Network intrusion intelligent monitoring method and system based on deep learning

Abstract

The invention provides a network intrusion intelligent monitoring method and system based on deep learning, relates to the field of network security, and solves the technical problem of response lag of an existing defense method. The method comprises the following steps: collecting multi-source data; preprocessing the multi-source data to generate a spatial-temporal feature map; inputting the spatial-temporal feature map into a first model and a second model constructed based on a deep learning algorithm for anomaly detection to obtain a detection result; wherein the first model is used for detecting a known attack mode, and the second model is used for detecting an unknown attack mode; and carrying out hierarchical risk level division on the detection result, and carrying out active defense according to the defense strategy of each risk level. The method is used in the network intrusion monitoring and defense process, intelligent monitoring and active defense of network intrusion are realized through multi-source data acquisition, spatial-temporal feature map generation, dual-model cooperative detection and layered defense strategy implementation, and the real-time performance and initiative of network security protection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and specifically to a network intrusion intelligent monitoring method and system based on deep learning. Background Art

[0002] In the wave of digitalization, the Internet has become deeply integrated into every aspect of social life. From business operations and financial transactions to personal information exchange, the importance of network security has become increasingly prominent. However, network intrusions constantly threaten the security, stability, and data integrity of network systems.

[0003] Existing network intrusion prevention technologies often experience a significant lag between detecting an intrusion and initiating effective defense measures. After detecting an intrusion, some traditional security devices require manual analysis and confirmation, followed by the manual development and execution of defense strategies. This manual intervention is inefficient given the millisecond-level pace of network attacks today. For example, in a distributed denial-of-service (DDoS) attack, attackers can launch a massive flood of requests in a short period of time, instantly exhausting the target server's bandwidth and resources. If the defense system cannot respond within seconds or even milliseconds, the server may be paralyzed during the manual verification and response process, disrupting services and causing significant financial losses and reputational damage. Summary of the Invention

[0004] This application provides a network intrusion intelligent monitoring method and system based on deep learning, which solves the technical problem of delayed defense response in the existing technology.

[0005] To achieve the above objectives, this application adopts the following technical solutions:

[0006] First, we provide a deep learning-based intelligent network intrusion monitoring method, including:

[0007] Collect multi-source data; the multi-source data includes switch port data, flow table matching statistics, process creation records, file access logs, API call parameters and HTTP request characteristics;

[0008] Preprocessing the multi-source data to generate a spatiotemporal feature map; the spatiotemporal feature map is used to characterize the distribution characteristics of the multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment;

[0009] Inputting the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection to obtain a detection result; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns;

[0010] The detection results are divided into hierarchical risk levels, and active defense is performed according to the defense strategy for each risk level.

[0011] Based on the above technical solution, in the deep learning-based network intrusion intelligent monitoring method provided in this application, by preprocessing multi-source data and generating spatiotemporal feature maps, complex network data can be converted into a visual expression with both dynamic changes in the time dimension and distribution characteristics in the spatial dimension, providing a more representative input for subsequent model detection; a first model and a second model constructed based on a deep learning algorithm are used for anomaly detection, wherein the first model has accurate feature matching capabilities for known attack patterns and can efficiently identify attack types in historical records, and the second model discovers unknown attacks by learning normal network behavior patterns. The combination of the two achieves full coverage detection of known and unknown attacks, greatly improving the accuracy and comprehensiveness of detection; a mechanism for automatically generating defense strategies based on detection results can respond quickly after an attack is discovered, and can initiate corresponding protection measures without human intervention, effectively shortening the attack response time and enhancing the real-time and proactive nature of network security protection.

[0012] In combination with the first aspect above, in a possible implementation, the multi-source data includes: switch port data, flow table matching statistics, process creation records, file access logs, API call parameters, and HTTP request features; wherein,

[0013] Switch port data includes switch port byte count, packet count, and duration;

[0014] Flow table entry matching statistics include source IP, destination IP, source port, destination port, protocol type, and flow duration;

[0015] The process creation record includes process ID, parent process ID, process creation time, and process execution path;

[0016] File access logs include file access path, access user, and file operation type;

[0017] API call parameters include API call path, API request parameters, and API response time;

[0018] HTTP request characteristics include URL parameters, User-Agent, and request header fields.

[0019] In combination with the first aspect above, in one possible implementation, the process of generating the spatiotemporal feature map includes:

[0020] Preprocess multi-source data to obtain standardized feature vectors; preprocessing includes Z-Score standardization, one-hot encoding, and normalization;

[0021] Based on the SDN network topology, physical nodes are mapped into two-dimensional grid coordinates.

[0022] A multi-channel spatial feature map is constructed using standardized feature vectors; the channels include network traffic feature channels, network connection relationship channels, host process behavior channels, file access control channels, and application layer interaction channels; wherein,

[0023] The network traffic feature channel includes the switch port data, the network connection relationship channel includes the flow table matching statistics, the host process behavior channel includes the process creation record, the file access control channel includes the file access log, and the application layer interaction channel includes the API call parameters and the HTTP request characteristics;

[0024] Use sliding windows to slice multi-source data to obtain sliced ​​data;

[0025] The slice data is temporally encoded using wavelet transform and fused with the multi-channel spatial feature map to obtain the spatiotemporal feature map.

[0026] In conjunction with the above first aspect, in a possible implementation, the first model includes:

[0027] Extract the spatial features of the input data through multiple convolutional layers and pooling layers;

[0028] Extract the temporal features of input data through LSTM network;

[0029] A cross-layer attention module is used to calculate the weight matrix of spatial features and temporal features, and weighted fusion of spatial features and temporal features is performed based on the weight matrix; the cross-layer attention module is used to characterize the correlation strength between spatial features at different time steps and temporal features at different spatial positions;

[0030] The weighted fused feature vector is flattened and classified through a fully connected layer to output the attack probability and attack type label.

[0031] In combination with the above first aspect, in a possible implementation, the second model includes:

[0032] Using an autoencoder to learn feature representations of normal traffic data to obtain true features; the normal traffic data represents multi-source data when no network intrusion occurs;

[0033] The information maximization generative adversarial network (InfoGAN) architecture is introduced. The generator of the InfoGAN architecture simulates attack traffic to obtain generated features.

[0034] The discriminator of the InfoGAN architecture distinguishes between real features and generated features, and through adversarial training, improves the generator's ability to generate abnormal traffic and the discriminator's ability to distinguish abnormal traffic; the abnormal traffic represents multi-source data including network intrusions;

[0035] Calculate the reconstruction error of normal traffic data passing through the autoencoder to obtain the error baseline of normal traffic data; the reconstruction error is used to characterize the autoencoder's ability to reconstruct the input data, and the difference between the original input data and the output data of the autoencoder is calculated using the mean square error or mean absolute error;

[0036] The reconstruction error of the input data is calculated, and the reconstruction error of the input data is compared with the error baseline to obtain an anomaly score.

[0037] In conjunction with the first aspect above, in one possible implementation, the process of generating the detection result includes:

[0038] The spatiotemporal feature graph is input into the first model and the second model respectively. The first model outputs the attack probability and attack type, and the second model outputs the anomaly score.

[0039] The weighted voting mechanism is used to perform a weighted summation of the attack probability and the anomaly score to obtain a comprehensive risk value.

[0040] The detection result includes a comprehensive risk value and an attack type.

[0041] In conjunction with the first aspect above, in one possible implementation, performing active defense according to the defense strategy for each risk level includes:

[0042] When the comprehensive risk value is less than the first threshold, the optimal routing path is calculated based on the K-path algorithm, and the traffic direction is guided by the OpenFlow flow table rules;

[0043] When the comprehensive risk value is greater than or equal to the first threshold and less than the second threshold, the pre-set temporary firewall range control list rules are called according to the attack type, and the frequency of anomaly detection is increased;

[0044] When the comprehensive risk value is greater than or equal to the second threshold and less than the third threshold, a dynamic defense strategy is generated using a reinforcement learning model; the input of the reinforcement learning model includes the current network topology characteristics, service characteristics, traffic characteristics and the state vector of historical strategy effects, and the output is the probability distribution of each defense strategy in the action space.

