Boundary security protection equipment vulnerability utilization detection method and device
By combining deep learning models for traffic monitoring, the problem of traditional boundary protection equipment detecting unknown threats is solved, an efficient and dynamic security protection system is realized, and the identification ability and resource utilization efficiency of unknown threats are improved.
Patent Information
- Application Number
- CN202510808103.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-17
- Publication Date
- 2025-08-01
AI Technical Summary
Traditional border protection equipment is difficult to deal with unknown vulnerabilities and advanced persistent threats, and has high resource consumption, which affects performance.
Combining traffic review and behavioral analysis, deep learning models such as multi-layer convolutional neural networks, long and short-term memory networks and variational autoencoder sequences are used to conduct multi-dimensional monitoring to identify abnormal traffic and unpublished vulnerability exploit attempts.
Achieve all-round security protection, automatically learn new attack modes, dynamically adjust model parameters, improve detection capabilities for unknown threats, and reduce resource consumption.
Smart Images
Figure CN120415893A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security, and specifically to a method and device for detecting the exploitation of vulnerabilities in border security protection devices. Background Art
[0002] With the deep integration of industrial Internet and information technology, the border security protection system of industrial control systems (ICS) is facing increasingly complex new security challenges. Traditional border protection means, such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc., although they can provide certain protection, they rely on predefined security rules or threat feature libraries and are difficult to cope with unknown vulnerabilities or advanced persistent threats. At the same time, in order to achieve heterogeneous redundancy of multiple execution entities, the system needs to maintain multifunctional filtering and review execution entities and perform dynamic scheduling and management, which not only increases the complexity of the system, but also may lead to high resource consumption and affect the overall performance. At the same time, due to the long-term static deployment of the above devices, once there are undetected vulnerabilities or backdoors, they may be maliciously exploited. Summary of the Invention
[0003] Based on this, the present invention provides a method and device for detecting the exploitation of vulnerabilities in border security protection devices, which combines traffic review and behavior analysis to achieve multi-dimensional monitoring of network traffic. It can not only identify known attack types, but also discover potential abnormal behaviors and unpublicized vulnerability exploitation attempts. By integrating a variety of deep learning models and technologies, covering from low-level protocol parsing to high-level application layer attack detection, a comprehensive security protection system is formed.
[0004] In the first aspect, the present invention provides a method for detecting the exploitation of vulnerabilities in border security protection devices, including:
[0005] Obtain original network data packets;
[0006] Preprocess the original network data packets to obtain standardized network data;
[0007] Input the standardized network data into a trained deep learning model to obtain an abnormal traffic detection result.
[0008] Further, the trained deep learning model includes a multi-layer convolutional neural network structure, a long short-term memory network or a variational autoencoder sequence, a fully connected layer, and a mathematical regression model;
[0009] Among them, the multi-layer convolutional neural network structure is used to extract key features from the input standardized network data;
[0010] The long short-term memory network or variational autoencoder sequence is used to perform time series analysis on key features to identify abnormal traffic;
[0011] The fully connected layer and the mathematical regression model are used to classify abnormal traffic.
[0012] Further, preprocessing the original network packets to obtain standardized network data, specifically:
[0013] Parsing the original network packets to obtain the datagram header information and payload information of the original network packets;
[0014] Normalizing the datagram header information and the payload information respectively to obtain normalized datagram header information and normalized payload information;
[0015] Integrating the normalized datagram header information and the normalized payload information into a data stream in a unified format to obtain standardized network data.
[0016] Further, the header information includes an IP address and a port number, and the payload information includes HTTP request content.
[0017] Further, the key features include a source IP address, a destination IP address, a port number, and a protocol type.
[0018] Further,
[0019] The long short-term memory network or variational autoencoder sequence is used to perform time series analysis on key features, specifically:
[0020] The long short-term memory network or variational autoencoder sequence combines a sliding window to capture the temporal relationship between each key feature to identify abnormal traffic. Further, the fully connected layer and the mathematical regression model are used to classify abnormal traffic, including:
[0021] Inputting the abnormal traffic into a batch normalization layer to obtain abnormal traffic with a similar distribution;
[0022] Inputting the abnormal traffic with a similar distribution into the fully connected layer and the mathematical regression model, and taking the threat category with the highest probability as the threat classification label of the abnormal traffic. Further, the method for detecting vulnerabilities exploited by a border security protection device further includes: dynamically adjusting the working state and model parameters of the deep learning model according to the detection results.
