Network deception resource defense method based on deep learning

Abstract

The invention discloses a network deception resource defense method based on deep learning, and relates to the technical field of network deception resource defense, and the method comprises the steps: S1, building a network target defense network, and carrying out the camouflage deployment of a network target needing to be protected through a camouflage simulation module; s2, monitoring the camouflage simulation module in real time through a danger sensing module, and performing display early warning operation through a user side interface; s3, when the user needs to use the network resources in the data center, analyzing whether the network resources are deception resources or not through an analysis and identification subsystem; and S4, analyzing the deception resources through a deep learning subsystem, finding out a common point of the deception resources, and performing automatic identification and marking operation on other network resources. According to the invention, the feature information of the network resources is collected in multiple dimensions, the malicious data in the network resources can be accurately identified and marked, and the network defense effect is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network deception resource defense, and specifically to a network deception resource defense method based on deep learning. Background Technique

[0002] As an important form of digital industry, the network is developing faster and faster with the digitalization process of various industries in society. It is facing unprecedented security risks. There are more and more deception resources in the network, and false deception resources are constantly infiltrating in the network environment, seriously leaking personal information, financial transaction information, etc. of users. To cope with the increasingly complex network deception behavior and reduce the probability of users being deceived, a new type of network deception resource defense strategy is needed. On the one hand, a series of false information and environments are constructed to interfere with the judgment of attackers, trace and technologically counter the attackers, and on the other hand, a large number of deception resources are analyzed and identified to find their common points, thereby improving the relevant defense capabilities of network deception resources.

[0003] Based on this, a network deception resource defense method based on deep learning is now provided, which can eliminate the drawbacks of existing technical solutions. Summary of the Invention

[0004] The purpose of the present invention is to provide a network deception resource defense method based on deep learning to solve the problem in the background technique that more and more network deception behaviors require a new type of network deception resource defense strategy.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A network deception resource defense method based on deep learning includes the following usage steps:

[0007] S1. Establish a network target defense network, use the camouflage simulation module to conduct camouflage defense on the network target to be protected, and set a number of monitoring nodes in the application service honeypot unit and the system service honeypot unit;

[0008] S2. Real-time monitor the camouflage simulation module through the danger perception module. When any access behavior against the monitoring nodes is found, generate a security log for the above access behavior and perform a display and warning operation through the user interface;

[0009] S3. When the user needs to use the network resources in the data center, analyze and identify whether the network resources are deception resources through the analysis and identification subsystem, and perform a result display and warning operation through the user interface;

[0010] S4. The spoofing resources are classified into the blacklist database. The deep learning subsystem analyzes the keywords, behavior patterns, and information sources of a large number of spoofing resources to find the commonalities of the spoofing resources, builds a deep learning model, and inputs the above information features into the model to enable automatic identification and marking operations on other network resources.

[0011] Preferably, the camouflage defense in step S1 includes network camouflage, IP camouflage, port camouflage, application software camouflage, operating system camouflage, file camouflage, and image and audio camouflage.

[0012] Preferably, step S3 includes:

[0013] S31. The analysis and identification subsystem analyzes whether the network resources are spoofing resources and performs inspection and identification operations in a multi-dimensional manner. The multi-dimensional analysis includes content review analysis, keyword analysis, technical analysis, behavior pattern analysis, and feedback analysis.

[0014] S32. The judgment module determines whether the above network resources are spoofing resources and classifies them into the corresponding databases. If the above network resources are identified as spoofing resources, after performing spoofing marking operations on the above resources, the resources are classified into the blacklist database. If the above network resources are identified as normal resources, the above normal resources are stored in the security database.

[0015] S33. The result is displayed and early warning operations are performed through the user interface. If it is a spoofing resource, the user is prompted through the interface to abandon using the resource. If it is a normal resource, the user is prompted that they can continue to use it.

[0016] Preferably, it further includes a network spoofing resource defense system based on deep learning. The system includes:

[0017] A data center for collecting, storing big data, and the data information of each subsystem.

[0018] A supervision center for real-time supervision of the data information of each subsystem, realizing information sharing with the data center, and timely transmitting the display results and early warning information to the user side.

[0019] A user side for remotely viewing the data information output by the data center and the supervision center and performing corresponding instruction operations based on the above data information.

[0020] A simulation subsystem for performing camouflage operations on network targets to be protected and delaying attack behaviors.

[0021] An analysis and identification subsystem for performing multi-dimensional analysis on network resources and determining whether the network resources are spoofing resources based on the above analysis results. The multi-dimensional analysis includes content review analysis, keyword analysis, and behavior pattern analysis.

[0022] A deep learning subsystem is used to find the commonalities among a large number of fraudulent resources in the blacklist database, and establish a deep learning model based on the above commonalities to perform automatic identification and interception operations on fraudulent resources.

[0023] Preferably, the data center includes a network database, a security database, and a blacklist database. The network database is used to collect, store, and provide resource information of big data. The security database is used to store network data that is analyzed as normal resources. The blacklist database is used to store network data that is analyzed as fraudulent resources and marked as fraudulent.

[0024] Preferably, the blacklist database is used to receive and store network fraudulent resources, and divide the above network fraudulent resources into several groups according to different time, review content, keywords, behavior patterns, and feedback information. Each group includes at least one network fraudulent resource.

