Network security intelligent monitoring method and system, and electronic equipment

Abstract

The invention relates to the technical field of network security intelligent monitoring scheme design, in particular to a network security intelligent monitoring method and system and electronic equipment. Comprising the steps that firstly, data are collected from multiple data sources of a network, network flow data, system log data, application program log data and the like are covered, and deep features are extracted through a deep learning algorithm; and then, an integrated learning behavior analysis model based on machine learning is adopted to analyze the preprocessed data, and by monitoring an analysis result in real time, decision making is carried out according to the type and severity of the abnormal behavior in combination with a predefined strategy, such as alarming, connection blocking or access permission adjustment. In addition, the system can continuously monitor network environment changes and automatically adjust parameters of the behavior analysis model. Through multi-aspect improvement, the false alarm rate is remarkably reduced, the data processing efficiency is improved, the monitoring system can adapt to the network environment change, and the accuracy and reliability of network security monitoring are effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security intelligent monitoring solution design, and particularly relates to a network security intelligent monitoring method, system, and electronic device. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly severe. There are some unsolved technical problems in the existing network security intelligent monitoring solutions. For example, in the face of complex and ever-changing network attacks, the existing monitoring solutions often have a high false alarm rate. This is because a single feature matching or a simple rule engine is difficult to accurately distinguish normal network behaviors from new attack behaviors, especially for encrypted or disguised attack traffic, which is easily misjudged as normal traffic or wrongly determined as a known type of attack. At the same time, in a large-scale network environment, the processing efficiency of the monitoring system is low, and it is difficult to effectively analyze and process a large amount of network data in real time, resulting in a lag in monitoring and an inability to respond to network security threats in a timely manner. In addition, the existing monitoring solutions lack adaptability and cannot adjust the monitoring strategy in a timely manner according to the dynamic changes in the network environment (such as changes in the network topology structure, the emergence of new network applications, etc.), thus affecting the accuracy and effectiveness of monitoring.

[0003] Therefore, the existing technology still needs to be further developed. Summary of the Invention

[0004] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and provide a network security intelligent monitoring method, system, and electronic device to solve the problems existing in the existing technology.

[0005] To achieve the above technical objectives, according to the first aspect of the present invention, the present invention provides a network security intelligent monitoring method, including:

[0006] S1. Data collection step: Collect network data from multiple data sources in the network. The data sources include network devices, servers, and terminal devices, and the collected data includes network traffic data, system log data, and application program log data;

[0007] S2. Data preprocessing step: Preprocess the collected network data. The preprocessing includes data cleaning, format unification, and feature extraction, where feature extraction includes extracting deep features of network traffic data based on deep learning algorithms;

[0008] S3. Behavior analysis step: Use a behavior analysis model based on machine learning to perform behavior analysis on the preprocessed data. The behavior analysis model is trained with a training dataset that contains normal network behavior data and abnormal network behavior data of known types. The behavior analysis model can identify normal network behavior and abnormal network behavior and determine the type of abnormal network behavior.

[0009] S4. Real-time monitoring and decision-making step: Real-time monitor the analysis results. When it is determined as abnormal network behavior, make a decision based on the type and severity of the abnormal behavior, combined with predefined policies. The decision results include alarm, blocking the connection, or adjusting network access permissions.

[0010] S5. Adaptive adjustment step: Continuously monitor the changes in the network environment and automatically adjust the parameters of the behavior analysis model or update the training dataset according to the changes in the network environment.

[0011] Specifically, in the behavior analysis step, the behavior analysis model based on machine learning is an ensemble learning model, which is composed of multiple different basic machine learning models. Each basic machine learning model analyzes the data from different perspectives, and the results of each basic model are integrated to improve the accuracy of behavior analysis.

[0012] Specifically, in the data collection step, the collection of the network traffic data is achieved through network sniffing technology or traffic mirroring technology.

[0013] Specifically, in the data preprocessing step, the feature extraction includes extracting the time series features, packet header features, and protocol features of the network traffic data.

[0014] Specifically, in the real-time monitoring and decision-making step, the alarm information includes detailed abnormal network behavior characteristics, relevant source IP addresses and destination IP addresses, and suspicious timestamps.

[0015] Specifically, in the real-time monitoring and decision-making step, the alarm methods include at least one of sound alarm, email alarm, and SMS alarm.

[0016] Specifically, in the adaptive adjustment step, when the network environment changes, new network data in the new environment is collected as new training samples to fine-tune the parameters of the behavior analysis model or retrain a part of the model structure, thereby updating the behavior analysis model.

[0017] Specifically, in the behavior analysis step, the types of abnormal network behavior include network attack behavior, malicious software activity behavior, and abnormal user access behavior.

[0018] According to a second aspect of the present invention, there is provided a network security intelligent monitoring system, comprising:

[0019] A data collection module: configured to collect network data from multiple data sources in the network, the data sources including but not limited to network devices, servers, and terminal devices, and the collected data including network traffic data, system log data, and application program log data;

[0020] A data preprocessing module: configured to preprocess the collected network data, the preprocessing including data cleaning, format unification, and feature extraction, wherein the feature extraction includes extracting deep features of network traffic data based on a deep learning algorithm;

[0021] A behavior analysis module: configured to perform behavior analysis on the preprocessed data by using a machine learning-based behavior analysis model, the behavior analysis model being trained by a training data set, the training data set containing normal network behavior data and various known types of abnormal network behavior data, and the behavior analysis model being capable of identifying normal network behavior and abnormal network behavior and determining the type of abnormal network behavior;

[0022] A real-time monitoring and decision-making module: configured to monitor the analysis result in real time, and when an abnormal network behavior is determined, make a decision according to the type and severity of the abnormal behavior, in combination with predefined policies, and the decision result includes alarming, blocking the connection, or adjusting network access permissions;

[0023] An adaptive adjustment module: configured to continuously monitor changes in the network environment, and automatically adjust the parameters of the behavior analysis model or update the training data set according to the changes in the network environment to improve the adaptive ability of the monitoring system.

[0024] According to a third aspect of the present invention, there is provided an electronic device, comprising: a memory; and a processor, wherein computer-readable instructions are stored on the memory, and when the computer-readable instructions are executed by the processor, the above-mentioned network security intelligent monitoring method is implemented.

[0025] Advantageous effects:

[0026] 1. Effectively reduce the false alarm rate

[0027] The present invention comprehensively collects network data from multiple data sources (network devices, servers, and terminal devices), and uses deep learning algorithms for feature extraction, enabling the discovery of deep features in network traffic data. In combination with an ensemble learning model, multiple different basic machine learning models analyze the data from different perspectives, and the results of each model are integrated, fully considering various features and potential patterns of the data, making the analysis of network behavior more comprehensive and in-depth. This method of multi-feature fusion and in-depth analysis can more accurately distinguish normal network behavior from abnormal network behavior, especially for new attack behaviors and encrypted or camouflaged attack traffic, effectively reducing the false alarm rate and avoiding misjudging normal traffic as abnormal or vice versa. In the judgment of abnormal network behavior types, the present invention not only focuses on network attack behaviors, but also covers various types such as malicious software activity behaviors and abnormal user access behaviors, and each type is carefully classified and accurately identified. This multi-dimensional behavior analysis system can more accurately locate and identify abnormal situations, improve the accuracy of behavior analysis, and further reduce the false alarm rate.