[0023] In a second aspect, the present invention also provides a device for detecting vulnerabilities exploited by a border security protection device, including:
[0024] A data acquisition module, configured to obtain original network packets;
[0025] A data preprocessing module for preprocessing the original network data packets to obtain standardized network data;
[0026] An anomaly detection module for inputting the standardized network data into a trained deep learning model to obtain an anomaly traffic detection result.
[0027] In a third aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the boundary security protection device vulnerability exploitation detection method according to any one of the first aspects are implemented.
[0028] In a fourth aspect, the present invention further provides a computer device including a memory and a processor, the memory storing a computer program, characterized in that when the processor executes the computer program, the boundary security protection device vulnerability exploitation detection method according to any one of the first aspects is executed.
[0029] The beneficial effects of adopting the above technical solutions are as follows: This embodiment combines traffic review and behavior analysis to achieve multi-dimensional monitoring of network traffic. It can not only identify known attack types, but also discover potential abnormal behaviors and unpublicized vulnerability exploitation attempts. By integrating a variety of deep learning models and technologies, covering from low-level protocol parsing to high-level application layer attack detection, a comprehensive security protection system is formed. Further, by using deep learning models, especially convolutional neural networks (CNNs) and long short-term memory networks (LSTMs), new attack patterns can be automatically learned from historical data without relying on a pre-defined feature library. Through a negative feedback mechanism and an online learning algorithm, the model can self-update and optimize according to the latest threat intelligence, maintaining sensitivity to the latest attack means. Description of the Drawings
[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art.
[0031] Figure 1 It is a schematic diagram of the boundary security protection device vulnerability exploitation detection method in an embodiment of the present application;
[0032] Figure 2 It is a schematic diagram of the boundary security protection device vulnerability exploitation detection device in an embodiment of the present application. Detailed Embodiments
[0033] Next, in combination with the accompanying drawings in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention. To describe the present invention in more detail, the method and device for detecting vulnerability exploitation of boundary security protection equipment provided by the present invention will be specifically described below in combination with the accompanying drawings.
[0034] Unless otherwise defined, the technical terms or scientific terms used in the disclosure of this application should have the ordinary meaning understood by those of ordinary skill in the art to which the present invention belongs. The "first", "second" and similar terms used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, terms such as "a", "one" or "the" do not indicate a limitation in quantity, but indicate the existence of at least one. The terms such as "including" or "comprising" mean that the elements or objects appearing before this term cover the elements or objects listed after this term and their equivalents, without excluding other elements or objects. The terms such as "connected" or "coupled" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The terms such as "upper", "lower", "left" and "right" are only used to represent relative positional relationships, and when the absolute position of the object being described changes, the relative positional relationship may also change accordingly.
[0035] The method for detecting vulnerability exploitation of boundary security protection equipment refers to the act of identifying, through technical means, the software vulnerabilities, configuration defects or preset backdoors existing in boundary security devices such as firewalls, intrusion detection systems, and intrusion prevention systems by attackers, and implementing illegal intrusion or privilege escalation. Its core value is reflected in three levels: First, the detection object is not external attack traffic, but focuses on the vulnerability exploitation behavior of the protection equipment itself; Second, it breaks through the limitations of traditional database detection, and identifies unknown threats such as zero-day vulnerability exploitation and supply chain pollution attacks through dynamic behavior analysis (such as protocol anomaly parsing, privilege mutation monitoring), which is especially suitable for targeted penetration against protection equipment in APT attacks; Then, by combining vulnerability priority assessment (such as CVSS score) and attack context correlation analysis, it realizes the upgrade from "vulnerability existence identification" to "actual attack chain blocking".
[0036] Based on this, in combination with the Figure 1 schematic diagram of the method for detecting vulnerability exploitation of boundary security protection equipment shown, the present invention proposes a method for detecting vulnerability exploitation of boundary security protection equipment, which automatically learns new attack patterns through a deep learning model and does not require relying on a feature library.
[0037] Step S101: Obtain the original network data packets.