[0025] Preferably, the supervision center includes a controller and an execution terminal. The controller is used to receive and output the information results of each subsystem and the data center, and output coordination instructions. The execution terminal is used to receive the coordination instructions of the controller and publish information according to the instructions.

[0026] Preferably, the simulation subsystem includes:

[0027] A disguise simulation module is used to generate network honeypots. The honeypots include an application service honeypot unit and a system service honeypot unit.

[0028] A danger perception module is used to monitor the buried network honeypots and obtain the monitoring data of the monitoring unit. The monitoring unit includes a file monitoring unit, a network monitoring unit, a process monitoring unit, and an image and audio monitoring unit.

[0029] A traceability and countermeasure module is used to perform traceability operations on the behavior when there is an attack or access to the monitoring node, obtain the behavior pattern and source of the behavior, and generate a security log and a warning reminder based on the above monitoring information.

[0030] The disguise simulation module, the danger perception module, and the traceability and countermeasure module are interconnected with each other.

[0031] Preferably, the analysis and identification subsystem includes:

[0032] A content review module is used to review whether the content of network resources contains false propaganda, false promises, obvious exaggeration, inducing users to provide personal information, and information for financial transactions. The content includes text, picture, and video information.

[0033] A keyword analysis module, which is used to extract keywords from network resources and compare them with the known fraud resource keywords in the data center;

[0034] A technical analysis module, which is used to observe the URLs of network resources and check whether the above network resources use the HTTPS protocol and whether there are malicious codes and links;

[0035] A behavior pattern analysis module, which is used to analyze the behavior patterns of network resources and perform comparison operations based on the above pattern features with the known fraud behavior patterns in the data center. The behavior patterns include traffic patterns and user interaction patterns;

[0036] A feedback analysis module, which is used to retrieve and collect feedback from other users on the above network resources. The feedback includes usage experience and security evaluation;

[0037] A judgment module, which is used to judge whether a network resource is a fraud resource and classify the network resource into the corresponding database based on the above results;

[0038] The judgment module is interconnected with the content review module, the keyword analysis module, the technical analysis module, the behavior pattern analysis module, and the feedback analysis module.

[0039] Preferably, the deep learning subsystem includes:

[0040] A feature extraction module, which is used to extract multi-modal features from known network fraud resources. The multi-modal features include but are not limited to text keywords, behavior patterns, traffic features, and image pixel features;

[0041] A deep learning model module, which is used to construct a deep learning model using known network fraud resources and input the above extracted features into the deep learning model;

[0042] A data classification module, which is used to automatically identify and classify other network resources using the trained deep learning model;

[0043] The feature extraction module, the deep learning model module, and the data classification module are interconnected.

[0044] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0045] The present invention combines the data processing ability of deep learning and the decision-making optimization ability of reinforcement learning, facilitating the handling of increasingly complex network deception resources. It can continuously learn and optimize, realizing the automatic identification and interception of network deception resources, reducing the number of manual interventions. A simulation subsystem is set up to protect the user's own network targets, effectively ensuring the security of personal information and property. With the cooperation of the analysis and identification subsystem and the deep learning subsystem, it is convenient to collect the characteristic information of network resources from multiple dimensions, realizing the accurate identification and marking of malicious data in network resources, avoiding the user from coming into contact with similar malicious data again when searching for resources later, and improving the network defense effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the usage process of the present invention.

[0047] Figure 2 It is a schematic diagram of the process of step S3 of the present invention.

[0048] Figure 3 It is a schematic diagram of the overall structure of the defense system of the present invention.

[0049] Figure 4 It is a schematic diagram of the structures of the data center and the supervision center of the present invention.

[0050] Figure 5 It is a schematic diagram of the structure of the simulation subsystem of the present invention.

[0051] Figure 6 It is a schematic diagram of the structure of the analysis and identification subsystem of the present invention.

[0052] Figure 7 It is a schematic diagram of the structure of the deep learning subsystem of the present invention.

[0053] Annotation of reference numerals in the drawings: Data center 100, Network database 110, Security database 120, Blacklist database 130, Supervision center 200, Controller 210, Execution terminal 220, User terminal 300, Simulation subsystem 400, Disguise simulation module 410, Application service honeypot unit 411, System service honeypot unit 412, Danger perception module 420, File monitoring unit 421, Network monitoring unit 422, Process monitoring unit 423, Image and audio monitoring unit 424, Tracing and countermeasure module 430, Analysis and identification subsystem 500, Content review module 510, Keyword analysis module 520, Technical analysis module 530, Behavior pattern analysis module 540, Feedback analysis module 550, Judgment module 560, Deep learning subsystem 600, Feature extraction module 610, Deep learning model module 620, Data classification module 630. DETAILED DESCRIPTION OF THE INVENTION

[0054] In order to make the objectives, technical solutions and advantages of the present invention more clear and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0055] In this embodiment, as Figure 1 - Figure 7 shown, a network deception resource defense method based on deep learning includes the following usage steps:

[0056] S1. Establish a network target defense network, and use the disguise simulation module 410 to disguise and defend the network target to be protected. A number of monitoring nodes are set in the application service honeypot unit 411 and the system service honeypot unit 412;

