Gateway equipment attack detection method and system

Abstract

The invention discloses an attack detection method and system for gateway equipment. According to the heterogeneous cooperative defense system based on protocol context awareness provided by the invention, a'kernel mode instruction recombination-user mode adversarial learning 'double-engine architecture is innovatively constructed, and low-delay extraction of attack features and active evolution of a protection strategy are realized. Specifically, the invention provides a migration type adversarial evaluation model, which breaks through the dependence of a traditional detection scheme on protocol grammar, dynamically constructs a cross-protocol attack sample through a generative adversarial network, captures traffic time sequence anomaly in combination with a bidirectional LSTM, and constructs a dynamic graph containing threat propagation probability and resource occupation trend. Therefore, feature migration and generalization modeling can be carried out on unknown or variant attack behaviors, the recognition capability on zero-day attacks and cross-protocol attacks is enhanced, and finally the detection accuracy is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a gateway device attack detection method and system. BACKGROUND

[0002] With the continuous innovation of network attack means, hackers and malicious attackers are constantly developing new attack strategies, and the threats to network devices and services are also showing a trend of diversification and concealment. Under this background, as an important node connecting the internal network and the external Internet, the security of the gateway device is directly related to the protection effect of the entire network system. The gateway device not only bears basic functions such as traffic forwarding and data filtering, but also is the first line of defense of the entire network security defense line.

[0003] The existing gateway protection system mainly relies on pre-defined static rules and feature libraries for security detection. These static rules are based on historical attack data and known threats, and indeed play a certain role in detecting known attack patterns. However, static rule matching has inherent limitations: once the attack method changes or a new attack method appears, the pre-set rules often cannot reflect the latest threat information in time, resulting in a lag in system detection capability. In addition, static rules are difficult to capture attack behaviors with high concealment and dynamic change characteristics, thereby greatly reducing the detection rate and protection effect of the system when facing new attacks. SUMMARY

[0004] The present application provides a gateway device attack detection method and system, which solves the technical problem of being difficult to capture attack behaviors with high concealment and dynamic change characteristics in the prior art, enabling the gateway device to effectively identify network malicious traffic attacks and improving the overall security of the gateway device.

[0005] The present application provides a gateway device attack detection method, comprising: obtaining network data packets; extracting a session identification five-tuple from the network data packets, copying the effective load of the maximum load interception length predefined in the network data packets to a ring buffer, and recording the starting offset and copy length of the effective load in the ring buffer; reading the load of a preset byte from the ring buffer as an original byte sequence based on the starting offset and copy length; statistically calculating the byte distribution probability p(b) of the original byte sequence in a preset window, and calculating the Shannon entropy H(b) through the formula ; statistically calculating the frequency of adjacent byte bigrams in the original byte sequence to obtain the conditional rate ; wherein,​ is the byte value at the current moment in the original byte sequence, is the byte value of the previous moment in the original byte sequence, and the formula The conditional entropy H2 is calculated; Using the source IP in the quintuple as a key, querying a preset reputation score database to obtain the corresponding autonomous system risk value, geographic area risk value, and historical attack hit count; By formula d i =t i −t i−1 Calculate the arrival interval sequence d of adjacent data packets i ; where t i is the timestamp of the arrival of the i-th data packet, t i-1 The timestamp of the arrival of the i-1th data packet; By formula Calculate the average arrival interval ; By formula Calculate the variance ; By formula The tenth-order autocorrelation value is calculated; The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographical area risk value, the number of historical attack hits, the average arrival interval , the variance and the tenth-order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output; Inputting the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network, and outputting a temporal embedding sequence; A fully connected network is stacked on the temporal embedding sequence, and a periodic representation PRE is calculated using the formula PRE = wᵀ (1 / T ∑t=1…Tht) + b; where wᵀ is the transposed weight vector of the fully connected network, ht is the hidden state of the bidirectional long short-term memory network at the t-th time step, T is the total number of time steps, and b is the bias of the fully connected network. The periodicity score is obtained by first subtracting a preset periodicity baseline mean from the periodicity representation PRE and then dividing the result by a preset periodicity standard deviation. The Shannon entropy is first subtracted from the preset entropy baseline mean, and then divided by the preset entropy standard deviation to obtain a load entropy score; The number of protocol types in the quintuple is first subtracted from the preset protocol flexibility baseline mean, and then divided by the preset protocol flexibility standard deviation to obtain a protocol flexibility score; integrate the periodicity score, the payload entropy score and the protocol flexibility score into a core behavior feature vector a; calculate a cosine similarity between the feature vector a and a pre-stored threat type vector by a formula cos_sim(a,bi)=(a·bi) / (‖a‖×‖bi‖); wherein bi is the pre-stored threat type vector; weight-sum the periodicity score, the payload entropy score and the protocol flexibility score to obtain a core aggregation score; splice the cosine similarity and the core aggregation score into a comprehensive threat distribution vector; normalize the comprehensive threat distribution vector to obtain a maximum probability value in the normalized distribution, and match to obtain a final threat type corresponding to the maximum probability value; integrate the final threat type, the maximum probability value, and the cosine similarity, the periodicity score, the payload entropy score and the protocol flexibility score corresponding to the maximum probability value into a cross-protocol threat feature x; calculate the Mahalanobis distance D by a formula ; wherein μ is a pre-set mean vector, and Σ is a pre-set covariance matrix; calculate a deviation degree score by a formula min(1,D / Dmax); wherein Dmax is a pre-set maximum allowed distance; calculate a CPU utilization rate u_t at time t by a formula u_t=φ1*u_{t-1}+φ2 * u_{t-2}+ε_t+θ1*ε_{t-1}+θ2 *ε_{t-2}; wherein φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is white noise residual error; statistically calculate a proportion of CPU utilization rates exceeding a set threshold value in N time instants, and take the proportion as an overload probability of the CPU; calculate a time slope β by a formula ; wherein t i is the memory utilization rate at the i-th second, is the mean value of time, is the mean value of memory utilization rate, and m i is the memory utilization rate at the i-th second; compare the time slope β with a set value to obtain a memory usage trend score; based on a pre-set exploit chain, construct an attack graph taking assets as nodes and paths as directed edges; assign the maximum probability value to a corresponding source node in the attack graph as an initial weight of a PageRank algorithm; when the PageRank algorithm is iterated, the score of each node is updated according to the following formula: PR_i(t+1) = (1 - d) / N + d *∑_{j→i} [PR_j(t) / outdeg(j)] where PR_i(t+1) is the PageRank score of node i after the t+1 iteration, d is a damping factor, N is the total number of nodes in the attack graph, j→i is all predecessor nodes j pointing to node i, and outdeg(j) is the number of out-edges of node j; The overall risk score is calculated by the formula overall risk score = feature application function (w d * deviation score + w c * (CPU overload probability + memory usage trend score) + w s * max(PageRank score)) ; wherein w d , w c , and w s are preset weights; The overall risk score is compared with a preset threshold to map out a risk level; The risk level, the maximum probability value, and the final threat type are integrated into a final threat assessment result.