[0045] In combination with the first aspect above, in a possible implementation, the reinforcement learning model includes a state space, an action space, and a reward function; wherein,

[0046] The state space includes network topology features, service features, traffic features, and historical policy effects; the network topology features include a network node connection relationship adjacency matrix constructed based on a software-defined network (SDN) controller, and the available bandwidth vector of links between network nodes; the service features include a binary encoding vector of a set of open ports, and a hash value representation of the service version running on each open port; the traffic features include a time series feature of the abnormal traffic ratio calculated based on a sliding window, and a probability density vector of the protocol distribution; the historical policy effects include a time series sequence of the blocking success rate of the last N defensive actions, and an exponential moving average of the network delay increase rate;

[0047] The action space includes IP hopping, port randomization, and traffic redirection action sets; IP hopping refers to randomly selecting a new IP address based on the uniform distribution of a preset IP address pool; port randomization refers to generating a new port using a deterministic random algorithm within the port range provided by the Internet Assigned Numbers Authority (IANA); and traffic redirection includes multiple preconfigured paths to the scrubbing center and honeypot system.

[0048] The reward function includes a weighted calculation function determined based on traffic anomaly data, network delay data, and defense strategy cost data.

[0049] In conjunction with the first aspect above, in one possible implementation, generating a dynamic defense strategy using a reinforcement learning model includes:

[0050] The state vector consisting of the current network topology characteristics, service characteristics, traffic characteristics and historical strategy effects is input into the reinforcement learning model;

[0051] The reinforcement learning model is optimized using a proximal policy optimization algorithm based on the actor-critic framework. The actor network is used to output the probability distribution of each action in the action space, and the critic network is used to generate the calculated value of the state-value function and update the critic network's own parameters by minimizing the temporal difference error.

[0052] Batch collect the last M state-action-reward-next-state quadruples and calculate the gradient estimate of the Actor network through importance sampling;

[0053] The Actor network and the Critic network are updated respectively according to the gradient estimate, and the state value function calculation result of the Critic network is used to provide an update target for the Actor network;

[0054] According to the updated Actor network output action probability distribution, the action with the highest probability in the action probability distribution is selected as the dynamic defense strategy.

[0055] In the second aspect, the present application provides a network intrusion intelligent monitoring method and system based on deep learning, including: a feature construction module, an anomaly detection module and a strategy generation module; wherein,

[0056] The feature construction module is used to preprocess the collected multi-source data to generate a spatiotemporal feature graph; the multi-source data includes switch port data, flow table matching statistics, process creation records, file access logs, API call parameters, and HTTP request features;

[0057] The spatiotemporal feature graph is used to characterize the distribution characteristics of multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment;

[0058] The anomaly detection module is configured to input the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection and obtain a detection result; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns;

[0059] The strategy generation module is used to classify the detection results into hierarchical risk levels and perform active defense according to the defense strategy of each risk level.

[0060] In a third aspect, a network intrusion intelligent monitoring device based on deep learning is provided, comprising: a communication unit and a processing unit; wherein,

[0061] The communication unit is used to collect multi-source data from the basic components in the network environment and transmit it to the processing unit, while interacting with the basic components to execute defense strategies; the basic components include switches, SDN controllers, flow table management devices, host systems, application service systems, and firewall devices; wherein,

[0062] The switch is used to collect switch port data;

[0063] The SDN controller is used to obtain a network topology map;

[0064] The flow table management device is used to collect flow table entry matching statistics;

[0065] The host system is used to collect process creation records and file access logs;

[0066] The application service system is used to obtain API call parameters and HTTP request characteristics;

[0067] The firewall device is configured to receive a defense policy instruction generated by a processing unit;

[0068] The processing unit is used to pre-process the multi-source data to generate a spatiotemporal feature map; the spatiotemporal feature map is used to characterize the distribution characteristics of the multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment;

[0069] Inputting the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection to obtain a detection result; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns;

[0070] The detection results are divided into hierarchical risk levels, and active defense is performed according to the defense strategy for each risk level.

[0071] In a fourth aspect, the present application provides a deep learning-based intelligent network intrusion monitoring device, comprising: a processor and a storage medium; the storage medium comprising instructions, the processor being configured to execute the instructions to implement the method described in the first aspect and any possible implementation of the first aspect. The deep learning-based intelligent network intrusion monitoring device can be an electronic device or a chip within an electronic device.

[0072] In a fifth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are run on a deep learning-based network intrusion intelligent monitoring device, the deep learning-based network intrusion intelligent monitoring device executes the method described in the first aspect and any possible implementation of the first aspect.

[0073] In a sixth aspect, the present application provides a computer program product comprising instructions, which, when run on a network intrusion intelligent monitoring device based on deep learning, enables the network intrusion intelligent monitoring device based on deep learning to perform the method described in the first aspect and any possible implementation of the first aspect.

[0074] This application provides a network intrusion intelligent monitoring method and system based on deep learning, which realizes accurate perception and comprehensive detection of network attacks through multi-source data collection and spatiotemporal feature fusion. Specifically, by collecting multi-dimensional data such as switch port statistics, flow table matching, process creation records, etc., it can capture signs of attacks from different levels such as network layer, host layer, and application layer, avoiding the one-sidedness of a single data source; through the spatiotemporal feature graph generated by Z-Score normalization, one-hot encoding and wavelet transform, the network topology structure and dynamic traffic characteristics are combined, which not only retains the node connection relationship and data distribution in the spatial dimension, but also incorporates the sequence change law in the time dimension, providing subsequent models with a high-dimensional feature representation that combines global vision and temporal dynamics, which can effectively improve the representation ability of network features.

[0075] The dual-model collaborative detection and layered defense mechanism achieves comprehensive coverage and intelligent response to both known and unknown attacks. The first model, combining CNN, LSTM, and cross-layer attention modules, accurately extracts the spatiotemporal characteristic patterns of attacks and classifies and identifies known attack types. The second model, leveraging adversarial training with autoencoders and InfoGAN, uses normal traffic characteristics as a baseline and analyzes reconstruction errors to identify unknown attacks that deviate from normal patterns. The two models are combined through a weighted voting mechanism to output a comprehensive risk value, significantly improving detection accuracy and robustness. Defense strategies are implemented in layers based on risk levels, ranging from routing optimization based on the K-path algorithm to dynamic defense driven by reinforcement learning. This achieves adaptive responses from traffic diversion to proactive countermeasures. In particular, the reinforcement learning model, by integrating multidimensional state spaces such as network topology, service characteristics, and traffic status, combined with diverse action spaces such as IP hopping and port randomization, can balance network latency while reducing attack probability. This creates an intelligent defense system that is both efficient and adaptive, enhancing the real-time and proactive nature of network security protection.

[0076] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution or beneficial effect is included in at least one embodiment. Therefore, the description of a technical feature, technical solution or beneficial effect in this specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and beneficial effects described in the present embodiment can also be combined in any appropriate manner. Those skilled in the art will understand that the embodiment can be implemented without one or more specific technical features, technical solutions or beneficial effects of a specific embodiment. In other embodiments, additional technical features and beneficial effects can also be identified in specific embodiments that do not embody all embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0078] Figure 1 A system architecture diagram of a deep learning-based network intrusion intelligent monitoring system provided in an embodiment of the present application;

[0079] Figure 2 A flowchart of a deep learning-based intelligent network intrusion monitoring method provided in an embodiment of the present application;

[0080] Figure 3 A flowchart of another deep learning-based intelligent network intrusion monitoring method provided in an embodiment of the present application;

[0081] Figure 4 A flowchart of another deep learning-based intelligent network intrusion monitoring method provided in an embodiment of the present application;

[0082] Figure 5 A schematic diagram of the structure of a deep learning-based intelligent network intrusion monitoring device provided in an embodiment of the present application;

[0083] Figure 6 Schematic diagram of the hardware structure of the deep learning-based network intrusion intelligent monitoring device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0084] In the description of this application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "a plurality" means two or more. Words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not limit them to be necessarily different.