[0057] The above steps set false information so that the network target appears to be a "normal target" to cover up real network activities, confuse malicious attackers or other users, and ensure the personal information security and property security of users;

[0058] S2. Real-time monitor the disguise simulation module 410 through the danger perception module 420. When any access behavior to the monitoring nodes is found, the above access behavior generates a security log, and a warning operation is displayed through the user interface 300;

[0059] Ensure its normal operation and effectively attract potential attackers. Abnormal access behaviors include, but are not limited to, attempts to log in, data queries, file downloads, etc. The content of the security log includes, but is not limited to, access time, access source, access type, access result, etc.;

[0060] S3. When the user needs to use the network resources in the data center 100, analyze and identify whether the network resources are deception resources through the analysis and identification subsystem 500, and display the results and perform a warning operation through the user interface 300;

[0061] The network resources are divided into deception resources and security resources, and corresponding blacklist databases 130 and security databases 120 are provided for the convenience of the user's next use;

[0062] S4. The deception resources are classified into the blacklist database 130. The deep learning subsystem 600 analyzes the keywords, behavior patterns and information sources of a large number of deception resources, finds the common points of the deception resources, establishes a deep learning model, and inputs the above information features into the model to automatically identify and mark other network resources;

[0063] The above steps require preprocessing the spoofing resources extracted from the blacklist database 130, including steps such as data cleaning, feature selection, and feature scaling. Then, using the preprocessed data, a hybrid modal neural network architecture (including CNN for image feature extraction, Transformer for text sequence modeling, and LSTM for traffic time series analysis) is used for model training, and the weights and bias parameters of the model are continuously optimized through the backpropagation algorithm. The trained deep learning model can automatically identify and classify other network resources, classifying network data into two categories: one is network spoofing data containing malicious data, and the other is normal data without malicious data, thereby realizing the prediction of network spoofing types based on multi-modal data.

[0064] The following are the specific operations for data preprocessing:

[0065] Data cleaning: Conduct a comprehensive screening of the data in the blacklist database 130, remove duplicate records to prevent redundant data from interfering with model training; at the same time, carefully identify and correct the error values in the data, such as incorrect URL formats, garbled characters, etc.; for missing values, use the multiple imputation method to ensure the integrity of the data.

[0066] Sample balancing processing: Since the sample quantities of various spoofing resources in the blacklist database 130 are severely unbalanced, to prevent the deep learning model from being biased towards the majority class samples, a method combining oversampling and undersampling is adopted; the SMOTE algorithm is used to synthesize and expand the minority class samples to generate new synthetic samples, increasing the quantity of minority class samples and enhancing their proportion in the training set; for the majority class samples, a random undersampling strategy is adopted, randomly selecting and deleting some samples to reduce the quantity of majority class samples, making the distribution of sample quantities of each class more balanced and enhancing the model's recognition ability for each class of samples.

[0067] Feature selection: The RFE algorithm is used to continuously and recursively delete the features that contribute less to the model performance, retain the important features, utilize its powerful classification ability on the multi-feature dataset to evaluate the importance of each feature to the classification result, screen out the most representative feature subset that is most helpful for improving the model performance, reduce the data dimension, and lower the model training complexity.

[0068] Pretraining and Encoding Methods: For image-based spoofing resources, a pre-trained CNN model on a large-scale image dataset is used for feature extraction. The image data is input into the pre-trained model, and the output of a specific layer of the model is obtained as the feature representation of the image. For text-based spoofing resources, a pre-trained language model is selected for feature extraction and encoding. During encoding, word embedding technology is used for words or characters in the text, mapping each word to a low-dimensional vector to capture the semantic relationships between words. Then, combined with positional encoding, the order information of the text is retained, providing high-quality input for subsequent Transformer model processing. For network traffic data, during encoding, unique encoding is used for categorical features (such as protocol type, connection status, etc.) in the traffic data, and numerical features (such as traffic volume, connection duration, etc.) are normalized and used as the input of the LSTM model.

[0069] Among them, as Figure 1 shown, the camouflage defense in step S1 includes network camouflage, IP camouflage, port camouflage, application software camouflage, operating system camouflage, file camouflage, and image and audio camouflage. The purpose of camouflage defense is to protect the network system and data from attacks through camouflage and deception means. For example, IP camouflage can change and hide the real IP address through a proxy server, virtual private network (VPN), or other IP camouflage tools to hide the network identity of the device. Through the above methods, they can all be used to protect personal privacy and thus improve security.

[0070] Among them, as Figure 1 and Figure 2 shown, step S3 includes:

[0071] S31. Analyze whether the network resource is a spoofing resource through the analysis and recognition subsystem 500, and perform inspection and recognition operations in a multi-dimensional manner. The multi-dimensional analysis includes content review analysis, keyword analysis, technical analysis, behavior pattern analysis, and feedback analysis;

[0072] S32. Judge whether the above network resource is a spoofing resource through the judgment module 560 and classify it into the corresponding database. If the above network resource is identified as a spoofing resource, after performing a spoofing marking operation on the above resource, it is classified into the blacklist database 130. If the above network resource is identified as a normal resource, the above normal resource is stored in the security database 120;

[0073] S33. Perform result display and warning operations through the interface of the user terminal 300. If it is a spoofing resource, prompt the user to abandon using the resource through the interface. If it is a normal resource, prompt the user that they can continue to use it.