[0006] Specifically, it further includes: The average inter-arrival interval , the variance , and the tenth-order autocorrelation value are smoothed to obtain smoothed average inter-arrival interval, variance, and tenth-order autocorrelation value; The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit number, the average inter-arrival interval , the variance , and the tenth-order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output, including: The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit number, the smoothed average inter-arrival interval, variance, and tenth-order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output.

[0007] Specifically, it further includes: If the periodicity PRE is greater than the preset periodicity baseline mean + preset periodicity standard deviation, the periodicity score is multiplied by a preset amplification coefficient to obtain a reinforced periodicity score; If the Shannon entropy > the preset entropy baseline mean + the preset entropy standard deviation, the load entropy score is multiplied by a preset amplification coefficient to obtain a reinforced load entropy score. If the number of protocol categories > the preset protocol flexibility baseline mean + the preset protocol flexibility standard deviation, the protocol flexibility score is multiplied by a preset amplification coefficient to obtain a reinforced protocol flexibility score.

[0008] Specifically, the method further comprises: Comparing the PageRank score of each node in the attack graph with a preset comparison threshold to obtain a corresponding asset whose PageRank score is greater than the comparison threshold; Taking the corresponding asset as a starting point, searching for a corresponding subnet identifier and terminal device in network topology information; According to the risk level and the final threat type, two-level indexing is performed to obtain a matched strategy template; According to the risk level, a preset database is queried to obtain a matched execution level, a speed limit value and a rollback strategy; The subnet identifier, the terminal device, the risk level, the final threat type, the matched execution level, the speed limit value and the rollback strategy are filled into the strategy template to obtain a recommended action of the threat event; The integration of the risk level, the maximum probability value and the final threat type into a final threat assessment result comprises: The integration of the risk level, the maximum probability value, the final threat type and the recommended action of the threat event into a final threat assessment result.

[0009] Specifically, the method further comprises: Mapping the IP address of the corresponding asset to a VLAN to which the corresponding asset belongs; Taking the highest risk level of the mapped assets under each VLAN as the risk level of the VLAN; The CPU core number of each VLAN is calculated by the formula: CPU core number = ⌈1×number of service services carried n×risk factor corresponding to the risk level×service-based latency factor⌉; The memory quota of each VLAN is calculated by the formula: memory quota = ⌈base memory unit×number of service services carried n×risk factor corresponding to the risk level×service-based latency factor⌉; The CPU core number of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, the corresponding asset and network topology information are used to construct a network model with resource constraints and risk labels; Taking the network model with the resource constraint and the risk label as a root node, a Monte Carlo tree search is started; In the Monte Carlo tree search process, a set action is simulated at each expansion node, and in the simulation process, an attack blocking rate, a false alarm rate, a response delay and an energy consumption efficiency are calculated for each set action, and the attack blocking rate, the false alarm rate, the response delay and the energy consumption efficiency are integrated into cumulative return records; The simulation continues until a preset iteration number or convergence, and all paths and their cumulative return records are recorded; From the cumulative return records, the optimal strategy combination in four dimensions of "blocking rate rise", "false alarm rate drop", "delay drop" and "efficiency rise" is screened out; The optimal strategy combination is associated with real-time resource state and network topology to generate a defense strategy combination.