[0028] 2. Significantly improve processing efficiency

[0029] The monitoring solution of the present invention adopts an integrated processing flow. From data collection, preprocessing to behavior analysis, real-time monitoring and decision-making, and adaptive adjustment, each link closely cooperates and operates efficiently. The operations of format unification and feature extraction in the data preprocessing step can optimize the data format and provide an efficient data structure for subsequent analysis; the application of the ensemble learning model improves the speed and accuracy of behavior analysis; the real-time monitoring and decision-making module can quickly respond to abnormal situations, avoiding the common lag problems in traditional monitoring systems, enabling the monitoring system to effectively analyze and process massive network data in real time in a large-scale network environment. The system of the present invention has an adaptive ability, capable of continuously monitoring changes in the network environment and automatically adjusting the parameters of the behavior analysis model or updating the training data set. This dynamic adjustment mechanism enables the model to quickly adapt to changes in new network applications, technological changes, and attack methods, and can maintain the best performance without frequent manual intervention, further enhancing the processing efficiency and adaptability of the monitoring system.

[0030] 3. Enhance the adaptive ability of monitoring

[0031] The adaptive adjustment module provided by the present invention can capture various changes in the network environment in real time, such as the addition of network applications, network topology adjustments, etc. By automatically collecting and analyzing network data in the new environment, it ensures that the monitoring system always pays attention to the latest network security situation, providing a basis for making accurate decisions in a timely manner. When a change in the network environment is detected, the system adopts incremental learning and model adjustment strategies, which can quickly fine-tune the parameters of the behavior analysis model or retrain a part of the model structure, enabling the model to quickly adapt to the challenges of the new environment. This dynamic optimization ability ensures that the monitoring system can maintain a high degree of adaptability and effectiveness in different network environments, providing continuous and reliable network security protection for users.

[0032] 4. Rich and flexible alarm and decision-making mechanisms

[0033] In terms of generating alarm information, the present invention includes key information such as detailed abnormal network behavior characteristics, source IP address, destination IP address, and suspicious timestamps, providing a comprehensive and accurate description of abnormal situations for administrators. This rich alarm information helps administrators quickly locate and understand security incidents, shortening the fault response time. The present invention supports multiple alarm methods, such as sound alarm, email alarm, and SMS alarm, etc. Administrators can flexibly select alarm methods according to actual needs and scenarios to ensure that they can receive alarm information in a timely manner and take corresponding measures when facing security incidents at different levels. This flexibility enhances the practicality of the monitoring system and improves the efficiency of network security emergency response.

[0034] In summary, the network security intelligent monitoring solution of the present invention has significant advantages in reducing the false alarm rate, improving the processing efficiency, enhancing the adaptive ability, and enriching the alarm and decision-making mechanisms, and can provide a more reliable and efficient monitoring solution for the network security field. Brief Description of the Drawings

[0035] Figure 1 is the flowchart of the network security intelligent monitoring method provided in the specific embodiment of the present invention;

[0036] Figure 2 is the schematic diagram of the system composition of the network security intelligent monitoring system provided in the specific embodiment of the present invention. Detailed Embodiments

[0037] To enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the present invention. Based on the embodiments in this application, other similar embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the scope of protection of this application. In addition, the directional terms mentioned in the following embodiments, such as "up", "down", "left", "right", etc., are only with reference to the directions of the accompanying drawings. Therefore, the directional terms used are for illustration rather than to limit the present invention.

[0038] The present invention will be further described below in conjunction with the accompanying drawings and preferred embodiments.

[0039] Please refer to Figure 1 , the present invention provides a network security intelligent monitoring method, including:

[0040] S1. Data collection step: Collect network data from multiple data sources in the network. The data sources include network devices, servers, and terminal devices, and the collected data includes network traffic data, system log data, and application program log data.

[0041] Specifically, in the data collection step, the collection of the network traffic data is implemented through network sniffing technology or traffic mirroring technology.

[0042] In a preferred embodiment, the specific steps of the data collection step are as follows:

[0043] In this step, a variety of technical means such as web crawlers, data interfaces, and system log recording programs are used to comprehensively collect network data from multiple data sources in the network. These data sources include but are not limited to various network devices (such as routers, switches, etc.), servers (such as web servers, database servers, etc.), and terminal devices (such as computers, mobile terminals, etc.).

[0044] The types of collected data are rich and diverse, covering network traffic data (such as information such as the content of data packets, source IP addresses, destination IP addresses, port numbers, protocol types, etc.), system log data (such as system operation records, error messages, login information, etc. of servers), and application program log data (such as operation records of various application programs, user interaction information, exception error messages, etc.). To ensure the integrity and accuracy of the data, a multi-threaded and distributed data collection method can be adopted to improve the collection efficiency, and preliminary verification and error correction processing are performed on the collected data.

[0045] S2. Data preprocessing step: Preprocess the collected network data. The preprocessing includes data cleaning, format unification, and feature extraction, where feature extraction includes extracting deep features of network traffic data based on deep learning algorithms.

[0046] Specifically, in the data preprocessing step, the feature extraction includes extracting the temporal features, packet header features, and protocol features of network traffic data.

[0047] In a preferred embodiment, the specific steps of the data preprocessing step provided by the present invention are as follows:

[0048] 1. Data cleaning: Use methods based on rules and statistical analysis to clean the collected data. For example, remove duplicate records, filter out meaningless data (such as null values, invalid characters, etc.), and correct or delete some outliers.

[0049] 2. Format unification: Since the data formats of different data sources may vary, it is necessary to convert the data into a unified format for subsequent processing. For example, for the date and time format, a specific format (such as ISO8601) is uniformly adopted; for IP addresses, the dotted decimal notation is uniformly adopted.

[0050] 3. Feature extraction: Feature extraction is a key link in data preprocessing, especially for extracting deep features of network traffic data based on deep learning algorithms. Deep learning models such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) can be used to automatically extract hidden features in network traffic data. For example, through the CNN model, the temporal features, frequency domain features, packet header features, etc. of network traffic data are automatically learned to provide richer semantic information for subsequent behavior analysis.

[0051] S3. Behavior analysis step: Use a machine learning-based behavior analysis model to perform behavior analysis on the preprocessed data. The behavior analysis model is trained through a training data set, which contains normal network behavior data and known types of abnormal network behavior data. The behavior analysis model can identify normal network behavior and abnormal network behavior and determine the types of abnormal network behavior.

[0052] Specifically, in the behavior analysis step, the machine learning-based behavior analysis model is an ensemble learning model, which is composed of multiple different basic machine learning models. Each basic machine learning model analyzes the data from different angles, and the results of each basic model are integrated to improve the accuracy of behavior analysis.

[0053] Specifically, in the behavior analysis step, the types of abnormal network behavior include network attack behavior, malicious software activity behavior, and abnormal user access behavior.