[0074] Among them, as Figure 3 - Figure 7As shown, it also includes a network deception resource defense system based on deep learning, which includes:

[0075] A data center 100, which is used to collect and store big data and data information of each subsystem, integrate and preprocess the data for subsequent analysis and supervision;

[0076] A supervision center 200, which is used to supervise the data information of each subsystem in real time. The data information includes but is not limited to network traffic, system status, security logs, etc., and timely transmits the display results and warning information to the user terminal 300 for information sharing;

[0077] A user terminal 300, which is used to remotely view the data information output by the data center 100 and the supervision center 200, and perform corresponding instruction operations based on the above data information. The user terminal 300 aims at ease of use and real-time performance, supports multi-platform access such as PCs, mobile devices, etc., and facilitates users to intuitively understand the data and make decisions;

[0078] A simulation subsystem 400, which is used to perform camouflage operations on network targets to be protected, delay attack behaviors, attract and detect attack behaviors through camouflage operations, so as to collect information of attackers, attack methods, etc., and facilitate adjusting the camouflage strategy according to the changes of attack behaviors to improve the protection effect;

[0079] An analysis and identification subsystem 500, which is used to perform multi-dimensional analysis on network resources and judge whether the network resources are deception resources based on the above analysis results. The multi-dimensional analysis includes content review analysis, keyword analysis, and behavior pattern analysis;

[0080] A deep learning subsystem 600, which is used to find the common points of a large number of deception resources in the blacklist database 130, establish a deep learning model based on the above common points, and perform automatic identification and interception operations on deception resources. The common points include keywords, behavior patterns, and abnormal access information.

[0081] Among them, such as Figure 3 and Figure 4As shown, the data center 100 includes a network database 110, a security database 120 and a blacklist database 130. The network database 110 is used to collect, store and provide resource information of big data. The security database 120 is used to store network data that is normal resources after analysis. The blacklist database 130 is used to store network data that is fraudulent resources and is marked as fraudulent after analysis. Different databases are used to store different types of network data for subsequent use. In addition, the blacklist database 130 is provided to mark the fraudulent resources so that the resources can be automatically filtered when used next time. The network database 110 cooperates with professional network security monitoring agencies to It obtains its long-accumulated database of malicious network activities, which covers a large number of labeled network deception samples, including disguised communication data involved in complex APT (advanced persistent threat) attacks. Under the premise of legality, compliance and security protection, it collects data traces generated by new deception tools and technologies, such as emerging social engineering fraud texts, targeted phishing website templates, etc. It deploys internal network monitoring nodes to capture suspected deception traffic in the internal network of an enterprise or organization in real time, such as abnormal email attachments from the outside, malicious connection attempts disguised as legitimate services in the internal network, etc., and archives these real-time data in time for subsequent analysis.

[0082] Among them Figure 4 As shown, the blacklist database 130 is used to receive and store network deception resources, including but not limited to phishing websites, malware links, fraudulent emails, etc., to provide data support for subsequent analysis and response, and divide the above network deception resources into several groups according to different times, review contents, keywords, behavior patterns and feedback information. It can identify the high-incidence deception types in a specific time period, help understand the methods and purposes of the deceivers, and help analyze the behavior patterns of deceptive behaviors. Each group includes at least one network deception resource, which is convenient for improving recognition efficiency and increasing the accuracy of defense measures.

[0083] Among them Figure 3 and Figure 4 As shown, the supervision center 200 includes a controller 210 and an execution terminal 220. The controller 210 is used to receive and output information results of each subsystem and the data center 100, and output coordination instructions. The execution terminal 220 is used to receive the coordination instructions of the controller 210 and publish information according to the instructions. The publishing channels include but are not limited to mobile device push, voice broadcast system, etc., which can quickly and accurately convey relevant information to designated recipients.

[0084] Among them Figure 3 - Figure 5 As shown, the simulation subsystem 400 includes:

[0085] The camouflage simulation module 410 is used to generate network honeypots. The honeypots include an application service honeypot unit 411 and a system service honeypot unit 412, which are used to simulate target systems or services in a real network environment to attract potential attackers;

[0086] The danger perception module 420 is used to monitor the buried network honeypots and obtain the monitoring data of the monitoring unit. The monitoring unit includes a file monitoring unit 421, a network monitoring unit 422, a process monitoring unit 423, and an image and audio monitoring unit 424. It receives the access logs and behavior data output by the camouflage simulation module 410, and outputs the detected abnormal behaviors or potential attack information to the traceability and countermeasure module 430 for real-time data exchange with the camouflage simulation module 410 to ensure the accuracy and timeliness of monitoring;

[0087] The traceability and countermeasure module 430 is used to perform traceability operations on behaviors when there are behaviors of attacking or accessing the monitoring nodes, obtain the behavior patterns and sources of the behaviors, and generate security logs and warning reminders based on the above monitoring information to facilitate tracing the sources of attackers and formulating corresponding counterattack strategies. The strategies may include blocking attacks, tracking attackers, collecting evidence, etc.;

[0088] The camouflage simulation module 410, the danger perception module 420, and the traceability and countermeasure module 430 are interconnected to facilitate the transfer and sharing operations of information and data.