[0085] It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0086] The network intrusion intelligent monitoring method based on deep learning provided by the embodiment of the present application can be applied to Figure 1 In the network intrusion intelligent monitoring system based on deep learning, as shown in Figure 1 As shown, the communication system includes: a feature construction module, an anomaly detection module and a strategy generation module; wherein,

[0087] The feature construction module is used to preprocess the collected multi-source data to generate spatiotemporal feature maps; the multi-source data includes switch port data, flow table matching statistics, process creation records, file access logs, API call parameters, and HTTP request features;

[0088] The spatiotemporal feature graph is used to characterize the distribution characteristics of multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment;

[0089] An anomaly detection module, configured to input the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection and obtain detection results; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns;

[0090] The strategy generation module is used to classify the detection results into hierarchical risk levels and perform active defense based on the defense strategy for each risk level.

[0091] To address technical issues in existing network intrusion detection technologies, such as insufficient unknown attack recognition capabilities and delayed defense responses, the present invention provides a method and system for intelligent network intrusion monitoring based on deep learning. The method includes:

[0092] S1, collect multi-source data;

[0093] S2, preprocessing the multi-source data to generate a spatiotemporal feature map; the spatiotemporal feature map is used to characterize the distribution characteristics of multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment;

[0094] S3: Input the spatiotemporal feature graph into a first model and a second model built based on a deep learning algorithm to perform anomaly detection and obtain detection results; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns;

[0095] S4, classify the detection results into tiered risk levels and perform active defense based on the defense strategy for each risk level.

[0096] Based on this, this application realizes all-round situational awareness from the network layer to the application layer through multi-source data collection, uses spatiotemporal feature maps to convert heterogeneous data into high-dimensional feature representations that combine spatial topology and temporal dynamics, and uses dual-model collaborative detection to cover known and unknown attack scenarios. Ultimately, through a layered defense strategy, it realizes automated protection from risk identification to active response, which can effectively improve the accuracy, comprehensiveness and real-time performance of network security monitoring, and solves the problems of insufficient unknown attack identification capabilities and delayed defense response in existing technologies.

[0097] like Figure 2 As shown, the network intrusion intelligent monitoring method based on deep learning provided by the embodiment of the present application includes:

[0098] S1. Collect multi-source data.

[0099] Among them, multi-source data is used to capture attack signs from different levels such as the network layer, host layer and application layer, providing comprehensive and multi-dimensional data support for subsequent spatiotemporal feature map generation and anomaly detection, including switch port data, flow table matching statistics, process creation records, file access logs, API call parameters and HTTP request characteristics.

[0100] In some implementations, data from different sources can be obtained by deploying the following components:

[0101] Integrate a Simple Network Management Protocol (SNMP) agent or NetFlow plug-in into the switch device to collect real-time traffic data such as port byte count and packet count.

[0102] Obtain flow table matching statistics through the northbound interface of the Software Defined Network (SDN) controller, including network connection information such as source IP and destination port;

[0103] Install a system call monitoring module in the host system to capture process creation records and file access logs;

[0104] Deploy API gateway and Web log parsing components at the application service layer to collect API call parameters and HTTP request characteristics.

[0105] It is important to note that data from different sources needs to be formatted and timestamps aligned. By standardizing the data format using a unified data collection protocol (such as Protobuf) and using the Network Time Protocol (NTP) clock synchronization mechanism to ensure temporal consistency across multiple sources, we can avoid detection bias caused by data heterogeneity.

[0106] S2. Preprocess multi-source data to generate spatiotemporal feature maps.

[0107] Among them, the spatiotemporal feature map is used to characterize the distribution characteristics of multi-source data in the spatial topological structure in the network environment and the dynamic change rules in the time series.

[0108] In some implementations, existing data preprocessing techniques and feature engineering methods can be used to convert raw data into feature representations suitable for deep learning models. Specifically, they include:

[0109] Data standardization: For numerical data, Min-Max standardization or Z-Score standardization is used to eliminate dimensional differences. For categorical data, one-hot encoding or label encoding is used.

[0110] Spatiotemporal feature fusion: A spatial feature matrix can be constructed based on the network topology (such as the node connection relationship obtained through OSPF and BGP routing protocols). The time series data can be sliced ​​using sliding window technology, and dynamic features can be extracted by combining time series analysis methods such as Fourier transform or wavelet transform. Finally, a spatiotemporal feature map can be generated through tensor splicing or convolution operations.

[0111] For example, the feature engineering process can be standardized with the help of open source tools such as Scikit-learn, and feature fusion can be completed using tensor operations in the TensorFlow or PyTorch framework. For large-scale data scenarios, SparkMLlib can be used for distributed feature calculations.

[0112] S3. Input the spatiotemporal feature map into the first model and the second model constructed based on the deep learning algorithm to perform anomaly detection and obtain detection results.

[0113] The first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns.

[0114] In some implementations, a dual-model architecture of supervised learning and unsupervised learning is often used to achieve collaborative detection of known and unknown attacks. Specifically, it can be:

[0115] The first model uses a combined architecture of CNN (convolutional neural network) and RNN (recurrent neural network). For example, CNN extracts spatial features (such as abnormal connection patterns in network topology), while LSTM or GRU captures temporal dependencies (such as sudden changes in traffic over time). The fully connected layer outputs attack probabilities and type labels, and the training data is based on a historical attack sample library (such as the NVD vulnerability library and the MITRE ATT&CK framework).

[0116] The second model: Based on the autoencoder, a normal behavior baseline model is constructed. The encoder compresses features and the decoder reconstructs data, and the reconstruction error is used to identify abnormal traffic that deviates from the normal pattern. Combined with GAN (generative adversarial network) to enhance anomaly detection capabilities, the generator simulates potential attack patterns, and the discriminator distinguishes normal features from abnormal features, improving the ability to recognize unknown attack patterns.

[0117] It should be noted that the model training adopts a transfer learning strategy, and the pre-trained model can be based on public datasets such as ImageNet; the optimization algorithm adopts common gradient descent methods such as Adam and SGD, and then prevents overfitting through early stopping (EarlyStopping) and regularization (L1 / L2).

[0118] S4. Divide the detection results into tiered risk levels and implement active defense based on the defense strategy for each risk level.

[0119] The purpose of risk level classification is to map the detection results of the first model and the second model into a unified risk assessment system and quantify the degree of risk.

[0120] In some implementations, the risk level is divided into low, medium, and high levels based on the overall risk value, and a graded response is implemented using existing network security defense measures. For example:

[0121] Low risk level: Flow table rules can be issued through the SDN controller, using equal-cost multi-path (ECMP) routing technology to divert abnormal traffic, or triggering the firewall's access control list (ACL) for refined traffic filtering;

[0122] Medium risk level: The attack source tracing mechanism can be activated to track the traffic trajectory of the attack source IP through NetFlow logs, while the detection frequency can be increased (for example, the sampling period can be shortened from 5 minutes to 1 minute), and the SIEM (Security Information and Event Management) system can be used for log correlation analysis.

[0123] High risk level: Attack traffic can be redirected to a cleaning center (e.g., deploying BGP route hijacking technology) or a honeypot system (e.g., using Docker containers to build virtual service nodes);

[0124] Or it can be linked with other security devices (such as WAF, IPS) to issue blocking instructions through the OpenAPI interface to achieve real-time interception of attacks.

[0125] It's important to note that the threshold settings for different risk levels can be dynamically optimized based on historical attack data. For example, by statistically analyzing the characteristic distribution of normal and attack traffic, a cross-validation method can be used to determine the threshold boundaries for each risk level to meet the security needs of different network environments.

[0126] Based on the above technical solution, the deep learning-based intelligent network intrusion monitoring method provided by this application realizes all-round situational awareness from the network layer to the application layer through multi-source data collection, and uses spatiotemporal feature maps to convert heterogeneous data into high-dimensional feature representations that have both spatial topology and temporal dynamics. With the help of dual-model collaborative detection, known and unknown attack scenarios are covered, and finally, through a layered defense strategy, automated protection from risk identification to active response is achieved, thereby improving the accuracy, comprehensiveness and real-time performance of network security monitoring.

[0127] In a possible implementation of the embodiment of the present application, the above S1 can be specifically implemented by the following S101, S102 and S103, which are specifically described below:

[0128] S101. Collect traffic data and connection relationship data of the network layer.

[0129] The network layer collects switch port data and flow table matching statistics, which are used to represent the real-time status of the network transport layer. Specifically, it includes:

[0130] Switch port data includes switch port byte count, packet count, and duration;

[0131] Flow table entry matching statistics include source IP, destination IP, source port, destination port, protocol type, and flow duration.