[0054] In a preferred embodiment, the behavior analysis step of the present invention includes:

[0055] Training behavior analysis model: Use a large amount of labeled data to train the behavior analysis model. The training data set contains normal network behavior data and various known types of abnormal network behavior data. Commonly used machine learning algorithms include supervised learning algorithms (such as decision trees, support vector machines, neural networks, etc.) and unsupervised learning algorithms (such as cluster analysis, association rule mining, etc.). This step uses an integrated learning model, which is composed of multiple different basic machine learning models, such as a decision tree-based model and a neural network-based model. Each basic machine learning model analyzes the data from different angles to mine potential patterns and rules in the data.

[0056] Identify network behavior: Input the pre-processed network data into the trained behavior analysis model. The model learns and analyzes the characteristics of the data to determine whether the current network behavior is normal. If it is determined to be abnormal behavior, further determine the type of abnormal behavior, such as network attack behavior (such as DDoS attack, SQL injection attack, etc.), malware activity behavior (such as virus infection, backdoor program operation, etc.) and abnormal user access behavior (such as abnormal login behavior, frequent access to sensitive information, etc.). To improve the accuracy of identification, a multi-model fusion method can be used to integrate the judgment results of multiple models.

[0057] The behavior analysis process of the present invention is described below by using specific examples:

[0058] Data collection: Collect network behavior data from multiple data sources on the enterprise network, including network traffic records (such as those obtained through network traffic collection devices deployed at network boundaries and key nodes), system logs (operation logs of operating systems and applications collected from servers and workstations), and employee operation records on office terminals, etc. These data cover normal network usage and some known abnormal behavior cases, such as previous DDoS attacks and illegal operations by internal employees.

[0059] Labeling: Network security experts and professional security analysts label the collected data. For example, normal network behavior data is labeled as "normal"; known attack behaviors are labeled according to specific attack types, such as "DDoS attack", "SQL injection attack", "malware infection", etc. During the labeling process, the relevant information of each data sample is recorded in detail, including the attack source IP address, destination IP address, attack time, involved ports and protocols, etc., for subsequent model learning.

[0060] Feature extraction: A variety of methods are used to extract rich features from the collected network data. In addition to traditional rule-based features such as source IP address, destination IP address, port number, protocol type, packet size in network traffic data, deep learning algorithms are also used to extract deep features. For example, a convolutional neural network (CNN) is used to extract the temporal features of network traffic data, automatically learning the patterns and rules in the data through convolutional and pooling layers; a recurrent neural network (RNN) is used to process the temporality of network data, capturing long-term dependencies in the sequence and mining potential patterns hidden in the data.

[0061] Feature selection and optimization: The extracted features are screened and optimized to remove redundant and irrelevant features, retaining the features that are most valuable for network behavior analysis. This can be achieved by calculating metrics such as feature correlation and information gain, ensuring that the model can focus on key features and improve the training efficiency and accuracy of the model.

[0062] Algorithm selection: Considering the complexity and diversity of network data, a variety of different basic machine learning algorithms are selected, including decision trees, support vector machines (SVMs), and neural networks. The decision tree algorithm has intuitive interpretability and fast learning ability, enabling rapid classification and judgment of data; SVMs perform well in dealing with high-dimensional data and nonlinear problems, effectively separating different classes of data; neural networks have strong nonlinear fitting ability and can learn complex patterns in the data.

[0063] Ensemble learning model construction: The Adaboost ensemble learning method is used to construct an ensemble learning model. The specific process is as follows:

[0064] Initialize the weights of each basic model to equal values. For example, assuming there are three basic models (decision tree, SVM, and neural network), the initial weight of each model is 1 / 3.

[0065] For each round of training, adjust the weights of the training data according to the prediction results of each basic model in the previous round. For example, if a data sample was misclassified in the previous round, then in subsequent rounds, the weight of this sample will increase, making the model pay more attention to these difficult-to-classify samples.

[0066] Each basic model is trained under the adjusted weights to obtain a new model. For example, the decision tree model constructs and prunes the tree by learning the features and labels of the data; the SVM separates different classes of data by finding the optimal hyperplane; the neural network adjusts the weights between neurons through the backpropagation algorithm to minimize the prediction error.

[0067] Finally, the prediction results of each base model are combined with weights to obtain the final output of the ensemble model. The way of weighted combination can be calculated according to the weights and prediction results of each base model. For example, for a certain data sample, the weight of the prediction result of the decision tree is 0.3, the weight of the prediction result of the SVM is 0.3, and the weight of the prediction result of the neural network is 0.4. Then the final prediction result is the weighted sum of the prediction results of each model.

[0068] Feature extraction: For the network data collected in real time, features are extracted according to the pre-determined feature extraction method. For example, for a network traffic record, features such as source IP address, destination IP address, port number, protocol type, packet size, and transmission time interval are extracted.

[0069] Vectorization: The extracted features are combined into a feature vector. For example, assume that 5 features are extracted, namely source IP address (after numerical encoding), destination IP address (after numerical encoding), port number, protocol type (after numerical encoding), and packet size. Then these features are arranged in a certain order into a vector, such as [source IP address encoding, destination IP address encoding, port number, protocol type encoding, packet size].

[0070] Model prediction: The feature vector is input into each base machine learning model in the ensemble learning model for prediction analysis. For example, the decision tree model makes judgments at the nodes of the tree according to the values of the feature vector, and finally reaches a leaf node along the decision path. The category corresponding to this leaf node is the prediction result of the decision tree; the SVM model determines which side of the classification hyperplane the data point is located by calculating the distance between the feature vector and the classification hyperplane, so as to determine its belonging category; the neural network model calculates the output value after the weighted summation and non-linear transformation of the input feature vector through each layer of neurons by the forward propagation algorithm, and determines the predicted category according to the comparison between the output value and the preset threshold.

[0071] It can be understood that the preset threshold can be set by the user of the present invention according to specific requirements, and the present invention does not limit it here, as long as it is applicable to the network security intelligent monitoring method proposed by the present invention.

[0072] Result fusion: The prediction results of each base model are comprehensively considered to determine the final judgment result of network behavior. The voting method is used for result fusion, that is, the number of votes for each base model predicting various abnormal types is counted, and the abnormal type with the most votes is the final prediction result. For example, if the decision tree model predicts "normal", the SVM model predicts "DDoS attack", and the neural network model predicts "DDoS attack", then the final result is "DDoS attack".

[0073] After the processing of the behavior analysis step, the system identifies that a certain part of the network traffic exhibits abnormal characteristics, conforming to the pattern of "DDoS attack". Specifically, a large number of data packets from different source IP addresses are concentrated and sent to the target server within a short period of time, and the characteristics of the data packets match the known DDoS attack characteristics. At this time, the system transmits this abnormal behavior information to the real-time monitoring and decision-making module for further processing.