[0038] Specifically, in this embodiment, the original network data packets can be collected through a network card. The original network data packets include three parts: a header, a payload, and a footer. The header contains the source address, destination address, protocol, and packet number. The payload is the actual transmission data of the original network data packet and is the only data transmitted and received between the source address and the destination address. The footer is used to notify the receiving device that the end of the data packet has been reached and is used to determine that all data packets have been fully received.
[0039] Step S102: Preprocess the original network data packets to obtain standardized network data.
[0040] Specifically, the standardization process of the original data packets in step S102 can include the following specific steps:
[0041] Step S201: Parse the original network data packets to obtain the data header information and payload information of the original network data packets.
[0042] Use a network protocol stack parsing tool (such as Libpcap) to parse the original network data packets and extract the data headers (such as IP addresses, port numbers) and payload information (such as HTTP request content) of the original network data packets.
[0043] Step S202: Normalize the data header information and payload information respectively to obtain normalized data header information and normalized payload information.
[0044] To ensure that data from different sources has the same scale range, the data header information and payload information are normalized respectively. For example, the Min-Max scaling method is used to scale the values to within the interval to obtain normalized data header information and normalized payload information.
[0045] Step S203: Integrate the normalized data header information and normalized payload information into a data stream in a unified format to obtain standardized network data.
[0046] Integrate the normalized data header information and normalized payload information into a data stream in a unified format, denoted as standardized network data, which is convenient for subsequent feature extraction and anomaly detection steps.
[0047] Step S103: Input the standardized network data into the trained deep learning model to obtain the anomaly traffic monitoring result.
[0048] Specifically, the trained deep learning model includes a multi-layer convolutional neural network structure, a long short-term memory network or a variational autoencoder sequence, a fully connected layer, and a mathematical regression model;
[0049] Among them, the multi-layer convolutional neural network structure is used to extract key features from the input standardized network data;
[0050] The long short-term memory network or variational autoencoder sequence is used to perform time series analysis on the key features to identify abnormal traffic;
[0051] The fully connected layer and the mathematical regression model are used to classify the abnormal traffic.
[0052] The following will describe in detail the specific functions of each part in the deep learning network:
[0053] (1) Regarding the multi-layer convolutional neural network structure:
[0054] Specifically, in this embodiment, a convolutional neural network layer is used to extract key features from the standardized network data, and the key features include but are not limited to the source IP address, destination IP address, port number, and protocol type.
[0055] First, a multi-layer convolutional neural network (CNN) structure is used to extract features from each field in the standard network data layer by layer. Each layer of the CNN structure contains multiple convolutional kernels for capturing features at different scales. For example, the first-layer convolutional kernels capture local features of the standard network data, and the deep convolutional kernels capture global features of the standard network data.
[0056] Second, by adding a pooling layer (such as max pooling) after each convolutional layer, the feature size dimension is reduced, while key feature information is retained, and the computational complexity is reduced.
[0057] Then, the feature vector extracted from the previous layer is used as the input of the next layer, and a multi-level feature representation is constructed to form the final key features.
[0058] (2) Regarding the long short-term memory network or variational autoencoder sequence:
[0059] In this embodiment, the key features are input into a long short-term memory network or a variational autoencoder sequence for time series analysis to identify abnormal traffic. Specifically, the identification of abnormal traffic patterns mainly relies on the time series analysis capabilities of a long short-term memory network (LSTM for short) or a variational autoencoder sequence (VAE for short). Training is performed based on the historical data of normal traffic, so as to capture normal traffic patterns. When the key features of network packets deviate from these normal patterns, they can be considered abnormal traffic patterns. The process of identifying through time series analysis of key features specifically includes the following steps:
[0060] Step S401: Capture the temporal relationship between each key feature through the gating unit of the long short-term memory network model.
[0061] Utilize the dependency relationship of key features in the time series, and capture the temporal relationship between the key features through the gating unit to avoid the problem of long-term dependencies.
[0062] Step S402: Divide the key features within a continuous time period into several time steps using a sliding window.
[0063] Use the sliding window technique to batch process the key features within a continuous time period. Each time window is a time step, thereby improving the calculation efficiency. For example, set a time window of a fixed size and move one time unit each time to process all the key features within this window.