[0089] Among them, as Figure 3 - Figure 6 shown, the analysis and recognition subsystem 500 includes:

[0090] The content review module 510 is used to review whether the content of network resources contains false propaganda, false promises, obvious exaggerations, inducing users to provide personal information, and information for financial transactions. The content includes text, pictures, and video information, and is used to perform multi-dimensional analysis on network resources and judge whether the network resources are deceptive resources based on the above analysis results;

[0091] The keyword analysis module 520 is used to extract keywords from network resources and compare them with the known keyword of deceptive resources in the data center 100. The keywords are such as domain names, IP addresses, email addresses, etc.;

[0092] The technical analysis module 530 is used to observe the URLs of network resources and check whether the above network resources use the HTTPS protocol and whether there are malicious codes and links, and judge whether they are similar to regular websites to ensure the security of data transmission;

[0093] The behavior pattern analysis module 540 is used to analyze the behavior patterns of network resources and perform a comparison operation with the known deception behavior patterns in the data center 100 based on the above-mentioned pattern features. The behavior patterns include traffic patterns and user interaction patterns. The traffic patterns include access frequency, data transfer volume, etc. The user interaction patterns include request types, frequent access, etc.;

[0094] The feedback analysis module 550 is used to retrieve and collect feedback from other users on the above network resources. The feedback includes usage experience and security evaluation. The feedback can be used as an important reference for identifying deceptive resources and helps the defense system continuously optimize and improve the identification algorithm;

[0095] The judgment module 560 is used to determine whether a network resource is a deceptive resource and classify the network resource into the corresponding database based on the above results. It aggregates and correlates multiple data sources, analyzes and identifies the context, trends, and characteristics of the network resource, and searches for associations with other suspicious resources or fraud gangs, thereby increasing the judgment accuracy. For each collected sample, a multi-level annotation system is adopted. In addition to basic deception type annotations such as phishing attacks, malware infections, network sniffing disguises, etc., behavior feature annotations are also added, such as propagation paths, triggering conditions, language style characteristics, sentiment tendencies, and target audience characteristics, for subsequent analysis;

[0096] The judgment module 560 is interconnected with the content review module 510, the keyword analysis module 520, the technical analysis module 530, the behavior pattern analysis module 540, and the feedback analysis module 550 to facilitate the transfer and sharing of information and data.

[0097] Among them, as Figure 3 - Figure 7 shown, the deep learning subsystem 600 includes:

[0098] The feature extraction module 610 is used to extract multi-modal features from known network deception resources. The multi-modal features include but are not limited to text keywords, behavior patterns, traffic features, and image pixel features. The keywords include domain names, IP addresses, and email addresses. The behavior patterns include access frequency, request types, and data transfer volume. The information sources include link sources and publishing media, and preprocess data such as text, images, and network traffic in network deception resources;

[0099] The deep learning model module 620 is used to build a deep learning model using known network deception resources and input the above-extracted features into the deep learning model. Inside the model, a neural network architecture is used to process and learn the feature data to establish a deep learning model for identifying deceptive resources;

[0100] The data classification module 630 is used to automatically identify and classify other network resources by using the trained deep learning model, and classify network data into two categories: one is network spoofing data containing malicious data, and the other is normal data without malicious data;

[0101] The feature extraction module 610, the deep learning model module 620, and the data classification module 630 are interconnected to facilitate the automatic identification and processing of spoofing resources in network data, providing strong protection for network security.

[0102] Specifically, first, before inputting the above data into the deep learning model, the data is preprocessed:

[0103] When processing text data, use the natural language processing toolkit for in-depth cleaning, remove interference information such as HTML tags, special symbols, and garbled characters, perform stemming and lemmatization to unify different forms of words into basic forms, reduce lexical redundancy. For example, unify "running" and "runs" into "run", use the stop word list to remove common meaningless words such as "the", and at the same time combine the domain-specific stop word list to exclude general terms that frequently appear in the network security field but have little discriminative power for the model, such as common network protocol names (HTTP, TCP, etc.). Perform word segmentation, word embedding (Word2Vec / BERT), and positional encoding on the text data to generate context-aware feature vectors. The processed word vector sequence should be organized into a two-dimensional tensor with a shape of [number of samples, word vector dimension * sequence length];

[0104] When processing image data, use a professional image editing library. First, grayscale the image to reduce data complexity while retaining the main contour information of the image. Then, use Gaussian filtering to remove noise to avoid noise interfering with the subsequent feature extraction module (such as blurring the noise and miscellaneous colors caused by network transmission in a web page screenshot). Highlight the main part of the image through adaptive threshold segmentation, for example, clearly distinguish the false buttons on a phishing website from the background. Finally, according to the input requirements of the deep learning model, uniformly scale the image to a specified size (such as 224x224 pixels) and convert it into a three-dimensional tensor [number of samples, height, width, number of channels], where the common number of channels is 3 (RGB image) or 1 (grayscale image);

[0105] When processing network traffic data, a traffic analysis tool is used to parse data packets and extract the header information of the data packets, including basic metadata such as source IP, destination IP, port number, protocol type, etc. At the same time, the time interval sequence of the data packets is calculated to analyze the burst characteristics of the traffic in order to identify possible precursors of attacks, such as traffic spike patterns. For the content of the data packets, if it involves text protocols, cleaning and feature extraction are performed, and finally the network traffic features are organized into a two-dimensional tensor [number of samples, number of features].