[0074] Specifically, the method by which the system identifies that a certain part of the network traffic exhibits abnormal characteristics specifically includes:

[0075] 1. A large number of data packets from different source IP addresses are concentrated and sent

[0076] 1.1 Setting and judgment of the threshold for the number of source IP addresses

[0077] Threshold setting: In a normal network environment, the number of data packets received by the target server from different source IP addresses within a unit time will remain within a relatively stable range. To identify abnormal situations, we set a threshold for the number of source IP addresses. For example, for an office server of a medium-sized enterprise, during normal business operations, the threshold for the number of data packets received from different source IP addresses per minute is set to 1000 (this threshold can be adjusted according to factors such as the specific business type and network scale of the server).

[0078] Judgment method: The system monitors the data packets received by the target server in real time and counts the number of different source IP addresses within each minute. When the number of data packets received from different source IP addresses within a certain minute exceeds the set threshold, it is considered that there is a situation where a large number of data packets from source IP addresses are concentrated and sent. For example, at a certain moment, the system monitors that the target server has received data packets from 1500 different source IP addresses within one minute, exceeding 50% of the set threshold of 1000. At this time, the system will trigger a further analysis and judgment mechanism.

[0079] 1.2 Analysis of the diversity of the distribution of source IP addresses and examples

[0080] Distribution diversity analysis: In addition to paying attention to the number of source IP addresses, it is also necessary to analyze the distribution of these source IP addresses. Normal user access behaviors usually come from relatively concentrated IP address segments. For example, the office devices of enterprise internal employees may be concentrated within several specific network segments. In a DDoS attack, the distribution of source IP addresses will be more extensive and random. We can calculate the entropy value of the source IP addresses to measure the diversity of their distribution. The higher the entropy value, the more uniform and random the distribution of the source IP addresses.

[0081] Example: Assume that under normal circumstances, the source IP addresses of the data packets received by the target server are mainly concentrated in several internal enterprise network segments, such as 192.168.1.0 / 24, 192.168.2.0 / 24, etc., and the calculated entropy value is 2.0. During an attack, the source IP addresses come from different networks around the world, including home networks, data centers, etc., and the entropy value rises to 5.0. This indicates that the distribution of the source IP addresses has become more diverse and random, conforming to the characteristics of a DDoS attack.

[0082] 2. Concentrated sending within a short period

[0083] 2.1 Setting and judging the time window threshold

[0084] Threshold setting: Set a time window threshold to determine whether data packets are concentratedly sent within a short period. For example, set the time window to 5 minutes. Within this time window, monitor and analyze indicators such as the number of source IP addresses and the data packet sending frequency.

[0085] Judgment method: When the number of source IP addresses exceeds the threshold and shows a rapid growth trend within the set time window, it is judged as concentrated sending within a short period. For example, within a 5-minute time window, the number of data packets received by the target server from different source IP addresses in the first 2 minutes is 800, and it quickly increases to 2000 in the next 3 minutes, with an average increase of 400 per minute. This rapid growth trend indicates that the data packets are concentratedly sent within a short period.

[0086] 3. Matching the data packet characteristics with the known DDoS attack characteristics

[0087] 3.1 Matching the data packet size characteristics and setting the threshold

[0088] Threshold setting: Different types of DDoS attacks usually use data packets of specific sizes. For example, in a UDP Flood attack, the attacker may send a large number of UDP data packets with a fixed size, and generally choose a larger data packet size to occupy more network bandwidth. We set a threshold range for the data packet size. For example, for a UDP Flood attack, when the data packet size exceeds 1400 bytes (considering that the maximum transmission unit MTU of an Ethernet frame is 1500 bytes, and after subtracting the overhead of the IP header and UDP header, the payload is generally around 1400 bytes), it is considered that the data packet size characteristics match the UDP Flood attack characteristics.

[0089] Example: The system monitors that the size of some data packets received by the target server is 1500 bytes, exceeding the set threshold of 1400 bytes. Moreover, the source IP addresses of these data packets conform to the characteristics of a large number of different source IP addresses and are sent concentratedly within a short period of time. At this time, it can be preliminarily judged that these data packets may belong to a UDP Flood attack.

[0090] 3.2 Matching of data packet sending frequency characteristics and threshold setting

[0091] Threshold setting: For different types of DDoS attacks, corresponding data packet sending frequency thresholds are set. For example, in a SYN Flood attack, the attacker will let the zombie hosts send SYN request data packets to the target server at an extremely high frequency. For normal network communication, the number of SYN request data packets sent per second is generally between dozens and hundreds. We set a threshold. When the number of SYN request data packets sent per second exceeds 1000, it is considered that the data packet sending frequency characteristics match the SYN Flood attack characteristics.

[0092] Example: The system monitors the number of SYN request data packets received by the target server in real time and finds that at a certain moment, the number of SYN request data packets received per second reaches 1500, exceeding the set threshold of 1000. Moreover, these data packets come from a large number of different source IP addresses and are sent concentratedly within a short period of time, conforming to the behavior pattern of a DDoS attack. Therefore, it can be judged as a SYN Flood attack.

[0093] 3.3 Matching of protocol and port utilization characteristics and threshold setting

[0094] Threshold setting: Some DDoS attacks use specific protocols or ports for attacks. For example, an HTTP Flood attack mainly targets port 80 (HTTP protocol) or port 443 (HTTPS protocol) of a web server. We can set a threshold. When the number of data packets for a specific port exceeds a certain proportion within a short period of time, it is considered that the protocol and port utilization characteristics of the data packets match the corresponding DDoS attack characteristics. For example, when the proportion of data packets for port 80 in the total number of data packets exceeds 80% within 1 minute, and the characteristics such as the source IP address and sending frequency of the data packets also conform to the DDoS attack characteristics, it is judged as an HTTP Flood attack.

[0095] Example: The system monitors that within 1 minute, 90% of the data packets received by the target server have the target port as port 80. Moreover, these data packets come from a large number of different source IP addresses and are sent concentratedly within a short period of time. Also, the characteristics such as the data packet size and sending frequency match the characteristics of an HTTP Flood attack. Therefore, it can be judged as an HTTP Flood attack.

[0096] Through the above refinement and illustration of technical features, combined with the setting of thresholds, it is possible to more accurately identify whether a certain part of network traffic exhibits abnormal features and conforms to the pattern of DDoS attacks, providing strong support for network security protection.

[0097] S4. Real-time monitoring and decision-making step: Real-time monitor the analysis results. When it is determined that it is an abnormal network behavior, make a decision according to the type and severity of the abnormal behavior, combined with predefined policies. The decision results include alarm, connection blocking, or adjustment of network access permissions.

[0098] Specifically, in the real-time monitoring and decision-making step, the alarm information includes detailed abnormal network behavior characteristics, relevant source IP addresses and destination IP addresses, and suspicious timestamps.

[0099] Specifically, in the real-time monitoring and decision-making step, the alarm methods include at least one of sound alarm, email alarm, and SMS alarm.

[0100] In a preferred embodiment, the real-time monitoring and decision-making step of the present invention includes the following solutions:

[0101] Real-time monitoring: The system establishes a real-time monitoring mechanism to regularly or real-time obtain the output results of the behavior analysis module. By real-time tracking of the analysis results, abnormal behaviors occurring in the network can be discovered in a timely manner.