[0132] In some implementations, network layer data can be collected using the following components and protocols:

[0133] Use the switch's built-in SNMP agent or NetFlow plug-in to periodically poll and obtain statistical data such as port byte count, packet count, and duration. The sampling period can be set to 10 seconds to 1 minute.

[0134] Pull flow table matching data in real time through the northbound interface (REST API) of the SDN controller (such as OpenDaylight), including source IP, destination IP, port number, protocol type and flow duration, and support triggered collection based on flow timeout mechanism.

[0135] It is important to note that traffic mirroring and protocol parsing are required for collected data. For example, traffic can be copied to the monitoring port using SPAN (Switch Port Analyzer) or Encapsulated Remote Port Mirroring (ERSPAN) technology, and the libpcap library can be used to parse packet header fields to ensure the integrity and timing accuracy of flow table matching data.

[0136] For example, when it is detected that the number of bytes on the switch port suddenly increases by more than a threshold (such as 3 times the baseline value) within 5 minutes, high-frequency collection of flow table data is automatically triggered (the sampling period is shortened to 5 seconds) for source tracing analysis of DDoS attacks.

[0137] S102: Collect system process data and file operation data at the host layer.

[0138] The host layer collects process creation records and file access logs, which are used to identify abnormal behavior patterns at the host layer. Specifically, the following are collected:

[0139] The process creation record includes process ID, parent process ID, process creation time, and process execution path;

[0140] File access logs include file access path, access user, and file operation type.

[0141] In some implementations, host-level data collection can be achieved through the following system interfaces and tools:

[0142] In Linux systems, use dynamic tracing tools such as SystemTap or LTTng (Linux Trace Toolkit next generation) to monitor process creation events, capture process ID, parent process ID, creation time, and execution path, and support recursive collection based on the process tree structure.

[0143] File system hooks (such as Linux's inotify or Windows's Change Journal) monitor file access behavior in real time, record access paths, user identities, and operation types (read / write / delete), and store them in rolling log files.

[0144] It's important to note that data collection requires security auditing and permission control. For example, access control mechanisms such as SELinux (Security-Enhanced Linux) or AppLocker can be used to restrict the permissions of collection components to prevent the leakage of sensitive file information. At the same time, hash verification of process execution paths can prevent malicious programs from tampering with records.

[0145] For example, when a suspicious execution path such as " / tmp / .random" is detected in a process creation record, the full collection of the access log of the corresponding file is automatically triggered for early warning of ransomware.

[0146] S103: Collect interaction data and HTTP request data at the application layer.

[0147] The collection objects of the application layer are API call parameters and HTTP request characteristics, which are used to analyze protocol anomalies and attack payloads at the application layer. Specifically, they include:

[0148] API call parameters include API call path, API request parameters, and API response time;

[0149] HTTP request characteristics include URL parameters, User-Agent, and request header fields.

[0150] In some implementations, application layer data can be collected through the following middleware and proxy components:

[0151] Implant a plug-in in the API gateway to intercept API call requests, extract the call path, request parameters, and response time, and store binary parameters (such as file uploads) in Base64 encoding.

[0152] Deploy a reverse proxy in front of the web server to parse the URL parameters, User-Agent field and request header in the HTTP request, and support structured parsing of JSON / XML format request bodies.

[0153] It should be noted that if the collected data contains sensitive information, it needs to be desensitized. For example, sensitive fields such as credit card numbers and passwords in the request parameters are filtered using regular expressions and replaced with the "***" placeholder. The User-Agent field is also standardized (for example, by unifying the browser kernel version representation) to reduce feature noise.

[0154] For example, when SQL injection keywords such as "union select" are detected in HTTP request features, the complete API call parameter chain is automatically captured, including the context data of the five related calls before and after, for attack chain analysis.

[0155] It should be noted that the collection of multi-source data can be done periodically or in a triggered manner. And when the data of a certain layer is triggered for collection, it is necessary to synchronously send data collection instructions for other layers to achieve temporal consistency association of cross-layer data and multi-dimensional feature linkage collection. Specifically, by deploying a unified event bus (such as a message queue based on Apache Kafka) or a central control module, when the network layer triggers high-frequency collection due to a sudden increase in traffic (such as the number of bytes on the switch port in S101 exceeds the threshold), the event bus will send synchronization instructions to the collection components of the host layer (S102) and the application layer (S103) in real time, carrying the timestamp and feature identifier of the triggering event.

[0156] After receiving the instruction, the collection components at each layer will immediately start the incremental collection of the corresponding data, and embed the globally unique association ID (such as UUID) and trigger timestamp in the data record to ensure that the flow table matching data of the network layer, the process creation record of the host layer, and the API call parameters of the application layer can be aligned across layers through the timeline and association ID.

[0157] Based on the above technical solution, through the hierarchical deployment of collection components and trigger mechanisms, real-time capture of multi-source data from the network layer to the application layer is achieved. This not only ensures the periodic sampling efficiency of regular traffic, but also dynamically adjusts the collection frequency and range when abnormal events occur, providing high-dimensional, time-consistent raw data support for subsequent spatiotemporal feature generation.

[0158] In a possible implementation of the embodiment of the present application, combined with Figure 2 ,like Figure 3 As shown, the above S2 can be specifically implemented through the following S201, S202 and S203, which are specifically described below:

[0159] S201. Standardize and encode multi-source data.

[0160] Data preprocessing is used to eliminate the dimensional differences of heterogeneous data and generate standardized feature vectors suitable for model input.

[0161] In some implementations, the following process flow may be used:

[0162] Z-Score normalization is performed on numerical data (such as switch port byte count and flow duration) using the following formula: Where μ is the data mean and σ is the data standard deviation;

[0163] One-hot encoding is performed on categorical data (such as protocol type and file operation type). For example, TCP is encoded as [1, 0, 0] and UDP is encoded as [0, 1, 0].

[0164] Convert time series data (such as process creation time) into timestamp differences and normalize them to the [0,1] range.

[0165] It's important to note that the parameters in the Z-Score normalization formula are determined by using the mean and standard deviation of the top 10% of samples as global normalization parameters. These parameters are then applied to subsequent real-time data to ensure consistency. The dimension of the one-hot encoding can be determined based on the number of corresponding data types in the multi-source data. For example, if file operation types include "read / write / execute," the encoding dimension is 3.

[0166] For example, when processing the number of bytes in a switch port, if the mean of the first 10% of the samples is 10 6 Bytes, with a standard deviation of 2×10 5 , then the 1.5×10 6 The byte is normalized to z = (1.5 × 10 6 -10 6 ) / (2×10 5 ), indicating that the value deviates from the mean by 2.5 standard deviations.

[0167] S202: Construct a multi-channel spatial feature map.

[0168] Based on the SDN network topology, physical nodes are mapped into two-dimensional grid coordinates, and a spatial matrix containing characteristics of different protocol layers is constructed by combining multi-source data.

[0169] In some implementations, the specific steps of constructing the spatial matrix include:

[0170] 1. Topology mapping: Obtain the network node connection relationship from the SDN controller and map each physical node (such as a switch or host) as a coordinate point in a two-dimensional grid. The link weight between nodes is determined by bandwidth or latency.

[0171] 2. Channel division: Construct 5 independent channels according to data type:

[0172] Network traffic feature channel: fill in the switch port data;

[0173] Network connection relationship channel: fill in the flow table matching data (source IP, destination IP, etc.);

[0174] Host process behavior channel: fill in the process creation record;

[0175] File access control channel: fill in file access log;

[0176] Application layer interaction channel: fill in API call parameters and HTTP request characteristics;

[0177] 3. Feature filling: Fill the standardized feature vector into the matrix position of the corresponding channel according to the node coordinates, and fill the missing values ​​with 0.

[0178] It should be noted that the mapping rule for grid coordinates is as follows: the Floyd-Warshall algorithm is used to calculate the shortest path between nodes. Nodes are arranged into an N×N grid (N is the number of nodes) based on the shortest distance, with a spacing of 1 between adjacent grid cells. The channel dimension of the spatiotemporal feature map is determined by the number of nodes and the feature dimension. The feature dimension of each grid cell is 5 (each dimension corresponds to a channel). For example, a network of 100 nodes can be mapped into a 10×10 grid, with the feature dimension of each node position being the number of features in that channel.

