

[0037] Analyze the performance of the validation set, including key metrics such as accuracy, recall, and F1 score, to identify which types of data the model does not perform up to standard, and which attack modes or time windows do not have a good prediction effect.

[0038] Detect outliers and classification errors in the data set, use clustering algorithms to classify abnormal data, and identify which anomalies are caused by improper data segmentation;

[0039] Re-evaluate the division of time windows to ensure that time windows with similar features are correctly divided into the same dataset; re-cluster similar attack patterns to ensure that attack data of the same type is concentrated in one slice; generate alternative data through generative adversarial networks to balance the ratio of attack types and normal traffic in the dataset, ensuring that the model can be trained on different types of data.

[0040] In an optional implementation manner, network traffic is collected by a network traffic capture tool deployed at a network node of a specific device, and the network traffic capture tool is used to obtain a time pattern and data volume of network traffic corresponding to the network node; the process of deploying at least one network traffic capture tool includes the following steps:

[0041] Initialize the network interface of the specific device, and after initialization, create a process of the network node deployed by the network traffic capture tool, and the process runs in the application of the specific device; establish communication between the specific device and the core network through the process, and send a network traffic collection instruction to the network traffic capture tool;

[0042] The network between the specific device and the core network is divided into a number of equally spaced small segments, and the midpoint of each small segment is set as the network node for deploying the network traffic capture tool; the average absolute relative error objective function of the network traffic capture time is established to determine the deployment location of the network traffic capture tool;

[0043] After the deployment location is confirmed, the deployment location and the identifier of the network traffic capture tool are sent to the application of the specific device for storage.

[0044] In an optional implementation manner, after the application sent to the specific device is stored, the following steps need to be performed:

[0045] Initialization and configuration of network traffic capture tool During the initialization phase, the network traffic capture tool obtains key parameters of the current network environment through external interfaces. The key parameters include network topology, bandwidth utilization, and device connection status;

[0046] Network traffic capture tools automatically adjust configuration parameters, including dynamically selecting network interfaces and optimizing capture time intervals, or adjusting packet size limits based on network load conditions;

[0047] The network traffic capture tool automatically identifies and loads drivers by analyzing the current operating system and hardware configuration; it monitors the performance of the driver in real time and dynamically switches or upgrades it.

[0048] The present invention obtains the location of the area where the network is fully defended and monitored. By deploying network traffic capture tools at the network nodes of specific devices, the time pattern and data volume of network traffic can be obtained in real time to achieve real-time monitoring of network activities; by analyzing the time pattern and data volume of traffic, abnormal traffic behavior, such as DDoS attacks and brute force cracking, can be identified to provide data support for subsequent defense measures. The time pattern and data volume of network traffic captured by the network traffic capture tool are automatically obtained according to a preset period, and network traffic data is automatically obtained through a preset period, which reduces manual intervention and improves the efficiency and accuracy of data collection; the obtained time pattern, data volume and attack pattern are integrated into a model data set to provide rich data support for model training; the model data set is divided into a training set, a test set and a verification set to ensure the scientificity and reliability of model training and verification. Use the training set to train the active security defense model. By using the training set to train the active security defense model, the model can learn and identify various network attack patterns, thereby improving the accuracy and generalization ability of the model. The trained active security defense model is deployed to regional locations and establishes communication with specific equipment. It can analyze network traffic in real time and quickly identify potential network attacks. When a network attack is identified, corresponding security protection measures are automatically taken, such as blocking the attack source, isolating the attacked device, etc., to ensure the security and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0050] Figure 1 This is a flow chart of the active security defense method based on network traffic time pattern and data volume analysis provided in Example 1 of the present invention;

[0051] Figure 2 A process diagram of deploying at least one network traffic capturing tool provided in Embodiment 2 of the present invention;

[0052] Figure 3 A process diagram of storing an application program sent to a specific device provided in Embodiment 3 of the present invention;

[0053] Figure 4 A process diagram of segmenting a model data set to obtain a training set, a test set, and a validation set provided in Embodiment 4 of the present invention;

[0054] Figure 5 A process diagram of adaptively adjusting the segmentation strategy provided in Embodiment 5 of the present invention;

[0055] Figure 6A process diagram of obtaining a trained active security defense model provided in Example 6 of the present invention;

[0056] Figure 7 A process diagram of building a multi-level active security defense model provided in Example 7 of the present invention;

[0057] Figure 8 A process diagram of forming a bottom-up hierarchical structure provided in Embodiment 8 of the present invention;

[0058] Fig. 9 A process diagram for identifying traffic behaviors that are significantly deviated from prediction results provided in Embodiment 9 of the present invention;

[0059] Fig.10 A process diagram for realizing the capture of abnormal patterns provided in Embodiment 10 of the present invention;

[0060] Fig.11 A block diagram of an electronic device provided by the present invention;

[0061] Fig.12 A block diagram of a computer-readable storage medium provided for the present invention. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present invention will be described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0063] In the following, the terms "first", "second", etc. are used only for convenience of description and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0064] In the present invention, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, "connection" can be a fixed mechanical connection, or a detachable mechanical connection, or integrated; or, "connection" can be a direct connection, or an indirect connection through an intermediate medium. In addition, unless otherwise clearly specified and limited, the term "coupling" should be understood in a broad sense, for example, "coupling" can be a direct electrical connection, such as physical contact and electrical conduction between two components, and can also be understood as electrical connection between different components in a circuit structure through physical lines such as copper foil or wires on a printed circuit board (PCB) that can transmit electrical signals to transmit electrical signals; or, "coupling" can be an indirect electrical connection between two components through an intermediate medium; or, "coupling" can be an electrical connection between two components in an air-spaced / non-contact manner, for example, two components are electrically connected by capacitive coupling to transmit electrical signals.

[0065] In the embodiments of the present invention, directional terms such as "up", "down", "left" and "right" may be defined including but not limited to the orientation relative to the schematic placement of the components in the drawings. It should be understood that these directional terms may be relative concepts, which are used for relative description and clarification, and may change accordingly according to the change of the orientation of the components in the drawings.

[0066] The embodiments of the present invention can be widely used in various scenarios that require real-time monitoring and defense against network attacks, such as: enterprise internal networks: protecting enterprise internal networks from external attacks; data centers: ensuring high availability and data security of data centers; cloud service providers: ensuring the security and stability of cloud services; financial institutions: preventing financial data from being stolen or tampered with. Through the method of the present invention, real-time monitoring and intelligent analysis of network traffic can be achieved, potential network attacks can be discovered and defended in a timely manner, and the security and reliability of the network can be improved.