[0102] Decision-making mechanism: When it is determined that it is an abnormal network behavior, make a decision according to the type and severity of the abnormal behavior, in accordance with the predefined policies. For example, for simple abnormal behaviors (such as a small amount of abnormal access by individual users), only trigger a sound alarm and remind the administrator to view; for abnormal behaviors that may cause serious harm (such as large-scale DDoS attacks), immediately block the connection and send email and SMS alarms to the administrator. The alarm information details abnormal network behavior characteristics (such as attack types, attack means, etc.), relevant source IP addresses and destination IP addresses, and suspicious timestamps, so that the administrator can quickly locate and solve the problem.

[0103] The following illustrates the real-time monitoring and decision-making process of the present invention through specific examples:

[0104] Based on the "DDoS attack" abnormal behavior identified in the above behavior analysis step, the real-time monitoring and decision-making module starts real-time monitoring and decision-making processing of this event to ensure the safe and stable operation of the enterprise network.

[0105] The system retrieves the latest behavior analysis results from the behavior analysis module every 1 minute. In this instance, the behavior analysis module continuously monitors network traffic data and discovers that the "DDoS attack" behavior persists, and the attack traffic shows a trend of gradual increase. The real-time monitoring module records these latest analysis results as the basis for subsequent decision-making.

[0106] Update the behavior feature library in real time based on the newly collected network behavior data. For example, as the attack progresses, the attacker may adjust the attack strategy, such as changing the distribution of the attack source IP addresses, increasing the intensity of the attack traffic, etc. The system analyzes these new data features and adds them to the behavior feature library so that the behavior analysis model can better adapt to the changes in the attack and improve the accuracy of identification.

[0107] Continuously track the "DDoS attack" behavior and record relevant detailed information. This includes the time when the abnormal behavior occurs (accurate to seconds), the source IP addresses (record the list of all source IP addresses participating in the attack), the destination IP address (i.e., the IP address of the target server under attack), the network services or applications involved (such as HTTP service), and the specific characteristics of the abnormal behavior (such as the size distribution and sending frequency of data packets). By real-time tracking the development trend of the abnormal behavior, more comprehensive information is provided for decision-making.

[0108] Evaluate the severity of the abnormal behavior based on the type, characteristics, and relevant network context information of the abnormal behavior. In this instance, the "DDoS attack" behavior has affected the normal operation of the enterprise network, and a large number of legitimate user requests cannot access the target server normally, resulting in the interruption of some services. Considering the size of the attack traffic, the duration, and the scope of the impact on the business, the severity of this abnormal behavior is determined to be high.

[0109] According to the predefined decision strategy rule library, search for the strategies that match the current severity and type of the abnormal behavior. The decision strategy rule library contains specific measures to be taken for different types and severities of abnormal behaviors. For the "DDoS attack" behavior with high severity, the predefined strategies include immediately blocking the attack connection, sending an emergency alarm message to the administrator, and starting the emergency response mechanism, etc.

[0110] Execute the corresponding decision measures in real time according to the matched decision strategies:

[0111] Block the connection: The system sends control instructions to network devices (such as firewalls), configures the access control list (ACL), and blocks all traffic from the attack source IP addresses from entering the enterprise network, thereby cutting off the attack path and preventing the attack from spreading further.

[0112] Alarm Notification: Send emergency alarm messages to the administrator through multiple alarm methods. For example, trigger a sound alarm simultaneously, and pop up a warning window on the administrator's work terminal to display the detailed information of abnormal behavior; send an email to the administrator, and the email content includes key information such as the type of attack, severity, source IP address, destination IP address, and attack start time; send a text message to the administrator to briefly describe the attack situation, ensuring that the administrator can receive the alarm notification in time and take corresponding measures.

[0113] Activate the emergency response mechanism: Automatically activate the emergency response mechanism, such as adjusting the network topology structure, switching the attacked server to a standby server to ensure business continuity; at the same time, organize network security experts to analyze and handle the attack event, and collect attack evidence for subsequent investigation and traceability.

[0114] The real-time monitoring and decision-making module effectively prevents the further influx of attack traffic by blocking the attack connection in a timely manner, protecting the core business system of the enterprise network from attacks. At the same time, through alarm notification and emergency response mechanism, the administrator can understand the attack situation in time and take corresponding measures, minimizing the losses caused by the attack to the enterprise network. After the attack event is processed, the system records and summarizes the whole process, providing lessons learned for subsequent network security protection, and further improving the behavior analysis model and decision-making strategy rule base.

[0115] S5. Adaptive adjustment step: Continuously monitor the changes in the network environment, and automatically adjust the parameters of the behavior analysis model or update the training data set according to the changes in the network environment.

[0116] Specifically, in the adaptive adjustment step, when the network environment changes, collect the network data in the new environment as new training samples, and fine-tune the parameters of the behavior analysis model or retrain a part of the model structure, thereby updating the behavior analysis model.

[0117] Specifically, in the preferred embodiment of the present invention, the adaptive adjustment step of the present invention includes:

[0118] Monitor network environment changes: Discover the changes in the network environment by continuously monitoring various metrics and changes in the network, such as changes in the network topology structure, installation and use of new network applications, etc. Network monitoring tools, traffic analysis tools, etc. can be used for monitoring.

[0119] Automatically adjust model parameters or update the training dataset: When it is detected that the network environment has changed, the system automatically collects network data related to the change as new training samples. For example, if a new network application is added, the system will collect the network data generated during the operation of this application. Then, an incremental learning approach is used to fine-tune the parameters of the behavior analysis model, or when necessary, retrain a part of the model's structure, so that the model can adapt to the new network environment and maintain the ability to accurately identify and analyze new changes.

[0120] The following presents a specific example of the adaptive adjustment steps based on the above solution, demonstrating how the system automatically adjusts the parameters of the behavior analysis model or updates the training dataset when the network environment changes, in order to maintain the effective monitoring and identification capabilities for network security threats.

[0121] Suppose a popular online collaborative office application is newly added to an enterprise's network environment, and employees start to widely use this application for daily work. With the introduction of this application, the network traffic pattern has changed, and at the same time, some malicious attackers have started to use some features of this application to carry out new types of network attacks. The accuracy of the behavior analysis model of the existing network security intelligent monitoring system has decreased when identifying abnormal behaviors related to this new application. At this time, it is necessary to initiate the adaptive adjustment steps to optimize the model to adapt to the new network environment.

[0122] The system regularly scans the network topology and discovers that some new server nodes have been added to the enterprise's internal network. These servers are specifically used to deploy and support the new online collaborative office application. The IP addresses, open port information, and running service types of these new servers are obtained through network detection tools. For example, the new application uses some specific ports (such as port 8080) for data transmission, which is different from the previous network topology and application configuration.

[0123] Monitor the characteristics and patterns of network traffic to identify the emergence of new network applications and services. Analyze information such as protocol characteristics, port number usage, and packet content in the traffic, and find that a large amount of data traffic has started to be transmitted through the specific port (port 8080) of the new application, and the packet payload contains the specific protocol identifier and encryption information of this application. For example, by analyzing the payload content of the packets, it is found that it contains some specific keywords and data structures related to online collaborative office, thus determining that this is a new network application.