[0064] Step S403: Set weights for the key features of each time step in combination with the attention mechanism.
[0065] The attention mechanism allows the model to give more weights to important key features during the processing, thereby improving the accuracy of anomaly detection. Specifically, the importance score of each time step can be calculated, and different weights can be assigned to each key feature accordingly, so that the model pays more attention to the key features that may indicate abnormal behavior. For example, in an HTTP request, if it is found that specific URL parameters or SQL statements are abnormal, then increase the weights of these key features.
[0066] (III) Fully connected layer and mathematical regression model
[0067] Specifically, the obtained abnormal traffic is input into a fully connected layer and a mathematical regression model for classification, and specific threat classification labels are marked for the abnormal traffic.
[0068] Specifically, the specific threat classification labels marked for abnormal traffic include but are not limited to normal traffic, Dos attack, and SQL injection. The process of inputting the above abnormal traffic into the fully connected layer and the mathematical regression model for classification is as follows:
[0069] Step S501: Input the abnormal traffic into the batch normalization layer to obtain abnormal traffic with a similar distribution.
[0070] In this embodiment, a batch normalization layer is added before the fully connected layer to ensure that each batch of input data has a similar distribution, accelerate the training process, and improve the model stability at the same time.
[0071] Step S502: Input the abnormal traffic with a similar distribution into the fully connected layer and the mathematical regression model, and use the threat category with the highest probability as the threat classification label of the abnormal traffic.
[0072] The mathematical regression model converts the output of the fully connected layer into a probability distribution, selects the threat category with the highest probability as the threat classification label of the abnormal traffic, and the threat classification label can be marked as "normal traffic", "Dos attack", "SQL injection", etc.
[0073] In addition, the method for detecting vulnerability exploitation of the border security protection device in this embodiment also has a dynamic scheduling and feedback part, specifically:
[0074] Step S106: Dynamically adjust the working state and model parameters of the deep learning model according to the detection results.
[0075] Specifically, this embodiment is provided with a negative feedback control mechanism to regularly evaluate the model performance of the deep learning model and update the model parameters according to the detection results to ensure the long-term stable operation of the deep learning model. For example, when it is found according to the detection results that the deep learning model has false alarms or missed detections, the accuracy can be improved by adjusting the model parameters of the deep learning model. The model parameters of the above deep learning model can be evaluated by indicators such as accuracy rate, recall rate, and F1 score. Combine the monitoring system logs and the administrator feedback information to identify false alarms and missed detections. Once the number of false alarms or missed detections reaches the set threshold (such as more than 10 times within a week), the model parameters of the deep learning model are adjusted.
[0076] Furthermore, combine the current network traffic and the detection results to dynamically adjust the acquisition frequency of the original data packets and the concurrent processing ability of the deep learning model.
[0077] Furthermore, if the deep learning model detects a newly emerging threat type, it automatically triggers an online learning process to update the knowledge base of the deep learning model in a timely manner. Specifically, when a new type of attack is detected, relevant data of the new type of attack is collected and the deep learning model is trained in combination with this data to update the deep learning model. The judgment of a new threat type is usually based on an increase in the uncertainty output by the deep learning model or new features that cannot be covered by the existing classification. For example, if a certain traffic pattern appears frequently but cannot be correctly classified by the current deep learning model, this may be a sign of a new threat type. Once such a situation is detected, relevant data of this threat type will be automatically collected and the online learning process will be triggered to update the model knowledge base to adapt to the new
[0078] In addition, in this embodiment, the method further includes recording the detailed information in each detection process, including the packet content, detection results, and measures taken, and providing a visualization interface to display the historical detection records and the real-time security situation, which is convenient for users to understand and operate.
[0079] In this embodiment, the method further includes immediately sending an alarm to notify the administrator when potential abnormal behavior is detected, and supporting multiple alarm methods, such as text messages, emails, or in-system notifications, to ensure timely response. Specifically, when the abnormal behavior warning module detects potential abnormal behavior, it immediately sends an alarm to notify the administrator. For example, it reminds relevant personnel by means of text messages, emails, or in-system notifications, supports multiple alarm methods, such as text messages, emails, or in-system notifications, to ensure timely response. For example, different alarm policies are configured to select the appropriate alarm method according to the threat level.