[0010] The application also provides an attack detection system of a gateway device, comprising: A network data packet acquisition module is configured to acquire network data packets; A data feature extraction module is configured to extract a session identification five-tuple from the network data packets, copy a payload of a predefined maximum payload interception length in the network data packets to a ring buffer, and record a starting offset and a copy length of the payload in the ring buffer; An original byte sequence acquisition module is configured to read a preset byte payload from the ring buffer as an original byte sequence based on the starting offset and the copy length; A Shannon entropy calculation module is configured to count a byte distribution probability p(b) of the original byte sequence in a preset window, and calculate a Shannon entropy H1 through a formula ; ; A conditional entropy calculation module is configured to count a frequency of adjacent byte bigrams in the original byte sequence to obtain a conditional rate ; wherein, is a byte value at a current time in the original byte sequence, is a byte value at a previous time in the original byte sequence, and a conditional entropy H2 is calculated through a formula ; A key query module is configured to take a source IP in the five-tuple as a key to query a preset reputation score database to obtain corresponding autonomous system risk values, geographical region risk values and historical attack hit times; An interval sequence calculation module is configured to calculate an adjacent data packet arrival interval sequence d i through a formula d i =t i−1 −t i ; wherein, ti is the timestamp of the i-th data packet arrival, t i-1 is the timestamp of the i-1-th data packet arrival; an average inter-arrival interval calculation module configured to calculate an average inter-arrival interval by a formula ; a variance calculation module configured to calculate a variance by a formula ; a tenth-order autocorrelation value calculation module configured to calculate a tenth-order autocorrelation value by a formula a spatial mapping module configured to input the Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit number, the average inter-arrival interval , the variance and the tenth-order autocorrelation value into a pre-trained shared encoder for spatial mapping, and output a protocol-independent feature vector; a time series embedding sequence obtaining module configured to input the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network, and output a time series embedding sequence; a periodicity representation calculation module configured to continue stacking a fully connected network on the time series embedding sequence, and calculate a periodicity representation PRE by a formula PRE = wᵀ·(1 / T·∑t=1…Tht)+b; wherein wᵀ is a weight vector transpose of the fully connected network, ht is a bidirectional long short-term memory network hidden state at a t-th time step, T is a total number of time steps, and b is a bias of the fully connected network; a periodicity score calculation module configured to subtract a preset periodicity baseline mean from the periodicity representation PRE, and divide by a preset periodicity standard deviation to obtain a periodicity score; a payload entropy score calculation module configured to subtract a preset entropy baseline mean from the Shannon entropy, and divide by a preset entropy standard deviation to obtain a payload entropy score; a protocol flexibility score calculation module configured to subtract a preset protocol flexibility baseline mean from the number of protocol categories in the five-tuple, and divide by a preset protocol flexibility standard deviation to obtain a protocol flexibility score; a score integration module configured to integrate the periodicity score, the payload entropy score and the protocol flexibility score into a core behavior feature vector a; a cosine similarity calculation module configured to calculate a cosine similarity between the feature vector a and a pre-stored threat type vector by a formula cos_sim(a, bi)=(a·bi) / (‖a‖×‖bi‖); wherein bi is the pre-stored threat type vector.​​​ a weighted summation module configured to perform a weighted summation on the periodicity score, the payload entropy score and the protocol flexibility score to obtain a core aggregation score; a concatenation module configured to concatenate the cosine similarity and the core aggregation score into a comprehensive threat distribution vector; a final threat type obtaining module configured to normalize the comprehensive threat distribution vector to obtain a maximum probability value in the normalized distribution, and match a final threat type corresponding to the maximum probability value; a cross-protocol threat feature obtaining module configured to integrate the final threat type, the maximum probability value, and the cosine similarity, the periodicity score, the payload entropy score and the protocol flexibility score corresponding to the maximum probability value into a cross-protocol threat feature x; a Mahalanobis distance calculating module configured to calculate a Mahalanobis distance D by a formula ; wherein μ is a preset mean vector and Σ is a preset covariance matrix; a deviation degree score calculating module configured to calculate a deviation degree score by a formula min(1, D / Dmax); wherein Dmax is a preset maximum allowed distance; a CPU utilization calculating module configured to calculate a CPU utilization u_t at a t-th moment by a formula u_t=φ1*u_{t-1}+φ2 * u_{t-2}+ε_t+θ1*ε_{t-1}+θ2 *ε_{t-2}; wherein φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is white noise residual error; a CPU utilization statistical module configured to count a proportion of CPU utilizations at N moments that exceed a set threshold value, and take the proportion as an overload probability of the CPU; a time slope calculating module configured to calculate a time slope β by a formula ; wherein t i is a i-th second, is a mean value of time, is a mean value of memory utilization, and m i is a memory utilization at the i-th second; a memory usage trend score obtaining module configured to compare the time slope β with a set value to obtain a memory usage trend score; an attack graph constructing module configured to construct an attack graph with assets as nodes and paths as directed edges based on a preset exploit chain; a PageRank iteration module, configured to assign the maximum probability value to a corresponding source node in the attack graph as an initial weight of a PageRank algorithm; and configured to update a score of each node according to the following formula during PageRank iteration: PR_i(t+1) = (1-d) / N + d*∑_j→i[PR_j(t) / outdeg(j)]; wherein PR_i(t+1) is a PageRank score of node i after the t+1th iteration, d is a damping factor, N is a total number of nodes in the attack graph, j→i is all predecessor nodes j pointing to node i, and outdeg(j) is a number of out-edges of node j; a total risk score calculation module, configured to calculate a total risk score according to a formula: total risk score = feature application function(w d * deviation score + w c * (overload probability of CPU + memory usage trend score) + w s * max(PageRank score)); d , w c , and w s are preset weights; a risk level mapping module, configured to map a risk level after comparing the total risk score with a preset threshold value; a threat assessment result obtaining module, configured to integrate the risk level, the maximum probability value, and the final threat type into a final threat assessment result.

[0011] Specifically, the method further includes: a smoothing module, configured to perform smoothing processing on the average inter-arrival interval , the variance , and the tenth-order autocorrelation value to obtain a smoothed average inter-arrival interval, a smoothed variance, and a smoothed tenth-order autocorrelation value; The spatial mapping module is specifically configured to input the Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit frequency, the smoothed average inter-arrival interval, the smoothed variance, and the smoothed tenth-order autocorrelation value into a pre-trained shared encoder to perform spatial mapping, and output to obtain a protocol-independent feature vector.

[0012] Specifically, the method further includes: a periodicity score strengthening module, configured to multiply the periodicity score by a preset amplification coefficient to obtain a strengthened periodicity score, if the periodicity PRE is greater than the preset periodicity baseline mean value + a preset periodicity standard deviation. a load entropy score strengthening module configured to multiply the load entropy score by a preset amplification coefficient to obtain a strengthened load entropy score if the Shannon entropy > the preset entropy baseline mean + a preset entropy standard deviation; a protocol flexibility score strengthening module configured to multiply the protocol flexibility score by a preset amplification coefficient to obtain a strengthened protocol flexibility score if the number of protocol categories > the preset protocol flexibility baseline mean + a preset protocol flexibility standard deviation.

[0013] Specifically, the method further comprises: a risk asset obtaining module configured to compare the PageRank score of each node in the attack graph with a preset comparison threshold to obtain a corresponding asset with a PageRank score greater than the comparison threshold; a querying module configured to query a corresponding subnet identifier and terminal device in the network topology information starting from the corresponding asset; a policy template indexing module configured to index the risk level and the final threat type to obtain a matched policy template; an operation matching module configured to query a preset database according to the risk level to obtain a matched execution level, speed limit value and rollback strategy; a recommended action obtaining module configured to fill the subnet identifier, the terminal device, the risk level, the final threat type, the matched execution level, speed limit value and rollback strategy into the policy template to obtain a recommended action of a threat event; The threat assessment result obtaining module is specifically configured to integrate the risk level, the maximum probability value, the final threat type and the recommended action of the threat event into a final threat assessment result.