[0124] Analyze the user's network behavior data, such as login behavior, access frequency, access time, accessed resources, etc. It is found that the access frequency of employees to the new application during working hours has increased significantly, and the time distribution and behavior patterns of access are different from the previous application usage. For example, previously, employees mainly accessed the office system during fixed time periods in the morning and afternoon, but now after the new application is launched, many employees will frequently access the application even during lunch breaks and after work, indicating that the user's behavior pattern has changed significantly.

[0125] The following illustrates how to determine whether the user's behavior pattern has changed significantly through specific examples:

[0126] 1. Determine key behavior indicators

[0127] To determine whether the user's behavior pattern has changed significantly, it is first necessary to determine the key indicators for measuring user behavior. These indicators should be able to reflect the user's behavior characteristics in different aspects, such as access time, access frequency, type of accessed resources, etc.

[0128] 1.1 Access time

[0129] Definition: Record the time information of the user accessing the system or a specific application, including the specific date and time point.

[0130] Function: By analyzing the distribution of the user's access time, understand the user's activity level in different time periods, and determine whether there is an abnormal access time pattern.

[0131] 1.2 Access frequency

[0132] Definition: Calculate the number of times the user accesses the system or a specific application within a unit of time.

[0133] Function: Reflect the frequency of the user's use of the system or application. An abnormal change in access frequency may imply a change in the user's behavior pattern.

[0134] 1.3 Type of accessed resources

[0135] Definition: Analyze the specific types of resources accessed by the user, such as different application programs, file types, web page content, etc.

[0136] Function: Understand the changes in the user's interests and needs, and identify whether there are abnormal access behaviors to specific resources.

[0137] 2. Data collection and preprocessing

[0138] To accurately determine the change in the user's behavior pattern, sufficient historical data needs to be collected and the data needs to be preprocessed to ensure the quality and consistency of the data.

[0139] 2.1 Data collection

[0140] Collection scope: Collect users' behavioral data from multiple data sources, including system logs, network traffic records, usage records of applications, etc.

[0141] Collection frequency: Determine the data collection frequency according to the actual situation. For example, record users' behavioral data at regular time intervals (such as every 1 minute, 5 minutes, etc.).

[0142] 2.2 Data cleaning

[0143] Remove noisy data: Delete obviously incorrect or incomplete data records, such as incorrect access time records, negative access frequencies, etc.

[0144] Handle missing values: For missing data, interpolation, mean filling, etc. can be used for processing, or marked and excluded according to specific situations.

[0145] 2.3 Data standardization

[0146] Unify time format: Standardize time data from different sources to ensure the consistency of time format for subsequent analysis and calculation.

[0147] Normalize access frequency: To eliminate the differences in access frequencies between different users or different time periods, normalize the access frequency data, for example, map it to the interval [0, 1].

[0148] 3. Set thresholds

[0149] To determine whether there are significant changes in the user behavior pattern, corresponding thresholds need to be set for each key behavior indicator. The setting of thresholds can be adjusted according to the statistical analysis of historical data and business requirements.

[0150] 3.1 Setting access time threshold

[0151] Historical data analysis: Analyze the distribution of access frequencies of users at different time periods within a day in historical data, and calculate the average access frequency and standard deviation for each time period. For example, by analyzing the user access records in the past month, it is found that the average access frequencies of users from 9 am to 11 am and from 2 pm to 4 pm are relatively high, which are 10 times per hour and 8 times per hour respectively, and the standard deviations are 2 times and 1.5 times respectively.

[0152] Threshold determination: Set a reasonable threshold range according to the distribution of historical data. Generally, the threshold can be set as the average value plus or minus several times the standard deviation. For example, for the time period from 9 am to 11 am, set the threshold of the access frequency as the average value plus or minus 2 times the standard deviation, that is, [10 - 2×2, 10 + 2×2] = [6, 14] times per hour. If a user's access frequency during this period exceeds this threshold range, it may indicate a change in their behavior pattern.

[0153] 3.2 Setting the access frequency threshold

[0154] Calculation of the long-term average access frequency: Calculate the average access frequency of a user over a relatively long period (such as the past week, month, etc.). For example, by analyzing the user's login records in the past month, calculate that the user's average weekly login times is 5 times.

[0155] Determination of the fluctuation range: Determine a reasonable fluctuation range according to the fluctuation of historical data. For example, calculate that the standard deviation of the user's weekly login times in the past month is 1 time, then the fluctuation range can be set as the average access frequency plus or minus 2 times the standard deviation, that is, [5 - 2×1, 5 + 2×1] = [3, 7] times per week. If a user's login times in a certain week exceed this range, it is considered that their access frequency has changed significantly.

[0156] 3.3 Setting the access resource type threshold

[0157] Calculation of the access proportion of resource types: Count the access proportion of a user to different resource types in historical data. For example, by analyzing the user's access records in the past month, it is found that the proportion of the user accessing office document resources is 60%, the proportion of accessing entertainment resources is 20%, and the proportion of accessing other resources is 20%.

[0158] Judgment of the abnormal proportion: Set a threshold to judge whether a user's access to a certain resource type is abnormal. For example, when the access proportion of a user to a certain type of resource suddenly exceeds 50% of its historical average proportion, it is considered that there has been a significant change in the access to this resource type. If a user's access proportion to entertainment resources suddenly rises to 40% within a certain period, exceeding 100% of its historical average proportion (20%), it indicates that the user's behavior pattern may have changed.

[0159] 4. Real-time monitoring and analysis

[0160] After setting the threshold, the system needs to monitor and analyze the user's real-time behavior data to determine whether the threshold conditions are met, so as to determine whether the user's behavior pattern has changed significantly.

[0161] 4.1 Real-time data collection

[0162] Real-time recording: The system records every user behavior operation in real time, including information such as access time, access frequency, and accessed resource type.

[0163] Data update: Regularly update the user behavior data to ensure the timeliness and accuracy of the data.

[0164] 4.2 Behavior pattern analysis

[0165] Index calculation: Based on the data collected in real time, calculate various behavior index values of the user within the current time period, such as the distribution of access time, access frequency, and accessed resource type.

[0166] Threshold comparison: Compare the calculated index values with the set thresholds to determine whether they exceed the threshold range. For example, if a user's access frequency at 10 am is 16 times per hour, exceeding the set threshold range of [6, 14] times per hour, it indicates that the user's behavior pattern in terms of access time may have changed.

[0167] 5. Example

[0168] Suppose the normal working hours of employee Li in the enterprise are from 9 am to 6 pm, and he mainly accesses the enterprise's internal office system and related business applications. The following is a specific example to illustrate how to determine whether Li's behavior pattern has changed significantly:

[0169] Historical data statistics: By analyzing Li's behavior data in the past month, the following information is obtained:

[0170] Access time: Li usually has a higher access frequency to the system during the two time periods from 9:30 am to 11:30 am and from 2 pm to 4:30 pm. The average number of accesses per hour is 8 times and 7 times respectively, and the standard deviations are 1.5 times and 1.2 times respectively.