[0106] At the input entrance of the deep learning model, a data verification mechanism is set up to ensure data integrity and rationality. The verification content includes: whether there are illegal characters in the text and whether the length exceeds the processing range of the model; whether the pixel values of the image are within the normal range and whether there are damaged or missing pixel blocks; whether the key features of the network traffic data are missing. If abnormal data is found, it is immediately marked and discarded or an attempt is made to repair it.

[0107] Facing complex multi-modal network deception scenarios and massive data, according to the above data characteristics, a suitable deep learning architecture is selected. Taking the multi-modal fusion model based on the attention mechanism as an example for the deep learning model, the parameter configurations of each layer are determined:

[0108] Input layer: For the image modality, it receives an image tensor that has been preprocessed and has a unified size (224x224x3). The preprocessing includes normalization, centering, or other adaptation operations to ensure that the data is adapted to the subsequent convolutional layer. The image tensor needs to pass through a normalization layer (BatchNorm) and a residual connection before being input into the convolutional layer.

[0109] For the text modality, it receives a two-dimensional text word vector tensor (with a shape of [number of samples, 300*100], assuming the word vector dimension is 300 and the sequence length is 100). The word vectors are mapped to a low-dimensional dense vector space through an embedding layer, and the output shape is [number of samples, 100, 300], which is convenient for subsequent processing. This tensor is then passed to the LSTM layer for sequence modeling. The network traffic features are input in the form of a two-dimensional tensor (with a shape of [number of samples, 50], assuming 50 key traffic features are extracted), and the features are preliminarily transformed through a fully connected layer to expand the dimension to 128 for data fusion with other modalities. At this time, the output tensor shape is [number of samples, 128], preparing for subsequent fusion.

[0110] Image Branch: In the task of predicting network deception types based on multimodal data, the architecture design of the image branch aims to gradually extract effective features from images. The first convolutional layer uses 64 convolutional kernels of size 3x3, with a stride of 1, padding mode of same, and activation function of ReLU. After passing the input image tensor (224x224x3) through this convolutional layer, the output feature map has a size of 224x224x64. Through this convolutional operation, the basic features of the image are initially extracted. At the same time, batch normalization is used to accelerate convergence and stabilize the training process, which helps to more accurately identify image features related to network deception in the subsequent steps. The second convolutional layer uses 128 3x3 convolutional kernels, with a stride of 1, padding mode of same, and activation function of ReLU. Batch normalization is used to accelerate convergence and stabilize the training process. The input is the feature map of the previous layer with a size of 224x224x64, and the output is a feature map of 224x224x128. This layer further extracts more complex features and expands the feature dimension based on the first layer, enhancing the representation ability for different types of image features and being more helpful for distinguishing network deception types. The third pooling layer uses max pooling, with a pooling window set to 2x2 and a stride of 2. The feature map of 224x224x128 is downsampled to obtain a feature map of 112x112x128. The pooling operation can reduce the data dimension, extract the main features, reduce the subsequent computational amount while retaining the key features useful for judging network deception types. The fourth residual module contains two 3x3 convolutional layers with 256 convolutional kernels, interspersed with batch normalization and ReLU activation functions. The gradient vanishing problem is solved through residual connections. The input is the feature map of 112x112x128, and the output is an enhanced feature map of 112x112x256. The residual module helps to deepen feature learning and can better capture the deep image features related to network deception. The fifth fully connected layer flattens the feature map after multiple convolutional and residual processes into a one-dimensional vector, connects to a fully connected layer, uses the ReLU activation function, maps the high-dimensional image features to a low-dimensional space, and obtains the final feature vector of the image branch, with a shape of [number of samples, 1024]. This feature vector will be fused with the feature vectors of other branches to provide an image-based basis for the final prediction of network deception types.

[0111] Text Branch: The text branch first passes through an embedding layer. The role of the embedding layer is to convert discrete symbols (such as words) in the text into low-dimensional vector representations, enabling the text to be effectively computed and processed in a deep learning model. The first layer of bidirectional LSTM sets the number of hidden units to 256. The text tensor ([number of samples, 100, 300]) after being processed by the embedding layer is input, and the hidden states are calculated simultaneously in both forward and backward directions along the text sequence. The output tensor shape is [number of samples, 100, 256]. The second layer uses the multi-head attention mechanism (Multi-Head Attention) to calculate the attention weights of different semantic granularities in parallel, and obtains the key feature representation of the text through weighted summation. The output shape is [number of samples, 2 * 256], highlighting the semantic part most relevant to deception judgment in the text and completing text feature extraction.