[0067] Embodiment 1:

[0068] like Figure 1 As shown, the embodiment of the present invention provides an active security defense method based on network traffic time pattern and data volume analysis, comprising the following steps:

[0069] Step S100: obtaining the location of the area to be monitored for network complete defense, obtaining the specific device to be monitored from the location of the area, and deploying at least one network traffic capture tool at the network node of the specific device, the network traffic capture tool being used to obtain the time pattern and data volume of the network traffic corresponding to the network node;

[0070] The time pattern of traffic refers to the distribution of network traffic in different time periods. Under normal circumstances, network traffic follows certain rules, such as higher traffic during peak hours on weekdays and lower traffic at night or on weekends. By analyzing the time pattern of traffic, abnormal traffic behavior can be identified. For example, if traffic suddenly increases significantly during a certain period of time, and this increase does not conform to normal work or business rules, this may be a sign of an attack, such as a DDoS attack (distributed denial of service attack). If traffic suddenly decreases significantly during normal peak hours, this may be because the network is controlled by an attacker, resulting in the inability of normal traffic to pass. If traffic shows abnormal periodic fluctuations, this may be because the attacker uses automated tools to perform periodic scans or attacks.

[0071] Data volume refers to the total amount of data transmitted over the network in a specific period of time. The size of the data volume can reflect the intensity and nature of network activities. By analyzing the data volume of traffic, the following anomalies can be identified: If a certain IP address transmits a large amount of data in a short period of time, it may be that the IP address is launching an attack, such as brute force cracking, data theft, etc.; If the data volume of a certain network protocol (such as HTTP, FTP, etc.) suddenly increases significantly, and this increase does not meet normal business needs, it may be that the attacker uses the protocol to carry out malicious activities; If a large number of abnormally sized data packets appear in the network (such as extremely small or extremely large data packets), it may be that the attacker is trying to bypass security detection or conduct a data overflow attack;

[0072] Step S200: automatically obtaining the time pattern and data volume of the network traffic captured by the network traffic capture tool and the corresponding attack pattern according to a preset period, and obtaining a model data set including the time pattern and the data volume attack pattern, and segmenting the model data set to obtain a training set, a test set and a validation set;

[0073] Step S300: Use the training set to train the active security defense model to obtain the trained active security defense model; deploy the active security defense model to the regional location, establish communication with specific equipment, analyze the network traffic, and obtain the evaluation results of potential network attacks. If there is a network attack, take security protection measures to protect it.

[0074] In the above embodiment, step S100 obtains the location of the area where the network is fully defended and monitored. By deploying network traffic capture tools at the network nodes of specific devices, the time pattern and data volume of network traffic can be obtained in real time to achieve real-time monitoring of network activities; by analyzing the time pattern and data volume of traffic, abnormal traffic behavior, such as DDoS attacks and brute force cracking, can be identified to provide data support for subsequent defense measures. Step S200 automatically obtains the time pattern and data volume of network traffic captured by the network traffic capture tool according to a preset period. Automatically obtaining network traffic data through a preset period reduces manual intervention and improves the efficiency and accuracy of data collection; integrates the obtained time pattern, data volume and attack pattern into a model data set to provide rich data support for model training; divides the model data set into a training set, a test set and a verification set to ensure the scientificity and reliability of model training and verification. Step S300 uses the training set to train the active security defense model. By using the training set to train the active security defense model, the model can learn and identify various network attack patterns, thereby improving the accuracy and generalization ability of the model. The trained active security defense model is deployed to the regional location, and communication is established with the specific equipment. It can analyze the network traffic in real time and quickly identify potential network attacks. When a network attack is identified, corresponding security protection measures are automatically taken, such as blocking the attack source, isolating the attacked device, etc., to ensure the security and stability of the network.

[0075] In summary, this embodiment can timely discover and identify abnormal network behavior by acquiring and analyzing network traffic data in real time; can quickly respond to network attacks and automatically take protective measures through automated data collection, model training, and real-time analysis; can improve the efficiency of identifying and defending against various network attacks through the learning and recognition of AI models, and ensure the security and stability of the network. This not only improves the automation level of network security defense, but also enhances the accuracy and response speed of defense, effectively protecting the network from various attacks.

[0076] Embodiment 2:

[0077] like Figure 2 As shown, based on Example 1, the process of deploying at least one network traffic capture tool in step S100 provided in the embodiment of the present invention includes the following steps:

[0078] Step S101: Initialize the network interface of the specific device, create a process of the network node deployed by the network traffic capture tool after initialization, and run the process in the application of the specific device; establish communication between the specific device and the core network through the process, and send a network traffic collection instruction to the network traffic capture tool;

[0079] Step S102: Divide the network between the specific device and the core network into a number of equally spaced segments, and set the midpoint of each segment as a network node for deploying a network traffic capture tool; establish a mean absolute relative error objective function for network traffic capture time, and determine the deployment location of the network traffic capture tool;

[0080] Among them, the expression of the mean absolute relative error objective function of network traffic capture time is:

[0081]

[0082] The error of network traffic capture time is expressed as:

[0083] Δt i =t i -t ideal

[0084] Network delay i Affects the network traffic capture time, and the error is further expressed as:

[0085] Δt i =t i -t ideal +d i

[0086] Considering the distribution of network traffic f(p i ), the error term Δt i Further refinement:

[0087]

[0088] The mean absolute relative error (MARE) is expressed as:

[0089]

[0090] Where, t i represents the network traffic capture time of the i-th network node, p i represents the layout location of the i-th network node, f(p i ) indicates that the network traffic is at position p i The distribution function at Δt i represents the error of network traffic capture time of the ith network node, N represents the total number of network nodes, and d i represents the network delay of the ith network node, p represents the layout position vector of the network node, P = [p 1 ,p 2 ,…,p N ], T represents the network traffic capture time vector, T = [t 1 ,t 2 ,…,t N], D represents the network delay vector, D = [d 1 ,d 2 ,…,d N ], t ideal is the ideal network traffic capture time, represented by the matrix w, where w ij Represents the influence weight of the ith network node on the jth network node; the expression combines the distribution of network traffic, the layout location, network delay, the mutual influence between network nodes and the importance of different locations, ensuring that the layout location of the network traffic capture tool can minimize the error of capture time;

[0091] Step S103: After the deployment location is confirmed, the deployment location and the identifier of the network traffic capture tool are sent to the application of the specific device for storage.