[0171] Access frequency: Li logs in to the enterprise office system an average of 5 times per week, with a standard deviation of 1 time.

[0172] Accessed resource type: The proportion of Li accessing office document resources is 70%, the proportion of accessing internal communication tool resources is 20%, and the proportion of accessing other resources is 10%.

[0173] Threshold setting:

[0174] Access time threshold: The access frequency threshold from 9:30 am to 11:30 am is set to [8 - 2×1.5, 8 + 2×1.5] = [5, 11] times per hour; the access frequency threshold from 2 pm to 4:30 pm is set to [7 - 2×1.2, 7 + 2×1.2] = [4.6, 9.4] times per hour.

[0175] Access frequency threshold: The threshold range of the number of logins per week is set to

[0176] [5 - 2×1, 5 + 2×1] = [3, 7] times / week.

[0177] Access resource type threshold: When the access ratio of a certain type of resource by Xiao Li exceeds 50% of its historical average ratio, it is considered that a significant change has occurred in the access to this resource type.

[0178] Real-time monitoring and analysis:

[0179] On Friday of a certain week, the system monitored Xiao Li's behavior data as follows:

[0180] Access time: At 10 am, Xiao Li's access frequency was 13 times / hour, exceeding the threshold range of [5, 11] times / hour set for the morning time period.

[0181] Access frequency: The number of times Xiao Li logged in to the enterprise office system this week was 8 times, exceeding the set threshold range of [3, 7] times / week.

[0182] Access resource type: The proportion of entertainment resources accessed by Xiao Li was 30%, exceeding 200% of its historical average proportion (10%), indicating that a significant change has occurred in the access to entertainment resources.

[0183] Conclusion: Based on the above analysis, Xiao Li's behavior indicators in terms of access time, access frequency, and access resource type all exceeded the set threshold range. Therefore, it can be judged that Xiao Li's behavior pattern has changed significantly. At this time, the system can further trigger the warning mechanism to notify relevant management personnel to pay attention and conduct investigations to determine whether there are security risks or other abnormal situations.

[0184] According to the detected changes in the network environment, analyze its impact on network security and the behavior analysis model. Determine which aspects of data and features are most critical for behavior analysis after the introduction of new applications, and which parts of the behavior pattern need to be focused on. For example, for features such as the communication protocol of new applications, data encryption methods, and users' operation behaviors in the applications, further analysis and learning are required to identify possible abnormal behaviors.

[0185] Based on the change impact analysis, formulate an adaptive adjustment strategy. Determine the specific scope of adjustment required for the behavior analysis model, including whether to adjust the model structure, which parameters to update, and how to expand and optimize the training dataset. For example, decide to fine-tune some of the basic models (such as neural network models) in the existing ensemble learning model, and at the same time add data related to new applications as new training samples to improve the model's ability to identify abnormal behaviors in the new application environment.

[0186] In view of the changes in the network environment and user behavior of new applications, data related to network behavior in the new environment is collected as new training samples. Specifically, it includes:

[0187] Normal behavior data: Collect network traffic data, system logs, and application logs from the scenarios where employees normally use new applications. For example, during normal working hours, record detailed data of operations such as document collaboration and video conferencing performed by employees using new applications, including the transmission content, timestamp, source IP address, destination IP address, and other information of the data packet.

[0188] Abnormal behavior data: simulate or monitor abnormal behaviors that may occur in relation to new applications, such as attacks by malicious attackers using vulnerabilities in new applications, illegal operations by internal employees, etc. For example, a DDoS attack can be simulated through a security testing tool to attack the server port (port 8080) of a new application, and network traffic data and system response data during the attack can be collected; at the same time, some illegal operation scenarios can be set, such as employees sharing sensitive files without authorization, and the corresponding operation behaviors and data changes can be recorded.

[0189] Label and organize the collected new training sample data. Labelers classify and label normal behavior data and abnormal behavior data according to the actual situation of the data, and record the characteristics and related information of each data in detail. For example, for abnormal behavior data, label its specific abnormal type (such as DDoS attack, data leakage, etc.), attack source IP address, attack target IP address, attack time and other key information. At the same time, clean and pre-process the data to remove invalid data such as noise data and duplicate data to ensure data quality and consistency.

[0190] The incremental learning method is used to fine-tune some parameters in the behavior analysis model. Taking the neural network model as an example, the specific process is as follows:

[0191] Select fine-tuning layers and parameters: Select the layers and parameters that need fine-tuning based on the characteristics of the new data and the structure of the model. Usually, some neurons and connection weights close to the output layer are selected for fine-tuning because these parts are closer to the final prediction results and more adaptable to new data. For example, select the last fully connected layer and some neurons in the second-to-last layer of the neural network model for fine-tuning.

[0192] Set learning rate and training parameters: Determine appropriate learning rate and number of training rounds. The learning rate determines the step size of each parameter update. Too large a learning rate may cause model instability, while too small a learning rate will slow down the training process. Based on experience and the size of new data, set the learning rate to 0.001 and the number of training rounds to 10.

[0193] Training with new data: Input the newly collected training sample data into the selected base model and train it according to the set learning rate and number of training epochs. During the training process, the model will automatically adjust the selected parameters according to the characteristics of the new data to adapt to the new network environment and behavior patterns. For example, in each training epoch, the model will calculate the loss function based on the new data and update the values of the selected parameters through the backpropagation algorithm, making the prediction results of the model closer to the labeled results of the new data.

[0194] Merge the newly collected training sample data with the original training data set to form a new and more comprehensive training data set. During the merging process, pay attention to the balance of the data to avoid the model being biased towards a certain type of data due to too much or too little new data. For example, if there is a large amount of newly collected normal behavior data, a part of it can be appropriately selected as validation data to ensure that the ratio of normal behavior data to abnormal behavior data in the training data set remains within a reasonable range (such as 1:1).

[0195] Perform further preprocessing on the updated training data set, including operations such as data cleaning, feature extraction, and normalization. For example, perform normalization processing on the network traffic data in the new data, map the data features to a fixed numerical range (such as 0 - 1) to improve the training effect and stability of the model.

[0196] After the adaptive adjustment step, the behavior analysis model has better adaptability and recognition ability for network behaviors in the new application environment. During subsequent monitoring, the system can more accurately identify normal behaviors and abnormal behaviors related to the new application, effectively reducing the false alarm rate and missed alarm rate.

[0197] Please refer to Figure 2 , the present invention provides another embodiment. This embodiment provides a network security intelligent monitoring system, and the network security intelligent monitoring system includes:

[0198] Data acquisition module 100: Used to collect network data from multiple data sources in the network. The data sources include but are not limited to network devices, servers, and terminal devices. The collected data includes network traffic data, system log data, and application program log data.

[0199] Data preprocessing module 200: Used to preprocess the collected network data. The preprocessing includes data cleaning, format unification, and feature extraction. Among them, feature extraction includes extracting deep features of network traffic data based on deep learning algorithms.