[0014] Specifically, the method further comprises: an IP address mapping module configured to map the IP address of the corresponding asset to a VLAN to which the corresponding asset belongs; a risk level obtaining module configured to take the highest risk level of the mapped assets under each VLAN as the risk level of the VLAN; a CPU core number calculating module configured to calculate the CPU core number of each VLAN by the formula CPU core number = ⌈1×number of carried service n×risk factor corresponding to the risk level×service-based time delay factor⌉; a memory quota calculating module configured to calculate the memory quota of each VLAN by the formula memory quota = ⌈base memory unit×number of carried service n×risk factor corresponding to the risk level×service-based time delay factor⌉; A model construction module is configured to construct a network model with resource constraints and risk labels based on the number of CPU cores of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, the corresponding asset, and network topology information. A Monte Carlo tree search module is configured to start a Monte Carlo tree search with the network model with resource constraints and risk labels as a root node. A cumulative return record integration module is configured to simulate a set action at each expansion node during the Monte Carlo tree search process, and calculate the attack blocking rate, false positive rate, response delay, and energy efficiency for each set action during the simulation process, and integrate the attack blocking rate, false positive rate, response delay, and energy efficiency into a cumulative return record; the simulation continues until a preset number of iterations or convergence, and all paths and their cumulative return records are recorded. An optimal strategy combination obtaining module is configured to filter out the optimal strategy combination in four dimensions of "blocking rate increase", "false positive rate decrease", "delay decrease", and "efficiency increase" from the cumulative return record. A defense strategy combination generation module is configured to associate the optimal strategy combination with real-time resource status and network topology to generate a defense strategy combination.

[0015] One or more technical solutions provided in the present application have at least the following technical effects or advantages: 1. The present application proposes a heterogeneous collaborative defense system based on protocol context awareness, innovatively constructs a "kernel state instruction reorganization-user state countermeasure learning" dual-engine architecture, and realizes low-latency extraction of attack features and active evolution of defense strategies. Specifically, the present application proposes a migratory countermeasure evaluation model, breaks through the dependence of traditional detection schemes on protocol syntax, dynamically constructs cross-protocol attack samples through a generative adversarial network, captures traffic timing anomalies through a bidirectional LSTM, and constructs a dynamic graph containing threat propagation probability and resource occupation trend, thereby enabling feature migration and generalization modeling of unknown or variant attack behaviors, enhancing the identification ability of zero-day attacks and cross-protocol attacks, and ultimately improving the detection accuracy.

[0016] 2. The eBPF / XDP is used to construct a kernel state feature extraction pipeline to capture instruction-level operations at the bottom of the protocol stack, generate multi-dimensional features including protocol compliance scores, instruction opcode entropy, and payload randomness, and further realize the identification of attack behaviors with dynamic changing features. Through the kernel state instruction flow reorganization mechanism, the present application can extract network behavior features in real time with millisecond-level delay, thereby realizing rapid response to potential attack behaviors.

[0017] 3. By instruction-level power consumption monitoring and Monte Carlo tree search strategy optimization, real-time balance of calculation accuracy and resource consumption is realized. When the CPU utilization is greater than a threshold, the inference speed is improved by automatically switching from a full-precision model to a lightweight model, and the memory occupation is reduced by combining random projection dimension reduction, and high-efficiency operation can still be maintained in resource-limited scenes such as edge computing. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A flowchart of the attack detection method of the gateway device provided by the embodiment of the application is shown. DETAILED DESCRIPTION

[0019] The embodiment of the application provides an attack detection method and system of a gateway device, solves the technical problem that it is difficult to capture attack behaviors with high concealment and dynamic change characteristics in the prior art, enables the gateway device to effectively identify network malicious traffic attacks, and improves the overall security of the gateway device.

[0020] The technical solution in the embodiment of the application is to solve the above technical problem, and the general idea is as follows: First, based on the kernel state protocol stack bypass technology, the network instruction stream is reconstructed by dynamic patching to generate a multi-dimensional feature matrix containing protocol compliance, timing correlation, and payload entropy. Next, GAN-LSTM hybrid architecture is used for cross-protocol attack feature transfer learning to build a dynamic risk assessment atlas containing behavior baseline deviation, resource occupation trend, and threat propagation probability. Finally, the model calculation granularity is dynamically adjusted, and when the CPU utilization exceeds a threshold, the lightweight inference mode is automatically switched, and the optimal protection strategy combination is generated based on Monte Carlo tree search.

[0021] Overall, the embodiment of the application not only greatly improves the response speed and adaptive defense capability of new attacks while maintaining high-performance packet processing, but also significantly enhances the overall security and stability of the gateway device, and is suitable for security reinforcement of key gateway devices in various network environments.

[0022] In order to better understand the above technical solution, the above technical solution will be described in detail in combination with the drawings of the specification and the specific embodiments.

[0023] As shown in Figure 1 The attack detection method of the gateway device provided by the embodiment of the application comprises: Step S110: acquiring network data packets; Step S120: extracting a session identification five-tuple from the network data packets, copying the effective payload of the predefined maximum payload length in the network data packets to a ring buffer, and recording the starting offset and copy length of the effective payload in the ring buffer; In this embodiment, the session identification five-tuple includes: source IP, destination IP, source port, destination port and protocol.

[0024] The above steps are described in detail. When the gateway device receives a raw network data frame, the XDP (eXpress Data Path) intercepts the frame at the network card driver layer and hands it over to the eBPF (extended Berkeley Packet Filter) program in the kernel mode for processing. The eBPF program first reads the Ethernet header in the raw network data frame to obtain the source / destination MAC, and then analyzes the IP header (extracts version, TTL, flag bit, protocol number, source / destination IP), transport layer header (extracts TCP / UDP port, TCP flag bit or ICMP type / code) and common application layer protocol fields (such as DNS transaction ID and query / response type, HTTP / 1.1 request line and important header fields, and cipher suite and extension fields in TLS ClientHello / ServerHello) in sequence. All the above extraction results are summarized as a field set, which is qualitatively described as: five-tuple (source IP: source port-destination IP: destination port@protocol), transport layer control information (TCP flag bit, UDP length, ICMP type / code), application layer protocol features (DNS transaction ID, HTTP request line, TLS handshake extension, etc.).