[0092] In the above embodiment, step S101 initializes the network interface of the specific device to ensure that the device can access the network normally, and creates a process for deploying the network traffic capture tool; ensures the establishment of a communication channel between the device and the core network, and provides a basis for sending traffic collection instructions; sends network traffic collection instructions to the network traffic capture tool through the process, ensuring that the tool can start capturing network traffic and provide raw data for data analysis and processing. Step S102 divides the network between the specific device and the core network into several equally spaced small segments, and deploys the network traffic capture tool at the midpoint of each small segment; ensures uniform capture of network traffic, avoiding traffic overload or omission problems that may occur at a single node; optimizes the deployment position of the network traffic capture tool by establishing the average absolute relative error objective function of the network traffic capture time, and ensures that the captured traffic data has high accuracy and reliability. After the deployment location is confirmed, step S103 sends the deployment location and the identification of the network traffic capture tool to the application of the specific device for storage; this ensures the persistence and traceability of the deployment information, facilitating subsequent management and maintenance; at the same time, the stored identification information also facilitates the identification and calling of the tool, ensuring that the network traffic capture tool can run stably and continuously provide data.

[0093] Embodiment 3:

[0094] like Figure 3 As shown, based on Example 2, the following steps need to be performed after the application sent to the specific device in step S103 provided in the embodiment of the present invention is stored:

[0095] Step S1031: Initialization and configuration of the network traffic capture tool. In the initialization stage, the network traffic capture tool obtains key parameters of the current network environment through an external interface. The key parameters include network topology, bandwidth utilization, and device connection status;

[0096] Step S1032: the network traffic capture tool automatically adjusts configuration parameters, including dynamically selecting a network interface and optimizing a capture time interval, or adjusting a data packet size limit according to network load conditions;

[0097] Step S1033: The network traffic capture tool automatically identifies and loads the driver by analyzing the current operating system and hardware configuration; monitors the performance of the driver in real time, and dynamically switches or upgrades it.

[0098] In the above embodiment, step S1031 initializes and configures the network traffic capture tool, obtains key parameters of the network environment through an external interface, such as network topology, bandwidth utilization, and device connection status, and the parameters provide basic data for configuration and optimization; the network traffic capture tool can be initialized and configured according to the current network environment to ensure that it can start and run normally under different network conditions. Step S1032 The network traffic capture tool automatically adjusts the configuration parameters, automatically selects the most suitable network interface for data capture according to the network load and demand, and ensures the efficiency and accuracy of the capture process; dynamically adjusts the capture time interval according to the network traffic situation to avoid excessive capture and waste of resources, while ensuring the integrity of the captured data; dynamically adjusts the data packet size limit according to the network load situation to ensure that the amount of captured data is moderate, neither too much nor too little. Step S1033 The network traffic capture tool automatically identifies and loads the driver by analyzing the current operating system and hardware configuration, and can automatically identify the current operating system and hardware configuration, and load the corresponding driver to ensure the compatibility and performance of the capture tool and the hardware; monitors the performance of the driver in real time, and dynamically switches or upgrades as needed to ensure that the capture tool always runs in the best state to avoid performance bottlenecks or data loss caused by driver problems. Through these steps, the network traffic capture tool can not only adapt to different network environments and hardware configurations, but also make dynamic adjustments according to real-time conditions to ensure the efficiency, accuracy and stability of the capture process.

[0099] Embodiment 4:

[0100] like Figure 4 As shown, based on Example 1, the process of segmenting the model data set to obtain a training set, a test set, and a validation set in step S200 provided in the embodiment of the present invention includes the following steps:

[0101] Step S201: Through the intelligent perception network, the time pattern and data volume of network traffic are captured in real time, and potential attack patterns are identified and recorded. Through the fusion of multi-source data, a dynamic and comprehensive model data set is constructed;

[0102] Step S202: Analyze the model data set according to the time series, automatically identify and divide the time windows with similar characteristics; identify different traffic patterns on weekdays and weekends, and segment them; for the same attack type in the same area, concentrate the data in one slice; automatically identify and cluster similar attack patterns, identify and classify them;

[0103] Step S203: Automatically detect outliers and missing values ​​in the data set, and use a generative adversarial network to generate alternative data; according to the verification results, adaptively adjust the segmentation strategy.

[0104] In the above embodiment, step S201 can capture the time pattern and data volume of network traffic in real time through the intelligent perception network to ensure the timeliness and freshness of the data; build a dynamic and comprehensive model data set through the fusion of multi-source data to ensure the diversity and coverage of the data set; identify and record potential attack patterns to provide basic data for security analysis and defense. Step S202 automatically identifies and divides time windows with similar characteristics through the analysis of time series, which helps to deeply understand the changes in traffic patterns; identifies different traffic patterns on weekdays and weekends, and performs segmentation, which helps to analyze security threats in different time periods; automatically identifies and clusters similar attack patterns, identifies and classifies them, and helps to systematically analyze and respond to various types of attacks. Step S203 automatically detects outliers and missing values ​​in the data set to ensure the integrity and accuracy of the data set; uses generative adversarial networks to generate alternative data to fill missing values ​​and enhance the richness and diversity of the data set; and adaptively adjusts the segmentation strategy based on the verification results to ensure the scientificity and effectiveness of the segmentation strategy. The high quality and high availability of the model data set are ensured, providing a solid foundation for subsequent training, testing and verification.

[0105] Embodiment 5:

[0106] like Figure 5 As shown, based on Example 4, the process of adaptively adjusting the segmentation strategy in step S203 provided in the embodiment of the present invention includes the following steps:

[0107] Step S2031: Analyze the performance of the validation set, including key indicators such as accuracy, recall, and F1 score, to identify which types of data the model performs poorly on, and which attack modes or time windows have poor prediction results;

[0108] Step S2032: Detect outliers and classification errors in the data set, classify the abnormal data using a clustering algorithm, and identify which anomalies are caused by improper data segmentation;

[0109] Among them, the clustering algorithm expression is:

[0110]

[0111] In the formula, D = {d 1 ,d 2 ,…,d k} is the model data set, where d k represents the kth data sample, E={e 1 ,e 2 ,…,e m} is an abnormal data set, where e m represents the mth abnormal data, C={c 1 ,c 2 ,…,c l} is the clustering result set, where c l represents the lth cluster; A={a 1 ,a 2 ,…,a p} is a set of anomalies caused by improper data segmentation, where a p represents the pth abnormal data caused by improper data segmentation; T = {t 1 ,t 2 ,…,t q} is a time window set, where t q represents the qth time window; F = {f 1 ,f 2 ,…,f s} is a feature set, where f s represents the sth feature; belongs to (e, c) indicates whether the abnormal data e belongs to the cluster c, dynamic feature (e, z) ≠ dynamic feature (c, z) indicates that the dynamic features of the data sample e at time or context z are inconsistent with the dynamic features of the category c to which it belongs at the same time or context; for each abnormal data in the abnormal data set, determine whether it belongs to a certain cluster; determine whether the cluster is consistent with the segmentation strategy of the current time window; further determine whether the dynamic features of the abnormal data in the time window are consistent with the dynamic features of the cluster in the time window; if the cluster is inconsistent with the segmentation strategy of the current time window, and the dynamic features of the abnormal data in the time window are inconsistent with the dynamic features of the cluster in the time window, then the abnormal data is classified as abnormal data caused by improper data segmentation and added to the set; in this way, the abnormal data caused by improper data segmentation can be more accurately identified, and corresponding adjustments and processing can be made;