[0200] Behavior Analysis Module 300: It is used to perform behavior analysis on the preprocessed data by using a machine learning-based behavior analysis model. The behavior analysis model is trained through a training data set, which contains normal network behavior data and various known types of abnormal network behavior data. The behavior analysis model can identify normal network behavior and abnormal network behavior and determine the type of abnormal network behavior;

[0201] Real-time Monitoring and Decision-making Module 400: It is used to monitor the analysis results in real time. When it is determined that it is abnormal network behavior, according to the type and severity of the abnormal behavior, combined with predefined policies, make decisions. The decision results include alarm, blocking the connection, or adjusting network access permissions;

[0202] Adaptive Adjustment Module 500: It is used to continuously monitor the changes in the network environment, and automatically adjust the parameters of the behavior analysis model or update the training data set according to the changes in the network environment to improve the adaptive ability of the monitoring system.

[0203] In a preferred embodiment, the present application further provides an electronic device, which includes:

[0204] A memory; and a processor. A computer-readable instruction is stored on the memory. When the computer-readable instruction is executed by the processor, the network security intelligent monitoring method described above is implemented. This computer device can generally be a server, a terminal, or any other electronic device with necessary computing and / or processing capabilities. In one embodiment, this computer device may include a processor, a memory, a network interface, a communication interface, etc. connected through a system bus. The processor of this computer device can be used to provide necessary computing, processing, and / or control capabilities. The memory of this computer device may include a non-volatile storage medium and an internal memory. An operating system, a computer program, etc. may be stored in or on the non-volatile storage medium. The internal memory can provide an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface and communication interface of this computer device can be used to connect and communicate with external devices through a network. When the computer program is executed by the processor, the steps of the method of the present invention are executed.

[0205] The present invention can be implemented as a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method of the embodiments of the present invention are caused to be executed. In one embodiment, the computer program is distributed across a plurality of network-coupled computer devices or processors such that the computer program is stored, accessed, and executed by one or more computer devices or processors in a distributed manner. A single method step / operation, or two or more method steps / operations, can be executed by a single computer device or processor or by two or more computer devices or processors. One or more method steps / operations can be executed by one or more computer devices or processors, and one or more other method steps / operations can be executed by one or more other computer devices or processors. One or more computer devices or processors can execute a single method step / operation or execute two or more method steps / operations.

[0206] Those of ordinary skill in the art will understand that the method steps of the present invention can be completed by a computer program instructing relevant hardware such as a computer device or a processor. The computer program can be stored in a non-transitory computer-readable storage medium, and when the computer program is executed, the steps of the present invention are caused to be executed. Depending on the situation, any reference herein to a memory, storage, database, or other medium may include non-volatile and / or volatile memory. Examples of non-volatile memory include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk, etc. Examples of volatile memory include random access memory (RAM), external cache memory, etc.

[0207] The technical features described above can be combined arbitrarily. Although not all possible combinations of these technical features are described, any combination of these technical features should be considered to be covered by this specification as long as such a combination is not contradictory.

[0208] The specific embodiments of the present invention described above do not constitute a limitation on the protection scope of the present invention. Any other corresponding changes and modifications made according to the technical concept of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A network security intelligent monitoring method, characterized in that: The method comprises: S1, data collection step: collecting network data from multiple data sources in the network, the data sources include network devices, servers and terminal devices, and the collected data include network flow data, system log data and application log data; S2, data preprocessing step: preprocessing the collected network data, wherein the preprocessing includes data cleaning, format unification and feature extraction, wherein the feature extraction includes extracting deep features of the network traffic data based on a deep learning algorithm; S3, behavior analysis step: using a behavior analysis model based on machine learning to perform behavior analysis on the preprocessed data, the behavior analysis model is trained by a training data set, the training data set contains normal network behavior data and known types of abnormal network behavior data, the behavior analysis model can identify normal network behavior and abnormal network behavior, and determine the type of abnormal network behavior; S4, real-time monitoring and decision-making step: real-time monitoring and analysis results, when it is determined to be abnormal network behavior, according to the type and severity of the abnormal behavior, combined with predefined policies, decision-making results include alarm, blocking connection or adjusting network access rights; S5, adaptive adjustment step: continuously monitor changes in the network environment, and automatically adjust the parameters of the behavior analysis model or update the training data set according to the changes in the network environment.

2. The network security intelligent monitoring method according to claim 1 is characterized in that: In the behavior analysis step, the behavior analysis model based on machine learning is an integrated learning model, which is composed of multiple different basic machine learning models. Each basic machine learning model analyzes the data from different angles, and the results of each basic model are integrated to improve the accuracy of behavior analysis.

3. The network security intelligent monitoring method according to claim 2 is characterized in that: In the data collection step, the collection of the network traffic data is achieved through network sniffing technology or traffic mirroring technology.

4. The network security intelligent monitoring method according to claim 1 is characterized in that: In the data preprocessing step, the feature extraction includes extracting the timing features, packet header features and protocol features of the network traffic data.

5. The network security intelligent monitoring method according to claim 3 is characterized in that: In the real-time monitoring and decision-making step, the alarm information includes detailed abnormal network behavior characteristics, relevant source IP addresses and destination IP addresses, and suspicious timestamps.

6. The network security intelligent monitoring method according to claim 1, characterized in that: In the real-time monitoring and decision-making step, the alarm method includes at least one of a sound alarm, an email alarm and a text message alarm.

7. The network security intelligent monitoring method according to claim 1, characterized in that: In the adaptive adjustment step, when the network environment changes, the network data in the new environment is collected as new training samples to fine-tune the parameters of the behavior analysis model or retrain part of the model structure, thereby updating the behavior analysis model.

8. The network security intelligent monitoring method according to claim 2, characterized in that: In the behavior analysis step, the types of abnormal network behaviors include network attack behaviors, malware activity behaviors, and abnormal user access behaviors.

9. A network security intelligent monitoring system, characterized in that: include: Data collection module: used to collect network data from multiple data sources in the network, the data sources include but are not limited to network devices, servers and terminal devices, and the collected data include network flow data, system log data and application log data; Data preprocessing module: used to preprocess the collected network data, the preprocessing includes data cleaning, format unification and feature extraction, wherein feature extraction includes extracting deep features of network traffic data based on deep learning algorithms; Behavior analysis module: used to perform behavior analysis on the preprocessed data using a behavior analysis model based on machine learning. The behavior analysis model is trained using a training data set, which includes normal network behavior data and multiple known types of abnormal network behavior data. The behavior analysis model can identify normal network behavior and abnormal network behavior, and determine the type of abnormal network behavior; Real-time monitoring and decision-making module: used to monitor and analyze the results in real time. When abnormal network behavior is determined, decisions are made based on the type and severity of the abnormal behavior and predefined policies. The decision results include alarming, blocking the connection, or adjusting network access rights. Adaptive adjustment module: used to continuously monitor changes in the network environment, automatically adjust the parameters of the behavior analysis model or update the training data set according to changes in the network environment to improve the adaptive ability of the monitoring system.

10. An electronic device, characterized in that: include: Memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the network security intelligent monitoring method according to any one of claims 1 to 8 is implemented.

Images