[0025] The eBPF program matches the field set with the predefined protocol parsing templates one by one: If "TCP three-way handshake incomplete" is detected, it means that only SYN and ACK are captured and SYN-ACK is missing, which may exist replay or bypass attack, and "incomplete handshake" is added to the exception marker list; If "TLS missing extension field" is detected, it means that SNI, SupportedGroups and other extensions are omitted in ClientHello, and "missing extension field" is added to the exception marker list; … (in turn judge ARP, DNS, HTTP / 2, QUIC, etc. Template conditions)… The eBPF program further switches the parsing mode of the raw network data frame in real time according to the updated exception marker list and the predefined mapping relationship: If the handshake is incomplete, perform deep TCP parsing mode to perform more strict verification on TCP sequence number and flag bit; If the extension field is missing, perform deep TLS parsing mode to extend the parsing to ServerHello and subsequent handshake; If it is a DNS amplification attack, perform deep DNS parsing mode to record the authoritative zone and additional record details.

[0026] Step S210: Reading a payload of preset bytes from the ring buffer as an original byte sequence based on the starting offset and the copy length; Step S220: Count the byte distribution probability p(b) of the original byte sequence in the preset window, and calculate it by the formula Calculate the Shannon entropy ; Count the frequencies of adjacent byte pairs in the original byte sequence to get the conditional rate ;in, is the byte value at the current moment in the original byte sequence, is the byte value of the previous moment in the original byte sequence, and through the formula The conditional entropy H2 is calculated; It's important to note that to reduce computational load, the current CPU utilization, memory usage, and network bandwidth usage are obtained and compared with predefined thresholds. If any of these exceeds the threshold, resource constraints are considered. In this case, only the Shannon entropy is calculated, not the conditional entropy. In this case, only the Shannon entropy is used in subsequent calculations.

[0027] Step S310: Using the source IP in the quintuple as a key, query the preset reputation score database to obtain the corresponding autonomous system risk value, geographic area risk value, and historical attack hit count; Step S410: By formula d i =t i −t i−1 Calculate the arrival interval sequence d of adjacent data packets i ; where t i is the timestamp of the arrival of the i-th data packet, t i-1 is the timestamp of the arrival of the i-1th data packet; by the formula Calculate the average arrival interval ; Through the formula Calculate the variance ; Through the formula The tenth-order autocorrelation value is calculated; Step S510: Shannon entropy , conditional entropy H2, autonomous system risk value, geographical area risk value, historical attack hit count, average arrival interval ,variance and the tenth order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output; the encoder adopts an alternating stack of multiple fully connected layers and normalization layers, and applies the same transformation matrix to each type of feature to ensure that the output protocol-independent feature vector is consistent in expression ability and dimension. After mapping, a fixed-length protocol-independent feature vector is obtained, which retains the original timing and load pattern and also integrates context risk information.

[0028] To reduce noise interference caused by instantaneous fluctuations in traffic and improve the accuracy of attack detection, the method further includes: The average inter-arrival interval , the variance and the tenth order autocorrelation value are smoothed to obtain a smoothed average inter-arrival interval, variance and tenth order autocorrelation value. Specifically, using a given smoothing coefficient α, the above three items are respectively applied to the exponential weighted moving average smoothing S t =αx t +(1-α)S t-1 . Where x t is the current window statistic, S t−1 is the previous window smoothing value. The average inter-arrival interval, variance and tenth order autocorrelation value are respectively substituted as different x t to calculate the smoothed average inter-arrival interval, variance and tenth order autocorrelation value.

[0029] In this case, the Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit count, the average inter-arrival interval , the variance and the tenth order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output, including: The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographic region risk value, the historical attack hit count, the smoothed average inter-arrival interval, variance and tenth order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output.

[0030] Step S520: input the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network, and the network bidirectional recurrent unit can capture the dependence of traffic on the previous and subsequent timing, and output a timing embedding sequence. Step S530: continue to stack a layer of fully connected network on the time sequence embedding sequence, and calculate a periodic representation PRE by the formula PRE = wT·(1 / T·∑t=1…Tht)+b; wherein wT is a weight vector transpose of the fully connected network, ht is a bidirectional long short-term memory network hidden state at the tth time step, T is a total number of time steps, and b is a bias of the fully connected network; Step S540: subtract a preset periodic baseline mean from the periodic representation PRE, and divide by a preset periodic standard deviation to obtain a periodic score; subtract a preset entropy baseline mean from the Shannon entropy, and divide by a preset entropy standard deviation to obtain a load entropy score; subtract a preset protocol flexibility baseline mean from the number of protocol types in the five-tuple, and divide by a preset protocol flexibility standard deviation to obtain a protocol flexibility score; Step S550: integrate the periodic score, the load entropy score, and the protocol flexibility score into a core behavior feature vector a, which can reflect a deviation degree of the session flow relative to historical normal behavior; In order to emphasize potential anomalies, the following are also included: If the periodic representation PRE is greater than the preset periodic baseline mean plus the preset periodic standard deviation, multiply the periodic score by a preset amplification coefficient to obtain a periodic score after enhancement; If the Shannon entropy is greater than the preset entropy baseline mean plus the preset entropy standard deviation, multiply the load entropy score by a preset amplification coefficient to obtain a load entropy score after enhancement; If the number of protocol types is greater than the preset protocol flexibility baseline mean plus the preset protocol flexibility standard deviation, multiply the protocol flexibility score by a preset amplification coefficient to obtain a protocol flexibility score after enhancement.

[0031] Step S560: calculate a cosine similarity between the feature vector a and a pre-stored threat type vector by the formula cos_sim(a, bi) = (a·bi) / (‖a‖×‖bi‖); wherein bi is the pre-stored threat type vector, a·bi is a vector inner product; ‖a‖ and ‖bi‖ are L2 norms of the vectors, respectively; and weight-sum the periodic score, the load entropy score, and the protocol flexibility score to obtain a core aggregation score; Step S570: concatenate the cosine similarity and the core aggregation score into a comprehensive threat distribution vector v = [s1, s2,..., sn, G]; wherein si is the cosine similarity of the ith threat type vector, 1≤i≤n, and G is the core aggregation score; Step S580: normalize the comprehensive threat distribution vector to obtain a maximum probability value in the normalized distribution as a preliminary confidence, and match to obtain a final threat type corresponding to the maximum probability value; Step S590: integrate the final threat type, the maximum probability value, and the cosine similarity corresponding to the maximum probability value, the periodicity score, the payload entropy score, and the protocol flexibility score into a cross-protocol threat feature x; Step S600: calculate the Mahalanobis distance D by the formula ; wherein μ is a preset mean vector, and Σ is a preset covariance matrix; Step S610: calculate the deviation degree score by the formula min(1, D / Dmax); wherein Dmax is a preset maximum allowed distance, that is, the Mahalanobis distance D is divided by the maximum allowed distance Dmax in the historical baseline and clipped to [0, 1] to obtain the deviation degree score.