[0112] Step S2033: Re-evaluate the division of time windows to ensure that time windows with similar features are correctly divided into the same data set; re-cluster similar attack patterns to ensure that attack data of the same type is concentrated in one slice; generate alternative data through a generative adversarial network to balance the ratio of attack types and normal traffic in the data set to ensure that the model can be trained on different types of data.

[0113] In the above embodiment, step S2031 validation set performance analysis, through key indicators such as accuracy, recall rate and F1 score, quantifies the performance of the model on the validation set, and provides clear data support for adjustment; identifies the poor performance of the model on specific types of data, and in which attack modes or time windows the prediction effect is poor, and provides direction for adjustment. Step S2032 anomaly detection and classification, classifies abnormal data through clustering algorithms, identifies outliers and classification errors in the data set, especially anomalies caused by improper data segmentation; clarifies which anomalies are caused by improper data segmentation strategies, and provides a basis for subsequent strategy adjustments. Step S2033 segmentation strategy adjustment, re-evaluates the division of time windows, ensures that time windows with similar characteristics are correctly divided into the same data set, and improves the internal consistency of the data set; re-clustering similar attack modes, ensures that the same type of attack data is concentrated in one slice, and avoids the model from confusing different types of attacks during training; generates alternative data through generative adversarial networks (GANs), balances the proportion of attack types and normal traffic in the data set, ensures that the model can be fully trained on different types of data, and improves the generalization ability of the model.

[0114] In summary, this embodiment improves the accuracy, recall and F1 score of the model on the validation set by optimizing the data segmentation strategy, thereby enhancing the model's prediction ability; by balancing the attack type and normal traffic ratio in the data set, the model's robustness in the face of different types of data is enhanced; by optimizing the time window division and attack pattern clustering, the internal consistency and quality of the data set are improved, providing a higher quality data foundation for model training. Through the implementation of these steps, it is ensured that the segmentation strategy of the model data set can be adaptively optimized, thereby improving the overall performance and generalization ability of the model.

[0115] Embodiment 6:

[0116] like Figure 6 As shown, based on Example 1, the process of obtaining the trained active security defense model in step S300 provided in the embodiment of the present invention includes the following steps:

[0117] Step S301: Based on time series analysis, dynamic features including traffic change rate and data volume growth rate are generated to capture short-term and long-term change trends of network traffic;

[0118] Step S302: Adopt a multi-level model to integrate the active security defense model, combine the time series prediction model and the anomaly detection model, and build a multi-level active security defense model; the time series prediction model is used to predict the future trend of normal network traffic; the anomaly detection model is used to identify abnormal traffic behaviors that do not match the prediction results; use the training set to train the multi-level model and optimize the active security defense model parameters;

[0119] Step S303: deploy the trained active security defense model to the network node, analyze the network traffic in real time, and generate the evaluation results of potential network attacks; dynamically adjust the security protection strategy according to the real-time analysis results, such as traffic restriction, IP blocking and protocol filtering; feed back the real-time analysis results to the active security defense model training layer, and dynamically update the parameters of the active security defense model.

[0120] In the above embodiment, step S301 generates dynamic features based on time series analysis. Through time series analysis, the model can effectively capture the short-term and long-term change trends of network traffic, which helps to identify changes in traffic patterns, such as a surge in traffic during peak hours or a decrease in traffic during low hours; the dynamic features generated by the model (such as traffic change rate and data volume growth rate) provide a rich data basis for subsequent prediction and anomaly detection. These features can reflect the real-time status of network traffic and help the model better understand and predict network behavior. Step S302 uses a multi-level model to integrate the active security defense model. The time series prediction model can predict the future trend of normal network traffic and help the model identify potential traffic anomalies in advance; by predicting future trends, the model can take preventive measures before anomalies occur; the anomaly detection model can identify abnormal traffic behaviors that do not match the prediction results, which helps to quickly discover potential network attacks; the efficiency of the anomaly detection model directly affects the response speed and accuracy of security defense; by using the training set to train the multi-level model, the parameters of the active security defense model can be optimized to improve the overall performance and stability of the model. The optimized parameters can make the model more efficient and reliable in practical applications. Step S303 deploys the trained active security defense model and analyzes the network traffic in real time. After the trained active security defense model is deployed to the network node, the model can analyze the network traffic in real time and generate the evaluation results of potential network attacks. The real-time monitoring capability enables the security team to respond quickly to network threats and reduce the losses caused by attacks. According to the real-time analysis results, the model can dynamically adjust the security protection strategy, such as traffic restriction, IP blocking and protocol filtering. This dynamic adjustment capability makes the security defense more flexible and adaptable, and can cope with the ever-changing network threats. Feedback the real-time analysis results to the active security defense model training layer, and dynamically update the model parameters. The continuous optimization mechanism ensures that the model can continuously adapt to the new network environment and attack methods, and maintain its efficiency and accuracy. Through these steps, the active security defense model can not only effectively identify and respond to network threats, but also continuously optimize its own performance, providing strong protection for network security.