[0179] For example, in a network containing 3 switches (A1, A2, A3) and 2 hosts (B1, B2), A1 is mapped to (0,0) and B1 is mapped to (2,1). Then, the connection from A1 to B1 in the flow table entry will be filled with source / destination IP and other features at the (0,0) and (2,1) positions of the network connection relationship channel.

[0180] S203: Fusing temporal features and spatial features to obtain a spatiotemporal feature map.

[0181] The temporal features are extracted by sliding window slicing and wavelet transform, and then fused with the spatial feature map to generate the final spatiotemporal feature map.

[0182] Specifically, the following steps may be included:

[0183] 1. Sliding window slicing: Set the window size T (e.g., 10 minutes) and step size t (e.g., 1 minute) to slice the multi-source data along the time axis to obtain sliced ​​data for multiple time windows;

[0184] 2. Wavelet transform coding: The time series data of each slice is decomposed into three layers using the Daubechies-4 (db4) wavelet basis to extract approximate coefficients (low-frequency features) and detail coefficients (high-frequency features);

[0185] 3. Spatiotemporal fusion: The time series features after wavelet transformation are used as new channels and spliced ​​with the multi-channel spatial feature map in the depth dimension to generate a three-dimensional spatiotemporal feature map (width × height × number of channels).

[0186] It should be noted that all multi-source data contains timestamps to ensure temporal consistency of data from different sources. Specifically, network layer data such as switch port data and flow table matching statistics are timestamped by the hardware clock of the network device; process creation records and file access logs of the host system are timestamped by the time service of the operating system kernel; and API call parameters and HTTP request features of the application layer are timestamped by the system time of the application server. All timestamps are synchronized based on NTP (Network Time Protocol) to achieve time axis alignment of cross-layer data in the subsequent preprocessing process, ensuring that the spatiotemporal feature map can accurately reflect the dynamic changes in network behavior in the time dimension.

[0187] It should be noted that the methods for determining the preset parameters include:

[0188] The window size T is determined based on the statistical median of historical attack durations (e.g., if the average DDoS attack lasts 8 minutes, then T = 10 minutes);

[0189] The number of wavelet decomposition layers is determined by cross-validation: the reconstruction errors of 1-5 layers of decomposition are tested on the first 10% of samples, and the 3 layers with the smallest errors are selected;

[0190] The number of channels is the number of spatial channels (5) plus the number of temporal channels (the number of coefficient layers after wavelet decomposition, such as 3-layer decomposition generates 4 channels), and the total number of channels is 9.

[0191] For example, a three-layer DB4 wavelet decomposition is performed on the switch port byte number sequence within a certain time window to obtain the approximate coefficient a3 and detail coefficients d1-d3, which correspond to the traffic change characteristics at different time scales respectively. After being fused with the spatial feature map, a spatiotemporal feature map containing time series dynamics is formed, which can be used to identify the time point and spatial location of traffic surges.

[0192] Based on the above technical solution, through standardized coding, multi-channel spatial mapping and time series feature fusion, multi-source heterogeneous data are converted into three-dimensional feature maps with both spatial topological relationships and temporal dynamic laws, providing high-dimensional and strong representation capability input for the subsequent first and second models, which can improve the accuracy and generalization ability of network intrusion detection.

[0193] In a possible implementation of the embodiment of the present application, combined with Figure 2 ,like Figure 4 As shown, the above S3 can be specifically implemented through the following S301, S302 and S303, which are specifically described below:

[0194] S301: Detect a known attack pattern using a first model.

[0195] Among them, the first model adopts the CNN-LSTM-attention fusion architecture to jointly extract the spatial topology and temporal dynamic features of the spatiotemporal feature graph, and output the attack probability and type label.

[0196] In some implementations, the model structure and calculation process can be as follows:

[0197] 1. Spatial feature extraction: Spatial features are extracted through three convolutional layers (convolution kernel size is 3×3, stride size is 1) and two maximum pooling layers (pooling window is 2×2), and the activation function is ReLU;

[0198] 2. Temporal feature extraction: The spatial features are flattened and then input into a two-layer LSTM network (hidden layer dimension 128) to capture time series dependencies;

[0199] 3. Cross-layer attention fusion: The weight matrix of spatial features and temporal features is calculated through the dot product attention mechanism. The formula is: Among them, Q is the time series feature vector, K and V are the spatial feature matrices, d k is the key vector dimension (set to 64);

[0200] 4. Classification output: The weighted fused features are passed through a fully connected layer and a softmax function to output the probability distribution of various attack types and the type label with the highest probability. Type labels include but are not limited to distributed denial of service attacks (DDoS), SQL injection attacks, ransomware attacks, port scan attacks, brute force attacks, cross-site scripting attacks (XSS), and command injection attacks.

[0201] S302: Detect unknown attack patterns using a second model.

[0202] Among them, the second model is based on the adversarial training architecture of autoencoders and Information Maximizing Generative Adversarial Nets (InfoGAN). It identifies unknown attacks that deviate from normal patterns through the reconstruction error of normal traffic features and outputs anomaly scores.

[0203] In some implementations, the model process and parameter settings may be as follows:

[0204] 1. Autoencoder structure:

[0205] Encoder: including but not limited to 2 fully connected layers (512 and 256 neurons), using LeakyReLU activation function;

[0206] Decoder: includes but is not limited to 2 fully connected layers (number of neurons: 256 and 512), using Sigmoid activation function;

[0207] The reconstruction error is calculated using the mean square error (MSE), and the objective function is: Among them, x i represents the original feature vector of the input sample, represents the reconstructed feature vector output by the decoder, and N is the total number of training samples;

[0208] 2.InfoGAN adversarial network structure:

[0209] Generator: The input is a multidimensional noise vector, and a feature vector G(z) with the same dimension as the autoencoder encoding result is generated through three layers of transposed convolution;

[0210] Discriminator: uses a 3-layer convolutional network (convolution kernel size 4×4, stride 2), takes as input the real feature x or the generated feature G(z), and outputs the probability of the real feature or the generated feature;

[0211] The joint loss function for constructing InfoGAN is: Where D(·) represents the discriminator output probability; They represent the expected values ​​of the true data distribution and the generator input distribution respectively.

[0212] 3. Anomaly score calculation:

[0213] Calculate the reconstruction error of normal traffic passing through the autoencoder to obtain the error baseline of normal traffic. The error baseline can be set as the sum of the mean and three standard deviations of the reconstruction error obtained by the model on the training set of normal traffic data (i.e., multi-source data state when no network intrusion occurs).

[0214] The reconstruction error of the data to be detected is calculated according to the objective function, and the reconstruction error is compared with the error baseline to obtain the anomaly score.

[0215] For example, if the reconstruction error of an unknown attack sample is 0.12 and the normal traffic baseline is 0.04, the anomaly score is 3.0, indicating that the sample deviates significantly from the normal pattern and is a high-risk anomaly.

[0216] S303: Output result of weighted fusion dual model.

[0217] The attack probability of the first model is combined with the anomaly score of the second model through a weighted voting mechanism to generate a comprehensive risk value as the final detection result.

[0218] In some implementations, the weighted fusion process may be as follows:

[0219] First, the anomaly score S is normalized, and the formula is: Among them, S min and S max are the minimum and maximum values ​​of anomaly scores in historical training data, respectively;

[0220] A weighted summation is then performed, using the formula: Comprehensive Risk Value (R) = α × P + β × S', where α + β = 1 represents the weighting coefficient, which can be determined based on experimental experience. For example, testing on the validation set found that when α = 0.6 and β = 0.4, the Comprehensive Risk Value achieved the highest F1 score for detecting both known and unknown attacks, so this weighting combination was selected.

[0221] It should be noted that the training set, validation set and test set are used in the training phase of the first model and the second model. When the detection performance (such as F1 value) on the validation set no longer improves for multiple consecutive rounds or reaches a preset threshold (such as F1 ≥ 0.95), the weight parameters of the optimal round can be saved, serialized and deployed in the processing unit of the network intrusion intelligent monitoring device, and applied to intrusion monitoring in actual network conditions.