[0032] Step S710: calculate the CPU utilization rate u_t at time t by the formula u_t=φ1*u_{t-1}+φ2 * u_{t-2}+ε_t+θ1*ε_{t-1}+θ2 *ε_{t-2}; wherein φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is white noise residual; Step S720: count the proportion of the CPU utilization rates at N time points exceeding a set threshold value, and take the proportion as the CPU overload probability; Specifically, the utilization rates u_t, u_{t−1} and the residuals ε_t, ε_{t−1} at the current time T are taken as the starting point, and the utilization rates u_{t+1}, u_{t+2}, …, u_{t+5} at the next five time points are calculated in turn through the recursive equation of the model, which are the CPU utilization rate prediction values within the next 5 seconds. Then the proportion of the five prediction values exceeding the threshold value of 85% is counted, which is taken as the CPU overload probability.

[0033] Step S730: calculate the time slope β by the formula ; wherein t i is the i-th second, is the mean value of time, is the mean value of memory utilization, and m i is the memory utilization rate at the i-th second; the time slope β is compared with a set value to obtain a memory usage trend score; Specifically, when β>0.1% per second, it is determined as an “upward trend”; when β<-0.1% per second, it is determined as a “downward trend”; otherwise, it is a “steady state”. In this embodiment, the “upward trend” corresponds to 1 point, the “downward trend” corresponds to 0 point, and the “steady state” corresponds to 0.5 point.

[0034] Step S810: based on a preset exploit chain, an attack graph is constructed with assets as nodes and paths as directed edges; Step S820: Assign the maximum probability value to the corresponding source node in the attack graph as the initial weight of the PageRank algorithm; when the PageRank is iterated, the score of each node is updated according to the following formula: PR_i(t+1)=(1-d) / N+d*∑_{j→i}[PR_j(t) / outdeg(j)] Where PR_i(t+1) is the PageRank score of node i after the t+1 iteration, d is the damping factor, N is the total number of nodes in the attack graph, j→i is all predecessor nodes j pointing to node i, and outdeg(j) is the number of out-edges of node j. Step S910: Calculate the overall risk score by the formula Overall risk score = Feature application function(w d * Deviation score + w c *(CPU overload probability + Memory usage trend score) + w s * max(PageRank score)); d , w c , and w s are preset weights. Step S920: Map the risk level after comparing the overall risk score with the preset threshold. The specific description of this step is as follows: If the overall risk score > 0.9, the risk level is unacceptable risk. If 0.7 < overall risk score ≤ 0.9, the risk level is high risk. If 0.5 < overall risk score ≤ 0.7, the risk level is medium risk. Otherwise, the risk level is low risk.

[0035] Step S930: Integrate the risk level, maximum probability value, and final threat type into the final threat assessment result.

[0036] In order to obtain the recommended action of the threat event, it also includes: Compare the PageRank score of each node in the attack graph with the preset comparison threshold to obtain the corresponding asset whose PageRank score is greater than the comparison threshold. Take the corresponding asset as the starting point to find the corresponding subnet identifier and terminal device in the network topology information. According to the risk level and the final threat type, two-level indexing is performed to obtain the matched strategy template. According to the risk level, the preset database is queried to obtain the matched execution level, speed limit value, and rollback strategy. Fill the subnet identification, terminal device, risk level, final threat type, matched execution level, rate limiting value and fallback strategy into the policy template to obtain the recommended action of the threat event; Specifically: I. The protection policy library is internally grouped by two dimensions of "risk level → threat type": II. Two-level index lookup First, take the corresponding sub-dictionary from the protection policy library with the risk level (such as "unacceptable level") as the first layer key; Then, in the sub-dictionary, take the list of all policy templates for the threat type (such as "encrypted_c2") under the risk level as the second layer key; III. Strategy template set The obtained policy template list is the "matched strategy template set", for example: matched strategy template set = protection policy library[risk level][threat type].

[0037] After locating the matched strategy template set, the following detailed subsequent processing is performed on each template to generate executable protection actions: Each strategy template predefines a set of placeholders for runtime parameters to be filled. Common placeholders include: {{SRC_IP}}: source IP address placeholder {{DST_PORT}}: destination port placeholder {{LAYER}}: execution level (such as XDP, iptables) {{RATE_LIMIT}}: rate limiting value {{FALLBACK}}: fallback strategy Use the affected asset information to map actual values to placeholders, for example: fill the first or all IPs in AFS (such as ["10.0.0.1"]) into {{SRC_IP}}, fill AFP (such as

[443] ) into {{DST_PORT}}, etc.

[0038] Determine {{LAYER}}, {{RATE_LIMIT}}, {{FALLBACK}} and other parameters according to the risk level, for example: for the unacceptable level, set LAYER="XDP" and FALLBACK="misfire rate > 5% switch rate limiting"; for the high level, set RATE_LIMIT="1Mbps" and QOS_PRIORITY = "high"; for the medium level, set REDIRECT_PORT = "8080" and HONEYPOT_IP="10.0.0.99".

[0039] For each template, replace all placeholders with the mapped parameters to generate an "instantiated" JSON-formatted action.

[0040] Collect all instantiated action entries in a list according to the original template order or priority as the recommended action for the threat event.

[0041] In this case, integrate the risk level, maximum probability value, and final threat type into the final threat assessment result, including: Integrate the risk level, maximum probability value, final threat type, and recommended action of the threat event into the final threat assessment result.

[0042] In this embodiment, the subnet identifier is used to limit the network segment range of the protection rule; all affected terminal devices within the subnet are used to explicitly specify the specific host to be protected / isolated in the policy; the risk level is used to let the template select the appropriate execution level and severity; the final threat type is used to let the template load the special defense logic corresponding to the threat; and the maximum probability value is used to display the threat confidence in the log or alarm message if necessary.