[0112] Fusion Layer: The feature vector [number of samples, 1024] of the image branch, the feature vector [number of samples, 2256] of the text branch, and the vector [number of samples, 128] after the transformation of the network traffic features are concatenated together in terms of dimensions to obtain a fused feature tensor with the shape of [number of samples, 1664] (where 1664 = 1024 + 2256 + 128). Then, it passes through a fully connected layer. The fully connected layer establishes connection relationships between each input neuron and all output neurons, and uses its learnable weight parameters to perform a non-linear transformation on the fused features. The output is the fused feature representation, which is ready to be input into the classification layer.

[0113] To avoid the isolation problem after the fusion of image features and network traffic features, a cross-attention mechanism is added to define an attention sub-module in the deep learning model module 620. By performing weighted fusion on the features of different branches, each branch's features can pay attention to the important information of other branches. The concatenated feature vector is input into the cross-attention mechanism to define the attention sub-module. For image, text, and network traffic features, the attention weights between them are calculated respectively, enabling each feature branch to adjust its own weight according to the information of other branches. According to the calculated attention weights, the features are weighted and summed to obtain a feature representation that integrates the information of different branches, thereby breaking the isolation between features and enhancing interactivity.

[0114] Classification Layer: Based on the output of the fusion layer, a Softmax classifier is connected. The number of neurons is equal to the number of deception types to be predicted. The Softmax function maps the fused features to the probability distributions of each category, and finally realizes the prediction of network deception types based on multi-modal data.

[0115] During the model training process, the preprocessed dataset is divided into a training set, a validation set, and a test set according to the deception type labels in a ratio of 8:1:1. For example, if there are 1000 pieces of data in the original dataset, belonging to three deception types A, B, and C respectively, with a quantity ratio of 3:2:1, then in the training set (800 pieces), the validation set (100 pieces), and the test set (100 pieces), the quantity ratio of the three types of samples A, B, and C should also maintain the ratio of 3:2:1, ensuring a reasonable distribution of various samples, avoiding sample imbalance in the test set, and making the model training and evaluation more representative. The model adopts an adaptive learning rate strategy (including a learning rate decay strategy), and the Adam optimization algorithm can be selected to adaptively adjust the learning rate of each parameter. The learning rate decays exponentially, using the formula lr = lr 0 ×γ t , where lr 0 is the initial learning rate, set to 0.001, γ is the decay factor, set to 0.99, and t is the number of training epochs, which can improve the generalization ability of the model, enabling it to converge quickly in the initial stage of model training and avoiding convergence stagnation caused by too small a learning rate in the later stage, thus enhancing the generalization ability of the model;

[0116] During the training process, the validation set is regularly used to evaluate the model performance. The macro-average F1-score is used as the main evaluation index, and at the same time, the area under the ROC-AUC curve is monitored to evaluate the model's ranking ability. The hyperparameters are adjusted according to the validation results. The initial values of the hyperparameters are determined based on the experience in the relevant field and the preliminary consideration of the model complexity and computing resources. L1 and L2 regularization terms are added to the loss function of the deep learning model. L1 regularization makes the weights of the model sparse, and L2 regularization makes the values of the weight parameters smaller, reducing the complexity of the model and preventing overfitting. The L1 regularization term is The L2 regularization term is where ω i is the model parameter, and L1 and L2 are the regularization coefficients, set to 0.001 and 0.0001 respectively, reducing the risk of overfitting; A Dropout layer is added between the fully connected layers of CNN, Transformer, and LSTM, and the dropout probability is set to 0.2, so that during training, each neuron is randomly discarded with a probability of 0.2, reducing the co-adaptation between neurons, preventing overfitting, and enhancing the adaptability of the model to data changes.

[0117] As described above, it is only the specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any person skilled in the art within the technical scope disclosed by this application should not easily think of changes or substitutions, and all should be covered within the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

Claims

1. A network fraud resource defense method based on deep learning, characterized in that: The usage steps include the following: S1. Establish a network target defense network, use a camouflage simulation module (410) to camouflage and deploy defenses on network targets that need to be protected, and set up several monitoring nodes in the application service honeypot unit (411) and the system service honeypot unit (412); S2, monitoring the camouflage simulation module (410) in real time through the danger perception module (420), when any access behavior to the monitoring node is found, the access behavior generates a security log, and displays an early warning operation through the user terminal (300) interface; S3, when a user needs to use network resources in the data center (100), the analysis and identification subsystem (500) analyzes whether the network resources are fraudulent resources, and displays the results and performs warning operations through the user terminal (300) interface; S4. The deceptive resources are classified into the blacklist database (130). The deep learning subsystem (600) analyzes the keywords, behavior patterns and information sources of a large number of deceptive resources to find the common points of the deceptive resources, establishes a deep learning model, and inputs the above information features into the model to automatically identify and mark other network resources.

2. The network fraud resource defense method based on deep learning according to claim 1 is characterized in that: The camouflage deployment in step S1 includes network camouflage, IP camouflage, port camouflage, application software camouflage, operating system camouflage, file camouflage and image and audio camouflage.