[0222] Furthermore, during model training, supervised training of the first model relies on known attack labels. However, unknown attacks discovered by the second model can be labeled and added to the first model's training set as new categories, gradually enabling the first model to classify emerging attacks. For example, labeled unknown attack samples can be added to the original training set in a ratio of 7:2:1, allowing incremental training of the first model and updating the parameters of its fully connected layers to adapt to new attack types.

[0223] Based on this technical solution, the first model accurately classifies known attacks, while the second model detects anomalies in unknown attacks, combined with a weighted fusion mechanism, achieves comprehensive detection of network intrusions. This dual-model architecture leverages the strengths of both supervised and unsupervised learning, improving the accuracy and robustness of detection results and providing a scientific risk assessment basis for subsequent layered defense strategies.

[0224] In a possible implementation of the embodiment of the present application, the above S4 specifically includes the following S401 to S403:

[0225] S401. Classify risk levels based on the comprehensive risk value.

[0226] The attack probability output by the first model and the anomaly score output by the second model are weighted and fused to obtain the comprehensive risk value R, which is then divided into three risk levels: low, medium, and high based on the preset threshold.

[0227] In some implementations, when R < a first threshold T1, the risk level is marked as low;

[0228] When the first threshold T1≤R<the second threshold T2, the risk level is marked as medium;

[0229] When R≥the second threshold T2, the risk level is marked as high.

[0230] The first threshold, T1, = 0.4, and the second threshold, T2, = 0.7, correspond to the boundaries between low and medium risk, and between medium and high risk, respectively. These can be obtained by statistically analyzing the risk value distribution of historical training data. For example, the mean of the comprehensive risk value of historical normal traffic plus one standard deviation can be set as T1, and the median of the comprehensive risk value can be set as T2.

[0231] It should be noted that thresholds need to be regularly updated based on the latest network traffic characteristics. For example, the mean and standard deviation should be recalculated based on 10GB of newly collected data every quarter to ensure the accuracy of risk level classification.

[0232] S402. Execute defense strategies for low / medium risk levels.

[0233] Executes preset static defense strategies for low / medium risk levels, including route optimization and increased detection frequency.

[0234] In some implementations, when the comprehensive risk value R < T1, the system calculates the optimal routing path based on the K-path algorithm, where K = 3. This value is determined by the network topology complexity and is usually taken as the number of shortest paths plus 1. The optimization objective is to minimize the weight ratio of link delay to maximize bandwidth utilization at 1:1. And the traffic direction is guided by the OpenFlow flow table rules: using the flow table rules generated by the SDN controller, the traffic is split into K load-balanced paths to ensure that abnormal traffic is diverted to the standby link while maintaining normal business transmission on the main link.

[0235] If the risk value is in the medium risk level of T1 ≤ R < T2, record the attack type and the corresponding multi-source data, store it in the attack feature library, and at the same time increase the detection frequency of anomaly detection. For example, increase the anomaly detection frequency from 1 time per 5 minutes to 1 time per 1 minute. Then, according to the attack type (i.e., the type label), call the temporary firewall access control list (ACL) rules to limit the traffic speed or temporarily block the source IP or the destination port.

[0236] It should be noted that the temporary firewall ACL rules are pre-set rule templates, as shown in Table 1 specifically:

[0237] Table 1, Temporary Firewall ACL Rule Template Table

[0238]

[0239] It should be pointed out that in the temporary firewall ACL rule template table, the matching condition templates for different actions are the attack types in the detection results of the dual model. When the risk level in the detection result is high and the corresponding attack type is given, the corresponding action is called.

[0240] S403. Generate dynamic policies for high risk levels through reinforcement learning.

[0241] In this application, by defining the state space, action space, and reward function, a reinforcement learning framework is obtained. Then, the proximal policy optimization (PPO) algorithm is used to perform iterative learning and verification on the reinforcement learning to generate dynamic defense policies.

[0242] Specifically, the state space is composed of multi-dimensional data, including:

[0243] Network topology features: including the node connection relationship and link bandwidth obtained based on the SDN controller. Among them, the node connection relationship is presented in the form of an adjacency matrix, recording the connection status of each node in the network; the link bandwidth records the currently available bandwidth resources of each link;

[0244] Service characteristics: including the binary encoding vector of the open port set and the running service version of each port; the open port set records all open port numbers and corresponding service types in the current network; the service version information records the specific version of the running service, which facilitates the identification of services that may have vulnerabilities;

[0245] Traffic characteristics: including abnormal traffic proportion and protocol distribution; the abnormal traffic proportion is calculated by calculating the proportion of abnormal traffic in the total traffic; the protocol distribution statistics show the traffic proportion of different protocols (such as TCP, UDP, etc.) in the current network;

[0246] Historical defense strategy execution effect: The blocking success rate calculates the ratio of the number of successful blocking times of the last N defense strategies to the total number of attacks; the delay increase records the change in network delay after the defense strategy is executed.

[0247] These data together constitute the state vector, which comprehensively describes the current state of the network.

[0248] The action space contains the following defensive actions:

[0249] IP hopping: Using Network Address Translation (NAT) technology, randomly selects an IP address from a preset IP address pool and dynamically modifies the IP address of the exposed service to confuse attackers.

[0250] Port randomization: Adjust the service listening port from the current port to any port in the preset candidate port set, making it more difficult for attackers to scan the port;

[0251] Traffic redirection: Based on abnormal traffic characteristics, abnormal traffic is directed to a cleaning center for malicious traffic cleaning, or to a honeypot system to trap attackers. Abnormal traffic can be obtained through the sliding window method. For example, based on the sliding window method, the mean μ and standard deviation σ of the traffic rate in the last 5 minutes are calculated. When the traffic rate exceeds μ+2σ, it is determined to be a traffic anomaly. The DBSCAN density clustering algorithm is then used to identify a large number of newly created asymmetric connections (the ratio of source IP to destination IP connections is greater than 10) in a short period of time (e.g., 10 seconds). Such connections are counted as abnormal connections. Finally, combined with protocol anomaly characteristics (e.g., UDP packets account for more than 80% and the destination ports are randomly distributed), the abnormal traffic range is comprehensively determined based on the number of abnormal connections and abnormal traffic.

[0252] Service degradation: Identify non-critical functional modules in the network and shut them down to reduce the attack surface and ensure the safe operation of core services.

[0253] The expression defining the reward function r is:

[0254] r=λ1ΔF-λ2ΔD norm-λ3C; where λ1, λ2, and λ3 represent weight coefficients, and ΔF represents the change in flow abnormality. The calculation formula is: ΔF = F before -F after ; F before Indicates the traffic anomaly before executing the defense strategy, P after It represents the degree of traffic anomaly after executing the defense strategy, and the calculation formula of traffic anomaly is: F = w1F rate +w2F conn ; w1, w2 represent feature weights, which are determined by training with historical attack data; F rate Indicates the flow rate deviation, which is calculated by the percentage of deviation between the current flow rate and the historical normal flow mean; F conn Indicates the connection abnormality rate, which is obtained by the ratio of abnormal connections to the total number of connections. The number of abnormal connections can be determined by identifying a large number of new connections in a short period of time.

[0255] ΔD norm Indicates the normalized network delay increment, the formula is: ΔD norm =(ΔD-min(D)) / (max(D)-min(D)); min(D) and max(D) represent the minimum and maximum network delay increments of the first 10% of samples, respectively;

[0256] C represents the execution cost of the defense strategy, which is determined by setting preset cost values ​​for different strategies. For example, the cost of IP hopping is C=1, the cost of redirecting traffic to the scrubbing center is C=3, and the cost of temporary service degradation is C=5.

[0257] Then use the Actor-Critic framework to optimize the algorithm:

[0258] Critic network: evaluates the current state and outputs the state value to guide the actor network to generate a better strategy;

[0259] Actor network: Generates action probability distribution based on state information and selects specific defense actions;

[0260] Clipped objective function: limits the range of policy updates to prevent destructive effects on the network caused by policy mutations;

[0261] Strategy iteration: Batch sampling of the most recent M (e.g., 100) interaction data updates network parameters to improve learning efficiency and stability;

[0262] Finally, based on the action probability distribution output by the updated Actor network, the action with the highest probability in the action probability distribution is selected as the dynamic defense strategy.