[0043] In order to obtain the defense policy, further comprising: Map the IP address of the corresponding asset to the VLAN to which it belongs; Take the highest risk level of the mapped assets under each VLAN as the risk level of the VLAN; specifically, traverse all mapped assets under each VLAN, read their corresponding risk levels, and take out the highest risk level under the VLAN according to the risk level from high to low to count the maximum risk level of the subordinate assets, and obtain the priority ranking list of each VLAN. For example, assume that VLAN 100 has asset A ("high risk") and asset B ("unacceptable risk"), then the risk level of VLAN 100 is determined as "unacceptable risk"; while VLAN 200 has asset C ("medium risk") and asset D ("high risk"), then "high risk" is selected. After completing the maximum value selection of each VLAN, sort all VLANs according to their risk levels from high to low.

[0044] Calculate the CPU core number of each VLAN by the formula CPU core number = ⌈1 x number of business services carried n x risk factor corresponding to risk level (e.g. "unacceptable risk" -> 2.0, "high risk" -> 1.5, etc.) x latency factor based on business (e.g. ≤ 50 ms -> 1.2, 50-100 ms -> 1.0, > 100 ms -> 0.8, etc.)⌉, and round up the calculated CPU core number; The memory quota of each VLAN is calculated by the formula: memory quota = ceiling (base memory unit * number of service services carried n * risk factor corresponding to the risk level * time delay factor based on the service). The CPU core number of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, the corresponding asset, and the network topology information are used to construct a network model with resource constraints and risk labels. The Monte Carlo tree search is started with the network model with resource constraints and risk labels as the root node. During the Monte Carlo tree search process, each expansion node simulates a set action, and during the simulation process, the attack blocking rate (the proportion of malicious traffic blocked), the false positive rate (the proportion of normal traffic mistakenly blocked), the response delay (the additional network delay affected by the action), and the energy efficiency (the calculation / memory overhead required by the new action) are calculated for each set action, and the attack blocking rate, the false positive rate, the response delay, and the energy efficiency are integrated into cumulative return records. In this embodiment, the set actions include XDP blocking, token bucket rate limiting, honeypot redirection, etc.

[0045] The simulation continues until the preset number of iterations or convergence, and all paths and their cumulative return records are recorded. From the cumulative return records, the optimal strategy combination in the four dimensions of "blocking rate increase", "false positive rate decrease", "delay decrease", and "efficiency increase" is selected. For example, the strategy combination that is not superior to any other path in the four key indicators of attack blocking rate, false positive rate, response delay, and energy efficiency is selected as the executable command of the final strategy. "Not superior to any other path" means that the selected strategy combination does not exist in all dimensions at least equal to another simulated path and strictly superior to it in a certain dimension. In other words, if the blocking rate of strategy A ≥ the blocking rate of strategy B, the false positive rate ≤ the false positive rate of strategy B, the delay ≤ the delay of strategy B, and the efficiency ≥ the efficiency of strategy B, and at least one dimension is better than strategy B, then strategy A dominates strategy B. Only those strategies that are not dominated by any other path constitute the optimal solution under multi-objective trade-off.

[0046] The optimal strategy combination is associated with the real-time resource state and the network topology to generate a defense strategy combination.

[0047] In this embodiment, the real-time resource state includes CPU core allocation and memory quota.

[0048] In order to dynamically update the defense strategy, after actual deployment, the protection effect indicators, attack blocking rate, false positive rate, response delay and energy efficiency, are monitored in real time and compared with the preset target threshold; if any indicator deviates from the target by more than the tolerance range, the adaptive feedback mechanism is triggered; Specifically, If the attack blocking rate decreases or the false positive rate increases, the rate limiting parameter (RATE_LIMIT) is automatically relaxed or tightened, and the fallback trigger threshold (FALLBACK) is adjusted; If the system resources are tight (CPU>80% or memory>75%) or the response delay is excessive, the high-overhead analysis step is prohibited according to the downgrade instruction, and dedicated cores are dynamically reassigned to the XDP layer blocking action; If the protection effect and resource utilization are within the target range, the current strategy combination is maintained unchanged; The new parameters after adaptation are mapped to the strategy template placeholders to generate a dynamic defense strategy; It should be noted that the real-time collected CPU utilization and memory utilization are compared with the preset threshold (such as CPU>80%, memory>75%), and if any indicator exceeds the limit, the resource state is determined to be "resource tight", otherwise it is "resource sufficient".

[0049] If it is "resource tight", generate a downgrade instruction: prohibit high-overhead steps (such as steps to collect current system CPU utilization, memory usage, and network bandwidth usage), allocate dedicated CPU cores to XDP layer blocking actions to isolate overhead, etc. Read the CPU core number and memory quota of each VLAN, as well as any downgrade instructions; at the same time, extract the risk level and corresponding assets of each network segment, and map the corresponding assets to specific network nodes and links based on network topology information, to build a network model with resource constraints and risk labels.

[0050] If it is "resource sufficient", combine network topology information to parse the physical switches or host nodes connected by the VLAN, and calculate the minimum CPU core number and memory quota required according to the risk level and business latency, to build a network model with resource constraints and risk labels.

[0051] At this point, by selecting the optimal solution, generating a defense strategy combination, deploying and executing, and adaptive feedback loop, the whole process from attack graph analysis to executable defense strategy is completed, and finally a dynamic defense strategy is obtained.

[0052] The embodiment of the application also provides an attack detection system of a gateway device, comprising: A network data packet acquisition module is configured to acquire network data packets; A data feature extraction module is used to extract a session identifier quintuple from a network data packet, copy a payload with a predefined maximum payload interception length in the network data packet into a ring buffer, and record a starting offset and a copy length of the payload in the ring buffer; In this embodiment, the session identifier quintuple includes: source IP, destination IP, source port, destination port, and protocol.