3. The network fraud resource defense method based on deep learning according to claim 1 is characterized in that: The step S3 comprises: S31, analyzing whether the network resource is a fraudulent resource through the analysis and identification subsystem (500), and performing inspection and identification operations in a multi-dimensional manner, wherein the multi-dimensional analysis includes content review analysis, keyword analysis, technical analysis, behavior pattern analysis and feedback analysis; S32, judging whether the network resource is a fraudulent resource by a judging module (560) and classifying it into a corresponding database; if the network resource is identified as a fraudulent resource, a fraudulent marking operation is performed on the resource and the resource is classified into a blacklist database (130); if the network resource is identified as a normal resource, the normal resource is stored in a security database (120); S33. Results are displayed and warnings are performed through the user terminal (300) interface. If the resource is a fraudulent resource, the user is prompted through the interface to give up using the resource. If the resource is a normal resource, the user is prompted to continue using the resource.

4. The network fraud resource defense method based on deep learning according to claim 1 is characterized in that: Also included is a network deception resource defense system based on deep learning, the system comprising: A data center (100), used to collect and store big data and data information of each subsystem; The monitoring center (200) is used to monitor the data information of each subsystem in real time, realize information sharing with the data center (100), and timely transmit the display results and warning information to the user end (300); The user terminal (300) is used to remotely view the data information output by the data center (100) and the monitoring center (200), and perform corresponding instruction operations based on the data information; The simulation subsystem (400) is used to perform camouflage operations on network targets that need to be protected to delay attack behaviors; An analysis and identification subsystem (500) is used to perform multi-dimensional analysis on network resources and determine whether the network resources are fraudulent resources based on the above analysis results, wherein the multi-dimensional analysis includes content review analysis, keyword analysis, and behavior pattern analysis; The deep learning subsystem (600) is used to find the common points of a large number of fraudulent resources in the blacklist database (130), and to establish a deep learning model based on the common points to automatically identify and intercept the fraudulent resources.

5. The network fraud resource defense method based on deep learning according to claim 4 is characterized in that: The data center (100) comprises a network database (110), a security database (120) and a blacklist database (130), wherein the network database (110) is used to collect, store and provide resource information of big data, the security database (120) is used to store network data that is normal resources after analysis, and the blacklist database (130) is used to store network data that is fraudulent resources after analysis and is marked as fraudulent.

6. The network fraud resource defense method based on deep learning according to claim 5 is characterized in that: The blacklist database (130) is used to receive and store network deception resources, and divide the network deception resources into a plurality of groups according to different times, review contents, keywords, behavior patterns and feedback information, each of which includes at least one network deception resource.

7. The network fraud resource defense method based on deep learning according to claim 4 is characterized in that: The supervision center (200) includes a controller (210) and an execution terminal (220), wherein the controller (210) is used to receive and output information results of each subsystem and data center (100), and output coordination instructions, and the execution terminal (220) is used to receive coordination instructions from the controller (210) and publish information according to the instructions.

8. The network fraud resource defense method based on deep learning according to claim 4 is characterized in that: The simulation subsystem (400) comprises: A camouflage simulation module (410) is used to generate a network honeypot, wherein the honeypot includes an application service honeypot unit (411) and a system service honeypot unit (412); A danger perception module (420) is used to monitor the buried network honeypot and obtain monitoring data of the monitoring unit, wherein the monitoring unit includes a file monitoring unit (421), a network monitoring unit (422), a process monitoring unit (423), and an image and audio monitoring unit (424); A source tracing and countermeasure module (430) is used to trace the behavior of attacking or accessing the monitoring node, obtain the behavior pattern and source of the behavior, and generate a security log and early warning reminder based on the above monitoring information; The camouflage simulation module (410), the danger perception module (420) and the source tracing countermeasure module (430) are interconnected.

9. The network fraud resource defense method based on deep learning according to claim 4 is characterized in that: The analysis and identification subsystem (500) comprises: A content review module (510) is used to review the content of network resources to see if there is any false propaganda, false promises, obvious exaggeration, or information that induces users to provide personal information or conduct financial transactions, and the content includes text, pictures, and video information; A keyword analysis module (520), used to extract keywords from network resources and compare them with known fraudulent resource keywords in the data center (100); A technical analysis module (530) is used to observe the URL of the network resource and check whether the network resource uses the HTTPS protocol and whether there are malicious codes and links; A behavior pattern analysis module (540) is used to analyze the behavior pattern of the network resources and compare the behavior pattern with the known fraudulent behavior pattern in the data center (100) based on the above-mentioned pattern characteristics, wherein the behavior pattern includes a traffic pattern and a user interaction pattern; A feedback analysis module (550) is used to retrieve and collect feedback from other users on the above network resources, wherein the feedback includes usage experience and security evaluation; A determination module (560) is used to determine whether the network resource is a fraudulent resource, and to classify the network resource into a corresponding database based on the above result; The judgment module (560) is interconnected with the content review module (510), the keyword analysis module (520), the technical analysis module (530), the behavior pattern analysis module (540), and the feedback analysis module (550).

10. The network fraud resource defense method based on deep learning according to claim 4 is characterized in that: The deep learning subsystem (600) comprises: A feature extraction module (610), for extracting multimodal features from known network fraud resources, wherein the multimodal features include but are not limited to text keywords, behavior patterns, traffic features, and image pixel features; A deep learning model module (620), used to construct a deep learning model using known network deception resources, and input the extracted features into the deep learning model; A data classification module (630) is used to automatically identify and classify other network resources using the trained deep learning model; The feature extraction module (610), the deep learning model module (620) and the data classification module (630) are interconnected.

Images