[0263] Based on this technical solution, a hierarchical risk classification and differentiated defense strategies enable adaptive responses from routine attacks to high-risk threats. Static strategies for low and medium risk levels ensure defensive efficiency, while dynamic reinforcement learning strategies for high-risk scenarios utilize multidimensional state space modeling and reward function optimization to generate both aggressive and fault-tolerant defensive actions. This approach blocks attacks while keeping network performance loss within acceptable limits, forming an automated, intelligent closed-loop network security protection loop.

[0264] The above mainly introduces the scheme of the embodiment of the present application from the perspective of device implementation. It can be understood that each device, for example, a network intrusion intelligent monitoring device based on deep learning, includes at least one of the hardware structure and software modules corresponding to the execution of each function in order to realize the above functions. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0265] The embodiment of the present application can divide the functional units of the network intrusion intelligent monitoring device based on deep learning according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0266] In the case of an integrated unit, Figure 5 A possible structural diagram of the deep learning-based network intrusion intelligent monitoring device involved in the above embodiment (referred to as the deep learning-based network intrusion intelligent monitoring device 50) is shown. The deep learning-based network intrusion intelligent monitoring device 50 includes a processing unit 501 and a communication unit 502, and may also include a storage unit 503. Figure 5 The structural diagram shown can be used to illustrate the structure of the deep learning-based network intrusion intelligent monitoring device involved in the above embodiments.

[0267] when Figure 5The structural schematic diagram shown is used to illustrate the structure of the network intrusion intelligent monitoring device based on deep learning involved in the above-mentioned embodiment. The processing unit 501 is used to control and manage the actions of the network intrusion intelligent monitoring device based on deep learning, the communication unit 502 is used for the network intrusion intelligent monitoring device based on deep learning to communicate with other devices, and the storage unit 503 is used to store the program code and data of the network intrusion intelligent monitoring device based on deep learning.

[0268] For example, the communication unit 502 is used to collect statistical data such as the number of bytes, number of packets, and duration of the switch port from the switch, obtain the network topology map and the node connection relationship adjacency matrix through the SDN controller, collect flow table item matching statistics such as source IP, destination IP, port, protocol type, etc. from the flow table management device, collect process creation records and file access logs from the host system, obtain API call parameters and HTTP request characteristics from the application service system, and transmit the defense policy instructions (such as OpenFlow flow table rules) generated by the processing unit to the firewall device.

[0269] Processing unit 501 is used to perform Z-Score standardization and one-hot encoding on multi-source data to generate a standardized feature vector; map physical nodes to two-dimensional grid coordinates based on the SDN topology map to construct a multi-channel spatial feature map; use sliding windows and wavelet transform to generate a spatiotemporal feature map; run a first model to detect known attack patterns and a second model to detect unknown attack patterns; and generate an active defense strategy based on the comprehensive risk value, such as calculating the optimal route based on the K-path algorithm, calling temporary firewall rules, or triggering a reinforcement learning model to generate a dynamic defense strategy.

[0270] In one possible implementation, the processing unit 501 is also used to define the state space (including network topology, service characteristics, traffic characteristics and historical policy effects) and action space (including defense actions such as IP hopping, port randomization, and traffic redirection) of the reinforcement learning model, design a reward function based on the reduction in anomaly probability and the increase in network delay, and use the PPO algorithm to optimize the reinforcement learning model parameters, and output the action probability distribution to select the optimal defense action.

[0271] In one possible implementation, the communication unit 502 is also used to receive attack trapping data fed back by the honeypot system and transmit it to the processing unit. The processing unit 501 is also used to update the reward function weight of the reinforcement learning model based on the honeypot data, and dynamically adjust the adaptability of the defense strategy to new attacks. At the same time, the communication unit 502 can interact with the SDN controller to issue flow table update commands corresponding to dynamic defense strategies such as traffic redirection and IP hopping in real time, and the processing unit 501 is responsible for triggering strategy iterative updates according to changes in network status.

[0272] Among them, the processing unit 501 can be a processor or a controller, and the communication unit 502 can be a communication interface, a transceiver, a transceiver, a transceiver circuit, a transceiver device, etc. Among them, the communication interface is a general term and can include one or more interfaces. The storage unit 503 can be a memory. When the network intrusion intelligent monitoring device 50 based on deep learning is a chip, the processing unit 501 can be a processor or a controller, and the communication unit 502 can be an input interface and / or output interface, a pin or a circuit, etc. The storage unit 503 can be a storage unit within the chip (for example, a register, a cache, etc.), or it can be a storage unit located outside the chip (for example, a read-only memory (ROM), a random access memory (RAM), etc.).

[0273] Among them, the communication unit can also be called a transceiver unit. The antenna and control circuit with transceiver functions in the network intrusion intelligent monitoring device 50 based on deep learning can be regarded as the communication unit 502 of the network intrusion intelligent monitoring device 50 based on deep learning, and the processor with processing function can be regarded as the processing unit 501 of the network intrusion intelligent monitoring device 50 based on deep learning. Optionally, the device used to implement the receiving function in the communication unit 502 can be regarded as a communication unit, and the communication unit is used to perform the receiving steps in the embodiment of the present application. The communication unit can be a receiver, a receiver, a receiving circuit, etc. The device used to implement the sending function in the communication unit 502 can be regarded as a sending unit, and the sending unit is used to perform the sending steps in the embodiment of the present application. The sending unit can be a transmitter, a transmitter, a sending circuit, etc.

[0274] Figure 5 If the integrated units are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The storage medium for storing computer software products includes various media that can store program codes, such as USB flash drives, mobile hard drives, read-only memories, random access memories, magnetic disks or optical disks.

[0275] Figure 5 A unit in a can also be called a module, for example, a processing unit can be called a processing module.

[0276] The embodiment of the present application also provides a hardware structure diagram of a network intrusion intelligent monitoring device based on deep learning (denoted as a network intrusion intelligent monitoring device based on deep learning 60), see Figure 6 The deep learning-based network intrusion intelligent monitoring device 60 includes a processor 601 and, optionally, a memory 602 connected to the processor 601 .

[0277] In the first possible implementation, see Figure 6 , the network intrusion intelligent monitoring device 60 based on deep learning also includes a transceiver 603. The processor 601, the memory 602 and the transceiver 603 are connected via a bus. The transceiver 603 is used to communicate with other devices or communication networks. Optionally, the transceiver 603 may include a transmitter and a receiver. The device used to implement the receiving function in the transceiver 603 can be regarded as a receiver, and the receiver is used to perform the receiving step in the embodiment of the present application. The device used to implement the sending function in the transceiver 603 can be regarded as a transmitter, and the transmitter is used to perform the sending step in the embodiment of the present application.

[0278] Based on the first possible implementation, Figure 6 The structural diagram shown can be used to illustrate the structure of the deep learning-based network intrusion intelligent monitoring device involved in the above embodiments.

[0279] in, Figure 6 The system chip in the deep learning-based network intrusion intelligent monitoring device can also be illustrated. In this case, the actions performed by the deep learning-based network intrusion intelligent monitoring device can be implemented by the system chip. The specific actions performed can be found above and will not be repeated here.

[0280] During implementation, each step of the method provided in this embodiment can be completed by hardware integrated logic circuits in a processor or by software instructions. The steps of the method disclosed in the embodiments of this application can be directly implemented as execution by a hardware processor, or as a combination of hardware and software modules in a processor.

[0281] The processor in this application may include but is not limited to at least one of the following: a central processing unit (CPU), a microprocessor, a digital signal processor (DSP), a microcontroller unit (MCU), or an artificial intelligence processor, etc., various types of computing devices that run software, each of which may include one or more cores for executing software instructions to perform operations or processing. The processor may be a separate semiconductor chip, or it may be integrated into a semiconductor chip together with other circuits. For example, it may form an SoC (system on chip) with other circuits (such as a codec circuit, a hardware acceleration circuit, or various bus and interface circuits), or it may be integrated into the ASIC as a built-in processor of an ASIC. The ASIC with the integrated processor may be packaged separately or with other circuits. In addition to including a core for executing software instructions to perform operations or processing, the processor may further include necessary hardware accelerators, such as a field programmable gate array (FPGA), a PLD (programmable logic device), or a logic circuit that implements dedicated logic operations.

[0282] The memory in the embodiments of the present application may include at least one of the following types: read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or electrically erasable programmable read-only memory (EEPROM). In some scenarios, the memory may also be a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0283] An embodiment of the present application also provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute any of the above methods.