[0121] Embodiment 7:

[0122] like Figure 7 As shown, based on Example 6, the process of constructing a multi-level active security defense model in step S302 provided in the embodiment of the present invention includes the following steps:

[0123] Step S3021: adopt the autoregressive integrated moving average model to predict future traffic trends by capturing the autocorrelation and moving average characteristics of the time series; clean, normalize and differentiate the historical traffic data, and use grid search to optimize the parameters of the autoregressive integrated moving average model; evaluate the performance of the autoregressive integrated moving average model on different data subsets by using K-fold cross validation; adopt the rolling prediction method to continuously update the autoregressive integrated moving average model using the latest historical traffic data to generate traffic prediction results for a period of time in the future;

[0124] Step S3022: using the isolation forest model, randomly dividing the data space, identifying anomalies, extracting anomaly samples such as DDoS attack traffic and malicious scanning traffic from historical data, and building a training set for the anomaly detection model; extracting features such as traffic size, data packet length distribution, and protocol type from traffic data as inputs to the anomaly detection model; using anomaly samples for training and optimizing model parameters; inputting real-time collected network traffic data into the anomaly detection model, performing real-time anomaly detection, generating anomaly scores, and evaluating the severity of abnormal behavior in real-time traffic data;

[0125] Step S3023: Divide the multi-level model into a time series prediction layer and an anomaly detection layer to form a bottom-up hierarchical structure; design the time series prediction model and the anomaly detection model as independent modules, and use the prediction results of the time series prediction model as the input of the anomaly detection model to achieve data flow between the layers; in the anomaly detection layer, compare the real-time traffic data with the prediction results to identify abnormal traffic behaviors that do not match the prediction results; feed back the anomaly detection results to the time series prediction layer to update the prediction model;

[0126] Step S3024: Use the training set to jointly train the multi-level model to optimize the parameters of each level model; based on the real-time analysis results, continuously update the parameters of the multi-level model.

[0127] In the above embodiment, step S3021 constructs and optimizes the time series prediction model. The autoregressive integrated moving average model can accurately predict future traffic trends by capturing the autocorrelation and moving average characteristics of the time series, providing a reliable benchmark for anomaly detection; the historical traffic data is cleaned, normalized and differentially processed to ensure the quality and consistency of the data and improve the prediction accuracy of the model; the parameters of the autoregressive integrated moving average model are optimized using grid search to ensure the stability of the model's performance on different data subsets and improve the generalization ability of the model; a rolling prediction method is used to continuously update the model using the latest historical data to generate traffic prediction results for a period of time in the future, ensuring the real-time and accuracy of the prediction results. Step S3022: Construction and optimization of the anomaly detection model. The isolation forest model can quickly identify anomalies by randomly dividing the data space. It is suitable for anomaly detection of high-dimensional data and has low computational complexity. Abnormal samples such as DDoS attack traffic and malicious scanning traffic are extracted from historical data to build a training set for the anomaly detection model to ensure that the model can effectively identify various abnormal behaviors. Features such as traffic size, data packet length distribution, and protocol type are extracted from traffic data as inputs to the anomaly detection model to improve the recognition ability of the model. The real-time collected network traffic data is input into the anomaly detection model to perform real-time anomaly detection, generate anomaly scores, and evaluate the severity of abnormal behaviors in real-time traffic data to ensure real-time monitoring of network security. Step S3023: Integration and data flow of multi-level models. The time series prediction model and the anomaly detection model are designed as independent modules to facilitate module replacement and upgrading, and improve the flexibility and maintainability of the system. The prediction results of the time series prediction model are used as the input of the anomaly detection model to realize data flow between levels and ensure information transmission and collaborative work between models at each level. The anomaly detection results are fed back to the time series prediction layer to update the prediction model, improve the adaptability and accuracy of the model, and ensure that the model can adapt to the dynamic changes of network traffic. Step S3024: Joint training and continuous optimization of multi-level models. Use the training set to jointly train the multi-level models, optimize the parameters of the models at each level, ensure the overall performance and stability of the model, and improve the prediction and detection capabilities of the model. In the joint training process, the overall prediction and detection capabilities of the model are improved through collaborative optimization between levels, ensuring that the model can effectively cope with complex network environments. Based on real-time analysis results, the parameters of the multi-level model are continuously updated to ensure that the model can adapt to the dynamic changes of network traffic and improve the real-time and accuracy of the system. Through the above steps, the multi-level active security defense model can effectively combine time series prediction and anomaly detection to achieve comprehensive monitoring and dynamic defense of network traffic, ensuring the security and stability of the network.

[0128] Embodiment 8:

[0129] like Figure 8 As shown, based on Example 7, the process of forming a bottom-up hierarchical structure in step S3023 provided in this embodiment of the present invention includes the following steps:

[0130] Step S30231: The future traffic prediction results generated by the time series prediction layer are converted into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependency and periodicity characteristics of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model.

[0131] Step S30232: In the anomaly detection layer, the real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type, and then fused with the high-dimensional feature vector transmitted by the time series prediction layer to form a comprehensive feature space;

[0132] Step S30233: Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the anomaly detection threshold; in the anomaly detection layer, the real-time traffic data and the prediction results are compared and analyzed at multiple levels to identify the traffic behavior that obviously deviates from the prediction results, and the traffic data is analyzed in time series to capture abnormal patterns; the identified abnormal traffic behavior is clustered and analyzed, and different types of abnormal behaviors are classified to distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning.

[0133] In the above embodiment, the generation and transmission of high-dimensional feature vectors in step S30231 converts the future traffic prediction results of the time series prediction layer into high-dimensional feature vectors through data processing and feature extraction. These feature vectors not only contain traffic trend information, but also embed the time dependence and periodicity characteristics of historical traffic patterns; refined feature extraction provides a richer reference benchmark for the anomaly detection layer and enhances the accuracy of anomaly detection; the generation of high-dimensional feature vectors improves the data expression ability, so that the anomaly detection model can more comprehensively understand and analyze traffic data, thereby more effectively identifying abnormal behavior. Step S30232 multi-dimensional feature fusion: in the anomaly detection layer, real-time traffic data is pre-processed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type, and is fused with the high-dimensional feature vectors transmitted by the time series prediction layer to form a comprehensive feature space; multi-dimensional feature fusion enables the anomaly detection model to more comprehensively capture the dynamic changes and potential anomalies of traffic data; by fusing multi-dimensional features, the anomaly detection model can not only identify anomalies in traffic size, but also capture anomalies in packet length distribution, protocol type, etc., thereby improving the comprehensiveness and accuracy of anomaly detection. Step S30233 Dynamic threshold setting and multi-level comparative analysis: Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the threshold for anomaly detection. The dynamic threshold setting enables the anomaly detection model to flexibly adjust the sensitivity of detection according to the fluctuation of real-time traffic data, avoiding the false alarm and missed alarm problems caused by fixed thresholds. In the anomaly detection layer, real-time traffic data and prediction results are compared and analyzed at multiple levels. First, the traffic behavior that obviously deviates from the prediction results is quickly identified through numerical comparison; then, the deep learning model is used for time series analysis to capture more subtle abnormal patterns. The multi-level comparative analysis improves the accuracy and efficiency of anomaly detection; the identified abnormal traffic behavior is clustered and analyzed, and different types of abnormal behaviors are classified to further distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning. This refined processing of clustering and classification improves the accuracy and pertinence of anomaly detection.