[0080] Based on the above technical solutions, the vulnerability exploitation detection method of the boundary security protection device provided in this embodiment achieves the following technical effects:
[0081] (1) Raw network packets are collected through the network card and subjected to standardization and normalization processing. This process ensures that data from different sources has the same scale range, improves the input quality of the subsequent deep learning model. Standardization and normalization processing can eliminate the differences between data, enabling the deep learning model to better learn the key patterns in the data, thereby improving the overall detection accuracy.
[0082] (2) The deep learning model uses a multi-layer convolutional neural network structure to extract features from the preprocessed packets, capturing features at different scales. The CNN can automatically learn and extract complex feature patterns without manual definition of features, enhancing the system's detection ability for unknown threats. For example, the CNN can identify abnormal traffic patterns that may not be covered by traditional rules.
[0083] (3) The deep learning model uses an LSTM or VAE sequence model to perform time series analysis on the extracted key features to identify abnormal traffic patterns. The LSTM can capture the temporal dependencies between data packets and enhance the ability to identify complex attack behaviors. For example, in a DDoS attack, the LSTM can detect and give early warnings of abnormal behaviors by analyzing the time series features of the traffic.
[0084] (4) The deep learning model converts the anomaly detection results into specific threat classification labels, such as normal traffic, DDoS attack, and SQL injection, through a fully connected layer and a softmax function. The fully connected layer and the softmax function can map complex feature vectors into specific threat categories and provide clear classification results. For example, the system can accurately determine whether the current traffic belongs to a DDoS attack based on the probability distribution output by the softmax and take corresponding defense measures.
[0085] (5) Dynamically adjust the working state of the deep learning model according to the detection results, and continuously optimize the parameters of the deep learning model through a negative feedback mechanism. The negative feedback mechanism can dynamically adjust the parameters of the deep learning model according to the actual operation situation to ensure the long-term stability and high accuracy of the system. For example, when false alarms or missed detections are found, the system can automatically adjust the parameters of the deep learning model to improve the detection accuracy.
[0086] It should be understood that although each step in the attached Figure 1 flowchart is shown sequentially according to the arrow indication, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise clearly stated in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, at least a part of the steps in the attached Figure 1 may include multiple sub-steps or sub-phases. These sub-steps or phases are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or phases is not necessarily sequential either, but can be executed alternately or in turn with at least a part of other steps or sub-steps or phases of other steps.
[0087] In the above embodiments of the present invention, the method for detecting vulnerability exploitation of a border security protection device is described in detail. The above method disclosed by the present invention can be implemented by various forms of devices. Therefore, the present invention also discloses a device for detecting vulnerability exploitation of a border security protection device, and specific embodiments are given below for detailed description.
[0088] A data acquisition module 701, configured to obtain original network data packets;
[0089] A data preprocessing module 702, configured to preprocess the original network data packets to obtain standardized network data;
[0090] Anomaly detection module 703 is configured to input the standardized network data into a trained deep learning model to obtain an abnormal traffic detection result.
[0091] For the vulnerability exploitation detection device of the border security protection device, reference can be made to the above limitations on the method, which will not be elaborated here. Each module in the above device can be implemented in whole or in part by software, hardware, and their combination. Each of the above modules can be embedded in the processor of the terminal device in hardware form or independent of it, or stored in the memory of the terminal device in software form so that the processor can call and execute the operations corresponding to each of the above modules.
[0092] In one embodiment, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned border security protection device vulnerability exploitation detection method are implemented.
[0093] The computer-readable storage medium may be an electronic memory such as a flash memory, EEPROM (electrically erasable programmable read-only memory), EPROM (erasable programmable read-only memory), hard disk, or ROM. Optionally, the computer-readable storage medium includes a non-transitory computer-readable storage medium. The computer-readable storage medium has a storage space for program codes for executing any method steps in the above method. These program codes can be read out from or written into one or more computer program products, and the program codes can be compressed in an appropriate form.
[0094] In one embodiment, the present invention provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it executes the above-mentioned border security protection device vulnerability exploitation detection method.