[0284] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the above methods.

[0285] An embodiment of the present application also provides a chip, which includes a processor and an interface circuit, the interface circuit is coupled to the processor, the processor is used to run a computer program or instruction to implement the above method, and the interface circuit is used to communicate with other modules outside the chip.

[0286] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more media that can be integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a DVD), or a semiconductor medium (eg, a solid state disk (SSD)).

[0287] Although the present application is described herein in conjunction with various embodiments, in the process of implementing the claimed application, those skilled in the art may understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0288] Although the present application has been described with reference to specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely illustrative of the present application as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, the present application is intended to encompass such modifications and variations as fall within the scope of the claims of the present application and their equivalents.

Claims

1. A network intrusion intelligent monitoring method based on deep learning, characterized by: include: Collect multi-source data; the multi-source data includes switch port data, flow table matching statistics, process creation records, file access logs, API call parameters and HTTP request characteristics; Preprocessing the multi-source data to generate a spatiotemporal feature map; the spatiotemporal feature map is used to characterize the distribution characteristics of the multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment; Inputting the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection to obtain a detection result; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns; The detection results are classified into risk levels, and active defense is performed according to the defense strategy for each risk level.

2. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The generation process of the spatiotemporal feature map includes: Preprocess multi-source data to obtain standardized feature vectors; preprocessing includes Z-Score standardization, one-hot encoding, and normalization; Based on the SDN network topology, physical nodes are mapped into two-dimensional grid coordinates. A multi-channel spatial feature map is constructed using standardized feature vectors; the channels include network traffic feature channels, network connection relationship channels, host process behavior channels, file access control channels, and application layer interaction channels; wherein, The network traffic feature channel includes the switch port data, the network connection relationship channel includes the flow table matching statistics, the host process behavior channel includes the process creation record, the file access control channel includes the file access log, and the application layer interaction channel includes the API call parameters and the HTTP request characteristics; Use sliding windows to slice multi-source data to obtain sliced ​​data; The slice data is temporally encoded using wavelet transform and fused with the multi-channel spatial feature map to obtain the spatiotemporal feature map.

3. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The first model includes: Extracting spatial features of input data through multiple convolutional layers and multiple pooling layers; the input data is multi-source data; Extract the temporal features of input data through LSTM network; A cross-layer attention module is used to calculate the weight matrix of spatial features and temporal features, and weighted fusion of spatial features and temporal features is performed based on the weight matrix; the cross-layer attention module is used to characterize the correlation strength between spatial features at different time steps and temporal features at different spatial positions; The weighted fused feature vector is flattened and classified through a fully connected layer to output the attack probability and attack type label.

4. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The second model includes: Using an autoencoder to learn feature representations of normal traffic data to obtain true features; the normal traffic data represents multi-source data when no network intrusion occurs; The information maximization generative adversarial network (InfoGAN) architecture is introduced. The generator of the InfoGAN architecture simulates attack traffic to obtain generated features. The discriminator of the InfoGAN architecture distinguishes between real features and generated features, and through adversarial training, improves the generator's ability to generate abnormal traffic data and the discriminator's ability to distinguish between them; the abnormal traffic data represents multi-source data including network intrusions; Calculate the reconstruction error of normal traffic data passing through the autoencoder to obtain the error baseline of normal traffic data; the reconstruction error is used to characterize the autoencoder's ability to reconstruct the input data, and the difference between the original input data and the output data of the autoencoder is calculated using the mean square error or mean absolute error; The reconstruction error of the input data is calculated, and the reconstruction error of the input data is compared with the error baseline to obtain an anomaly score.

5. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The process of generating the detection result includes: The spatiotemporal feature graph is input into the first model and the second model respectively. The first model outputs the attack probability and attack type, and the second model outputs the anomaly score. The weighted voting method is used to perform weighted summation of the attack probability and anomaly score to obtain the comprehensive risk value; The detection result includes a comprehensive risk value and an attack type.

6. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The active defense strategy based on each risk level includes: When the comprehensive risk value is less than the first threshold, the optimal routing path is calculated based on the K-path algorithm, and the traffic direction is guided by the OpenFlow flow table rules; When the comprehensive risk value is greater than or equal to the first threshold and less than the second threshold, the pre-set temporary firewall range control list rules are called according to the attack type, and the frequency of anomaly detection is increased; When the comprehensive risk value is greater than or equal to the second threshold and less than the third threshold, a dynamic defense strategy is generated using a reinforcement learning model; the input of the reinforcement learning model includes the current network topology characteristics, service characteristics, traffic characteristics and the state vector of historical strategy effects, and the output is the probability distribution of each defense strategy in the action space.

7. The network intrusion intelligent monitoring method based on deep learning according to claim 6 is characterized in that: The reinforcement learning model includes a state space, an action space, and a reward function; wherein, The state space includes network topology features, service features, traffic features, and historical policy effects; the network topology features include a network node connection relationship adjacency matrix constructed based on a software-defined network (SDN) controller, and the available bandwidth vector of links between network nodes; the service features include a binary encoding vector of a set of open ports, and a hash value representation of the service version running on each open port; the traffic features include a time series feature of the abnormal traffic ratio calculated based on a sliding window, and a probability density vector of the protocol distribution; the historical policy effects include a time series sequence of the blocking success rate of the last N defensive actions, and an exponential moving average of the network delay increase rate; The action space includes IP hopping, port randomization, and traffic redirection action sets; IP hopping refers to randomly selecting a new IP address based on the uniform distribution of a preset IP address pool; port randomization refers to generating a new port using a deterministic random algorithm within the port range provided by the Internet Assigned Numbers Authority (IANA); and traffic redirection includes multiple preconfigured paths to the scrubbing center and honeypot system. The reward function includes a weighted calculation function determined based on traffic anomaly data, network delay data, and defense strategy cost data.

8. The network intrusion intelligent monitoring method based on deep learning according to claim 6 is characterized in that: The generation of a dynamic defense strategy using a reinforcement learning model includes: The state vector consisting of the current network topology characteristics, service characteristics, traffic characteristics and historical strategy effects is input into the reinforcement learning model; The reinforcement learning model is optimized using a proximal policy optimization algorithm based on the actor-critic framework. The actor-critic framework includes an actor network and a critic network. The actor network is used to output the probability distribution of each action in the action space, and the critic network is used to generate the calculated value of the state-value function and update the critic network's own parameters by minimizing the temporal difference error. Batch collect the last M state-action-reward-next-state quadruples and calculate the gradient estimate of the Actor network through importance sampling; The Actor network and the Critic network are updated respectively according to the gradient estimate, and the state value function calculation result of the Critic network is used to provide an update target for the Actor network; According to the updated Actor network output action probability distribution, the action with the highest probability in the action probability distribution is selected as the dynamic defense strategy.

9. The network intrusion intelligent monitoring method based on deep learning according to claim 1 is characterized in that: The multi-source data includes: switch port data, flow table matching statistics, process creation records, file access logs, API call parameters and HTTP request characteristics; wherein, Switch port data includes switch port byte count, packet count, and duration; Flow table entry matching statistics include source IP, destination IP, source port, destination port, protocol type, and flow duration; The process creation record includes process ID, parent process ID, process creation time, and process execution path; File access logs include file access path, access user, and file operation type; API call parameters include API call path, API request parameters, and API response time; HTTP request characteristics include URL parameters, User-Agent, and request header fields.

10. The network intrusion intelligent monitoring system based on deep learning is characterized by: include: Feature construction module, anomaly detection module and strategy generation module; among them, The feature construction module is used to preprocess the collected multi-source data to generate a spatiotemporal feature graph; the multi-source data includes switch port data, flow table matching statistics, process creation records, file access logs, API call parameters, and HTTP request features; The spatiotemporal feature graph is used to characterize the distribution characteristics of multi-source data in the spatial topology structure and the dynamic change rules in the time series in the network environment; The anomaly detection module is configured to input the spatiotemporal feature graph into a first model and a second model constructed based on a deep learning algorithm to perform anomaly detection and obtain a detection result; the first model is used to detect known attack patterns, and the second model is used to detect unknown attack patterns; The strategy generation module is used to classify the detection results into hierarchical risk levels and perform active defense according to the defense strategy of each risk level.

Images