[0134] In summary, the data flow between the levels of this embodiment not only realizes the fusion of prediction results and real-time data, but also improves the accuracy and efficiency of anomaly detection through dynamic threshold setting and multi-level comparative analysis. Specifically including: refined feature extraction, enhanced data expression capabilities, comprehensive feature space construction, improved comprehensiveness of anomaly detection, dynamic threshold setting, multi-level comparative analysis, and abnormal behavior clustering and classification, making the anomaly detection system more intelligent and efficient. Through refined processing and multi-level comparative analysis, the data flow between the levels not only realizes the fusion of prediction results and real-time data, but also improves the accuracy and efficiency of anomaly detection through dynamic threshold setting and abnormal behavior clustering and classification, which meets the requirements of innovation.

[0135] Embodiment 9:

[0136] like Fig. 9 As shown, based on Example 8, the process of identifying the traffic behavior that obviously deviates from the prediction result in step S30233 provided in the embodiment of the present invention includes the following steps:

[0137] Step S302331: The anomaly detection layer makes a preliminary comparison between the real-time traffic data and the prediction results of the time series prediction layer, and determines whether the traffic data significantly deviates from the normal range based on the preset threshold. Then, the traffic data is locally compared by sliding the time window to identify abnormal fluctuations in a short period of time, and a global comparison is made in combination with the historical traffic data to capture abnormal changes in long-term trends.

[0138] Step S302332: extracting time series features, through time series analysis of network traffic data, extracting network traffic size, change rate, fluctuation amplitude and other features, reflecting the current state of network traffic, and also including the time dependence and periodicity characteristics of historical traffic patterns; through feature extraction, converting network traffic data into high-dimensional time series feature vectors;

[0139] Step S302333: Perform local pattern recognition on the time series features to capture local anomalies in the network traffic data; perform global pattern recognition on the time series features to capture long-term abnormal trends in the network traffic data to capture abnormal patterns.

[0140] In the above embodiment, step S302331, the anomaly detection layer makes a preliminary comparison between the real-time traffic data and the prediction results of the time series prediction layer; by setting a preset threshold, it can quickly identify whether the traffic data deviates significantly from the normal range; by sliding comparison of the time window, it can capture abnormal fluctuations in a short period of time, and combined with the global comparison of historical data, it can identify abnormal changes in long-term trends; it can timely discover abnormal behavior in traffic and provide basic data for analysis. Step S302332 extracts time series features. By analyzing the time series of traffic data, it extracts features such as traffic size, rate of change, and fluctuation amplitude, which can fully reflect the current state of network traffic. At the same time, the time dependence and periodicity characteristics of historical traffic patterns are extracted, and the traffic data is converted into high-dimensional time series feature vectors, providing rich data support for pattern recognition; the analyzability of the data is enhanced, making anomaly detection more accurate. Step S302333 performs local pattern recognition and global pattern recognition on the time series features. Through local pattern recognition, local anomalies in the traffic data can be captured, and abnormal behaviors in a short period of time can be discovered in time; through global pattern recognition, long-term abnormal trends in the traffic data can be captured, and potential systemic problems can be identified; it can fully cover the detection needs of traffic anomalies and improve the system's early warning capabilities and response speed.

[0141] In summary, the steps of this embodiment form a complete anomaly detection process through data comparison, feature extraction and pattern recognition, which can effectively identify abnormal behaviors in network traffic and ensure the stable operation of the network. This embodiment realizes comprehensive analysis of traffic data and accurate anomaly detection through hierarchical timing analysis and abnormal pattern capture process. The specific process includes preliminary deviation identification, multi-level comparative analysis, timing feature extraction, abnormal pattern capture, and abnormal behavior clustering and classification. It not only improves the accuracy and efficiency of anomaly detection, but also enhances the intelligence and adaptability of the system.

[0142] Embodiment 10:

[0143] like Fig.10 As shown, based on Example 9, the process of capturing the abnormal mode in step S302333 provided in the embodiment of the present invention includes the following steps:

[0144] Step S3023331: Acquire the data of local abnormal points, including the timestamp, abnormal degree, and abnormal characteristics (such as flow size, change rate, fluctuation amplitude, etc.) of the abnormal points; and simultaneously acquire the data of global abnormal points, including the timestamp, abnormal degree, and abnormal characteristics (such as long-term trend change, periodic change, etc.) of the abnormal points;

[0145] Step S3023332: align the local outlier points and the global outlier points according to the timestamps, calculate the respective weights according to the outlier degrees of the local outlier points and the global outlier points, perform weighted fusion on the local outlier points and the global outlier points according to their respective weights, and generate a comprehensive outlier point, the outlier degree of the comprehensive outlier point being the weighted sum of the outlier degrees of the local outlier points and the global outlier points;

[0146] Step S3023333: Take local anomaly points and global anomaly points as initial clustering centers, perform hierarchical clustering, and generate multiple anomaly clusters based on the feature similarity between the anomaly points. Each anomaly cluster represents a similar anomaly pattern. Use the mean to perform a comprehensive evaluation on each anomaly cluster and calculate its degree of anomaly. According to the characteristics of the anomaly cluster, determine its local or global anomaly type. According to the comprehensive evaluation results, generate the final anomaly pattern. Each anomaly pattern contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly, and the possible cause analysis of the anomaly.

[0147] In the above embodiment, step S3023331 obtains the data of the abnormal point, and by obtaining the data of the local abnormal point and the global abnormal point, the comprehensiveness of the abnormal detection is ensured; the local abnormal point can capture the abnormal fluctuation in a short period of time, while the global abnormal point can capture the abnormal changes in the long-term trend. The combination of the two can more comprehensively reflect the abnormal situation of the network traffic; the timestamp, abnormal degree, and abnormal characteristics (such as traffic size, change rate, fluctuation amplitude, etc.) of the abnormal point are obtained, which provides a rich data basis for abnormal pattern analysis. Step S3023332 data alignment and weighted fusion, by aligning the local abnormal point and the global abnormal point according to the timestamp, ensures the consistency of the data in the time dimension and avoids the analysis error caused by time dislocation; by calculating the weights of the local abnormal point and the global abnormal point, and performing weighted fusion, the generated comprehensive abnormal point can more accurately reflect the overall situation of the abnormality; the weighted fusion method makes the abnormal points with higher abnormal degree have greater influence in the fusion process, and improves the accuracy of abnormal detection. Step S3023333 hierarchical clustering and comprehensive evaluation, through the hierarchical clustering method, local anomalies and global anomalies are clustered to generate multiple anomaly clusters; each anomaly cluster represents a class of similar anomaly patterns, which can more clearly identify different types of abnormal behaviors; each anomaly cluster is comprehensively evaluated using the mean, and its degree of anomaly is calculated, which can quantify the severity of the anomaly and provide a basis for anomaly analysis and processing; according to the characteristics of the anomaly cluster, its local or global anomaly type is determined, which can more accurately classify abnormal behaviors and provide guidance for targeted processing measures; based on the comprehensive evaluation results, the final anomaly pattern is generated, each anomaly pattern contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly and the possible cause analysis of the anomaly; this information provides network management personnel with a detailed anomaly report, which helps to take timely countermeasures.