[0095] The computer device includes a memory, a processor, and one or more computer programs. One or more of the computer programs can be stored in the memory and configured to be executed by one or more processors. One or more application programs are configured to execute the above-mentioned border security protection device vulnerability exploitation detection method.
[0096] The processor may include one or more processing cores. The processor utilizes various interfaces and circuits to connect various parts within the entire computer device. By running or executing instructions, programs, code sets, or instruction sets stored in the memory, and by invoking data stored in the memory, the processor performs various functions of the computer device and processes data. Optionally, the processor may be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), or programmable logic array (PLA). The processor may integrate one or a combination of several of a central processing unit (CPU), a reporting validator for buried point data (graphics processing unit, GPU), and a modem, etc. Among them, the CPU mainly processes the operating system, user interface, application programs, etc.; the GPU is responsible for rendering and drawing the displayed content; the modem is used to process wireless communication. It can be understood that the above-mentioned modem may not be integrated into the processor and may be implemented separately through a communication chip.
[0097] The memory may include random access memory (RAM) and may also include read-only memory. The memory can be used to store instructions, programs, code, code sets, or instruction sets. The memory may include a program storage area and a data storage area. Among them, the program storage area may store instructions for implementing the operating system, instructions for implementing at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created during the use of the terminal device.
[0098] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.
Claims
1. A method for detecting the exploitation of vulnerabilities in a border security protection device, characterized in that, Including: Obtain the original network data packet; Preprocess the original network data packet to obtain standardized network data; Input the standardized network data into the trained deep learning model to obtain the abnormal traffic detection result.
2. The method for detecting vulnerability exploitation of the border security protection device according to claim 1, characterized in that, The trained deep learning model includes a multi-layer convolutional neural network structure, a long short-term memory network or a variational autoencoder sequence, a fully connected layer, and a mathematical regression model; Among them, the multi-layer convolutional neural network structure is used to extract key features from the input standardized network data; The long short-term memory network or the variational autoencoder sequence is used to perform time series analysis on the key features to identify abnormal traffic; The fully connected layer and the mathematical regression model are used to classify the abnormal traffic.
3. The vulnerability exploitation detection method for the border security protection device according to claim 1, characterized in that The preprocessing of the original network data packet to obtain standardized network data is specifically as follows: Parse the original network data packet to obtain the data header information and payload information of the original network data packet; Normalize the data header information and the payload information respectively to obtain the normalized data header information and the normalized payload information; Integrate the normalized data header information and the normalized payload information into a data stream in a unified format to obtain standardized network data.
4. The method for detecting vulnerability exploitation of the boundary security protection device according to claim 3, wherein The header information includes the IP address and the port number, and the payload information includes the HTTP request content.
5. The vulnerability exploitation detection method for the border security protection device according to claim 4, characterized in that, The key features include the source IP address, the destination IP address, the port number, and the protocol type.
6. The method for detecting vulnerability exploitation of the boundary security protection device according to claim 5, characterized in that, The long short-term memory network or the variational autoencoder sequence is used to perform time series analysis on the key features, specifically as follows: The long short-term memory network or the variational autoencoder sequence combines a sliding window to capture the temporal relationship between each key feature to identify abnormal traffic.
7. The vulnerability exploitation detection method for the boundary security protection device according to claim 6, characterized in that The fully connected layer and the mathematical regression model are used to classify the abnormal traffic, specifically as follows: Input the abnormal traffic into the batch normalization layer to obtain abnormal traffic with a similar distribution; Input the abnormal traffic with a similar distribution into the fully connected layer and the mathematical regression model, and use the threat category with the highest probability as the threat classification label of the abnormal traffic.
8. The vulnerability exploitation detection method for the boundary security protection device according to claim 1, wherein Also including: Dynamically adjust the working state and model parameters of the deep learning model according to the detection result.
9. A vulnerability exploitation detection device for a border security protection device, characterized in that, Including: A data acquisition module for obtaining the original network data packet; A data preprocessing module for preprocessing the original network data packet to obtain standardized network data; An abnormal detection module for inputting the standardized network data into the trained deep learning model to obtain the abnormal traffic detection result.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for detecting vulnerabilities in the boundary security protection device as described in any one of claims 1-8.
11. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it executes the method for detecting vulnerabilities in the boundary security protection device as described in any one of claims 1-8.