[0148] In summary, this embodiment ensures the comprehensiveness of anomaly detection and the richness of data, improves the accuracy of anomaly detection and the reflection of the overall situation; clearly identifies different types of abnormal behaviors, quantifies the severity of the anomaly, and provides a basis for subsequent processing; accurately classifies abnormal behaviors, generates detailed abnormal reports, and helps to respond in a timely manner. This makes the capture of abnormal patterns more comprehensive, accurate, and efficient, and improves the reliability and practicality of network traffic anomaly detection.

[0149] Fig.11 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present invention is shown.

[0150] The electronic device may include a central processing unit / microprocessor / main control chip, etc. 1; a storage medium 2, coupled to the central processing unit / microprocessor / main control chip, etc. 1, and storing computer executable instructions therein, for performing the steps of each method of an embodiment of the present invention when executed by the processor.

[0151] The central processing unit / microprocessor / main control chip etc. 1 may include but is not limited to, for example, one or more processors or microprocessors etc.

[0152] The storage medium 2 may include, but is not limited to, for example, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (such as hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0153] In addition, the electronic device may also include (but not limited to) a data bus 3, an input / output bus / external bus / device bus 4, a display 5, and input / output devices 6 (eg, keyboard, mouse, speaker, etc.).

[0154] The central processing unit / microprocessor / main control chip etc. 1 can communicate with external devices ( 5 , 6 etc.) through the I / O bus 4 via a wired or wireless network (not shown).

[0155] The storage medium 2 may also store at least one computer executable instruction for executing the various functions and / or method steps in the embodiments described in the present technology when the instruction is executed by the central processing unit / microprocessor / main control chip 1.

[0156] In one embodiment, the at least one computer executable instruction may also be compiled into or constitute a software product, wherein one or more computer executable instructions are executed by a processor to perform the various functions and / or method steps in the embodiments described in the present technology.

[0157] Fig.12 A schematic diagram of a computer-readable storage medium according to an embodiment of the present invention is shown.

[0158] like Fig.12 As shown, instructions are stored on the non-transitory computer-readable storage medium 8, and the instructions are, for example, computer-readable instructions 7. When the computer-readable instructions 7 are executed by the processor, the various methods described above can be executed. The non-transitory computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-transitory non-volatile memory may include, for example, a read-only memory (ROM), a hard disk, a flash memory, etc. For example, the non-transitory computer-readable storage medium 11 can be connected to a computing device such as a computer, and then, when the computing device runs the computer-readable instructions 10 stored on the computer-readable storage medium 11, the various methods described above can be performed.

[0159] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0162] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for executing all or part of the steps of the various embodiments of the method of the present invention through a computer device (which can be a personal computer, a server, or a network device, etc.). The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (full name in English: Read-Only Memory, English abbreviation: ROM), random access memory (full name in English: Random Access Memory, English abbreviation: RAM), disk or optical disk and other media that can store program codes.

[0163] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An active security defense method based on network traffic time pattern and data volume analysis, characterized in that: The process of capturing abnormal patterns is realized by using active security defense models, and the data of local abnormal points and global abnormal points are obtained; Align the local outlier points and the global outlier points according to the timestamps, calculate their respective weights according to their outlier degrees, perform weighted fusion on the local outlier points and the global outlier points according to their respective weights, and generate a comprehensive outlier point. The outlier degree of the comprehensive outlier point is the weighted sum of the outlier degrees of the local outlier points and the global outlier points. Local anomaly points and global anomaly points are used as initial cluster centers for hierarchical clustering. Hierarchical clustering is performed based on the feature similarity between anomaly points to generate multiple anomaly clusters, each of which represents a similar anomaly pattern. The mean is used to perform a comprehensive evaluation on each anomaly cluster to calculate its degree of anomaly. Based on the characteristics of the anomaly cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final anomaly pattern is generated, each of which contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly, and an analysis of the possible causes of the anomaly. The active security defense model is used to analyze network traffic and obtain the evaluation results of all network attacks. The active security defense model is based on the prediction results of its time series prediction layer, and the anomaly detection layer dynamically sets the anomaly detection threshold. In the anomaly detection layer of the active security defense model, real-time traffic data and prediction results are compared and analyzed at multiple levels to identify traffic behaviors that are significantly deviated from the prediction results, and time series analysis is performed on traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are clustered and analyzed, and different types of abnormal behaviors are classified to distinguish different types of abnormal behaviors.

2. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 1, characterized in that: The future traffic prediction results generated by the time series prediction layer of the active security defense model are converted into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependency and periodicity characteristics of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model. In the anomaly detection layer, real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type, and then fused with the high-dimensional feature vector transmitted by the time series prediction layer to form a comprehensive feature space; Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the anomaly detection threshold. In the anomaly detection layer, real-time traffic data and prediction results are compared and analyzed at multiple levels to identify traffic behaviors that obviously deviate from the prediction results, and time series analysis is performed on traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are clustered and analyzed, and different types of abnormal behaviors are classified to distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning.

3. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 2, characterized in that: The process of identifying traffic behavior that significantly deviates from the predicted results includes the following steps: The anomaly detection layer makes a preliminary comparison between the real-time traffic data and the prediction results of the time series prediction layer, and determines whether the traffic data significantly deviates from the normal range based on the preset threshold. Then, the traffic data is locally compared by sliding the time window to identify abnormal fluctuations in a short period of time. Combined with historical traffic data, a global comparison is made to capture abnormal changes in long-term trends. Extract time series features. Through time series analysis of network traffic data, the size, rate of change and fluctuation range of network traffic are extracted to reflect the current state of network traffic, and also include the time dependence and periodicity characteristics of historical traffic patterns. Through feature extraction, network traffic data is converted into high-dimensional time series feature vectors. Perform local pattern recognition on time series features to capture local anomalies in network traffic data; perform global pattern recognition on time series features to capture long-term abnormal trends in network traffic data and capture abnormal patterns.

4. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 3, characterized in that: The process of capturing abnormal patterns includes the following steps: Obtain data on local outliers, including timestamps, degree of anomaly, and features of the outliers; and simultaneously obtain data on global outliers, including timestamps, degree of anomaly, and features of the outliers; Align the local outlier points and the global outlier points according to the timestamps, calculate their respective weights according to their outlier degrees, perform weighted fusion on the local outlier points and the global outlier points according to their respective weights, and generate a comprehensive outlier point. The outlier degree of the comprehensive outlier point is the weighted sum of the outlier degrees of the local outlier points and the global outlier points. Local anomaly points and global anomaly points are used as initial clustering centers for hierarchical clustering. Hierarchical clustering is performed based on the feature similarity between anomaly points to generate multiple anomaly clusters, each of which represents a similar anomaly pattern. The mean is used to perform a comprehensive evaluation on each anomaly cluster to calculate its degree of anomaly. Based on the characteristics of the anomaly cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final anomaly pattern is generated, and each anomaly pattern contains the timestamp of the anomaly, the degree of anomaly, the type of anomaly, and an analysis of the possible causes of the anomaly.

5. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 1, characterized in that: The active security defense model adopts a multi-level construction method, which includes the following steps: The autoregressive integrated moving average model is used to capture the autocorrelation and moving average characteristics of the time series to predict future traffic trends; the historical traffic data is cleaned, normalized and differentiated, and the parameters of the autoregressive integrated moving average model are optimized using grid search; the performance of the autoregressive integrated moving average model on different data subsets is evaluated by using K-fold cross validation; the rolling prediction method is used to continuously update the autoregressive integrated moving average model using the latest historical traffic data to generate traffic prediction results for a period of time in the future; The isolation forest model is used to randomly divide the data space, identify anomalies, extract DDoS attack traffic and malicious scanning traffic anomaly samples from historical data, and build a training set for the anomaly detection model; extract traffic size, packet length distribution and protocol type features from traffic data as input for the anomaly detection model; use anomaly samples for training and optimize model parameters; input real-time collected network traffic data into the anomaly detection model to perform real-time anomaly detection, generate anomaly scores, and evaluate the severity of abnormal behavior in real-time traffic data; The multi-level model is divided into a time series prediction layer and anomaly detection layer to form a bottom-up hierarchical structure; the time series prediction model and the anomaly detection model are designed as independent modules, and the prediction results of the time series prediction model are used as the input of the anomaly detection model to achieve data flow between the layers; in the anomaly detection layer, the real-time traffic data is compared with the prediction results to identify abnormal traffic behaviors that do not match the prediction results; the anomaly detection results are fed back to the time series prediction layer to update the prediction model; Use the training set to jointly train the multi-level model and optimize the parameters of each level model; based on the real-time analysis results, continuously update the parameters of the multi-level model.

6. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 5, characterized in that: The training process of the active security defense model includes the following steps: Based on time series analysis, dynamic features including traffic change rate and data volume growth rate are generated to capture short-term and long-term change trends of network traffic; A multi-level model is used to integrate the active security defense model, and the time series prediction model and anomaly detection model are combined to build a multi-level active security defense model; the time series prediction model is used to predict the future trend of normal network traffic; Anomaly detection models are used to identify abnormal traffic behaviors that are inconsistent with the predicted results; Use the training set to train the multi-level model and optimize the parameters of the active security defense model; Deploy the trained active security defense model to network nodes, analyze network traffic in real time, and generate evaluation results of potential network attacks; dynamically adjust security protection strategies based on real-time analysis results; feed back real-time analysis results to the active security defense model training layer to dynamically update the parameters of the active security defense model.

7. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 6, characterized in that: The process of obtaining the training set includes the following steps: Through intelligent perception network, the time pattern and data volume of network traffic are captured in real time, and potential attack patterns are identified and recorded. Through the fusion of multi-source data, a dynamic and comprehensive model data set is built; Analyze the model data set according to time series, automatically identify and divide time windows with similar characteristics; Identify different traffic patterns on weekdays and weekends and segment them; for the same attack type in the same area, aggregate the data into one slice; automatically identify and cluster similar attack patterns, identify and classify them; Automatically detect outliers and missing values ​​in datasets and generate alternative data using generative adversarial networks; According to the verification results, the segmentation strategy is adaptively adjusted.

8. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 7, characterized in that: The process of adaptively adjusting the segmentation strategy includes the following steps: Analyze the performance of the validation set, including key metrics such as accuracy, recall, and F1 score, to identify which types of data the model does not perform up to standard, and which attack modes or time windows do not have a good prediction effect. Detect outliers and classification errors in the data set, use clustering algorithms to classify abnormal data, and identify which anomalies are caused by improper data segmentation; Re-evaluate the division of time windows to ensure that time windows with similar characteristics are correctly divided into the same data set; re-cluster similar attack patterns to ensure that the same type of attack data is concentrated in one slice; By generating alternative data through a generative adversarial network, the ratio of attack types and normal traffic in the dataset is balanced to ensure that the model can be trained on different types of data.

9. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 7, characterized in that: The network traffic is collected by a network traffic capture tool deployed at a network node of a specific device, and the network traffic capture tool is used to obtain the time pattern and data volume of the network traffic corresponding to the network node; the process of deploying at least one network traffic capture tool includes the following steps: Initialize the network interface of the specific device, and after initialization, create a process of the network node deployed by the network traffic capture tool, and the process runs in the application of the specific device; establish communication between the specific device and the core network through the process, and send a network traffic collection instruction to the network traffic capture tool; Divide the network between the specific device and the core network into several equally spaced segments, and set the midpoint of each segment as the network node where the network traffic capture tool is deployed; Establish the mean absolute relative error objective function of network traffic capture time and determine the placement location of network traffic capture tools; After the deployment location is confirmed, the deployment location and the identifier of the network traffic capture tool are sent to the application of the specific device for storage.

10. The active security defense method based on network traffic time pattern and data volume analysis as claimed in claim 9, characterized in that: After the application is sent to a specific device for storage, the following steps need to be performed: Initialization and configuration of network traffic capture tool During the initialization phase, the network traffic capture tool obtains key parameters of the current network environment through external interfaces. The key parameters include network topology, bandwidth utilization, and device connection status; Network traffic capture tools automatically adjust configuration parameters, including dynamically selecting network interfaces and optimizing capture time intervals, or adjusting packet size limits based on network load conditions; The network traffic capture tool automatically identifies and loads drivers by analyzing the current operating system and hardware configuration; it monitors the performance of the driver in real time and dynamically switches or upgrades it.

Images