[0053] The original byte sequence acquisition module is used to read a preset byte payload from the ring buffer as the original byte sequence based on the starting offset and the copy length; Shannon entropy calculation module is used to count the byte distribution probability p(b) of the original byte sequence within the preset window, and calculate it through the formula Calculate the Shannon entropy ; Conditional entropy calculation module, used to count the frequency of adjacent byte pairs in the original byte sequence to obtain the conditional rate ;in, is the byte value at the current moment in the original byte sequence, is the byte value of the previous moment in the original byte sequence, and through the formula The conditional entropy H2 is calculated; It's important to note that to reduce computational load, the current CPU utilization, memory usage, and network bandwidth usage are obtained and compared with predefined thresholds. If any of these exceeds the threshold, resource constraints are considered. In this case, only the Shannon entropy is calculated, not the conditional entropy. In this case, only the Shannon entropy is used in subsequent calculations.

[0054] A key query module is used to query the preset reputation score database using the source IP in the quintuple as the key to obtain the corresponding autonomous system risk value, geographical area risk value, and historical attack hit count; Interval sequence calculation module, used to calculate the interval sequence using the formula d i =t i −t i−1 Calculate the arrival interval sequence d of adjacent data packets i ; where t i is the timestamp of the arrival of the i-th data packet, t i-1 The timestamp of the arrival of the i-1th data packet; The average arrival interval calculation module is used to calculate the average arrival interval using the formula Calculate the average arrival interval ; Variance calculation module, used to calculate the variance through the formula The tenth-order autocorrelation value is calculated; Spatial mapping module, used to convert Shannon entropy Shannon entropy H1, conditional entropy H2, autonomous system risk value, geographical region risk value, historical attack hit number, average inter-arrival interval, variance and tenth order autocorrelation value and tenth order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output; the encoder adopts an alternately stacked structure of multiple fully connected layers and normalization layers, and applies the same transformation matrix to each type of feature to ensure that the output protocol-independent feature vector is consistent in expression ability and dimension. After the mapping is completed, a fixed-length protocol-independent feature vector is obtained, which retains the original time sequence and load pattern and also fuses context risk information.

[0055] In order to reduce the noise interference caused by instantaneous fluctuation of traffic and improve the accuracy of attack detection, the method further includes: A smoothing module is configured to smooth the average inter-arrival interval , variance and tenth order autocorrelation value to obtain smoothed average inter-arrival interval, variance and tenth order autocorrelation value. Specifically, the smoothing module is specifically configured to use a given smoothing coefficient a to apply exponential weighted moving average smoothing S t =αx t +(1-α)S t-1 to the three items respectively. Wherein x t is the current window statistic, and S t−1 is the previous window smoothing value. The average inter-arrival interval, variance and tenth order autocorrelation value are respectively taken as different x t , and the smoothed average inter-arrival interval, variance and tenth order autocorrelation value are calculated.

[0056] In this case, the spatial mapping module is specifically configured to input the Shannon entropy , conditional entropy H2, autonomous system risk value, geographical region risk value, historical attack hit number, smoothed average inter-arrival interval, variance and tenth order autocorrelation value into a pre-trained shared encoder for spatial mapping, and output a protocol-independent feature vector.

[0057] The time sequence embedding sequence obtaining module is configured to input the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network, and the network bidirectional recurrent unit can capture the dependence relationship of the traffic in the front and rear time sequence, and output a time sequence embedding sequence. The periodicity representation calculating module is configured to continue stacking a fully connected network on the time sequence embedding sequence, and calculate a periodicity representation PRE by the formula PRE= wᵀ·(1 / T·∑t=1…Tht)+b; wherein wᵀ is a weight vector transpose of the fully connected network, ht is a bidirectional long short-term memory network hidden state at the tth time step, T is the total number of time steps, and b is a bias of the fully connected network.​​ a periodicity score calculation module configured to subtract a preset periodicity baseline mean from the periodicity representation PRE and divide the result by a preset periodicity standard deviation to obtain a periodicity score; a load entropy score calculation module configured to subtract a preset entropy baseline mean from the Shannon entropy and divide the result by a preset entropy standard deviation to obtain a load entropy score; a protocol flexibility score calculation module configured to subtract a preset protocol flexibility baseline mean from the number of protocol types in the quintuple and divide the result by a preset protocol flexibility standard deviation to obtain a protocol flexibility score; a score integration module configured to integrate the periodicity score, the load entropy score, and the protocol flexibility score into a core behavior feature vector a, which reflects the degree of deviation of the session flow from historical normal behavior; To emphasize potential anomalies, the following are further included: a periodicity score enhancement module configured to multiply the periodicity score by a preset amplification coefficient to obtain an enhanced periodicity score, if the periodicity representation PRE is greater than the preset periodicity baseline mean plus the preset periodicity standard deviation; a load entropy score enhancement module configured to multiply the load entropy score by a preset amplification coefficient to obtain an enhanced load entropy score, if the Shannon entropy is greater than the preset entropy baseline mean plus the preset entropy standard deviation; a protocol flexibility score enhancement module configured to multiply the protocol flexibility score by a preset amplification coefficient to obtain an enhanced protocol flexibility score, if the number of protocol types is greater than the preset protocol flexibility baseline mean plus the preset protocol flexibility standard deviation.

[0058] a cosine similarity calculation module configured to calculate the cosine similarity between the feature vector a and a pre-stored threat type vector bi by the formula cos_sim(a, bi) = (a · bi) / (‖a‖ × ‖bi‖), where a · bi is the inner product of the vectors, and ‖a‖ and ‖bi‖ are the L2 norms of the vectors; a weighted sum module configured to perform a weighted sum of the periodicity score, the load entropy score, and the protocol flexibility score to obtain a core aggregation score; a concatenation module configured to concatenate the cosine similarity and the core aggregation score into a comprehensive threat distribution vector v = [s1, s2,..., sn, G], where si is the cosine similarity of the i-th threat type vector, 1 ≤ i ≤ n, and G is the core aggregation score; a final threat type obtaining module configured to normalize the comprehensive threat distribution vector, obtain the maximum probability value in the normalized distribution as a preliminary confidence, and match to obtain a final threat type corresponding to the maximum probability value; The cross-protocol threat feature obtaining module is configured to integrate the final threat type, the maximum probability value, and the cosine similarity corresponding to the maximum probability value, the periodicity score, the payload entropy score, and the protocol flexibility score into a cross-protocol threat feature x. The Mahalanobis distance calculation module is configured to calculate a Mahalanobis distance D by a formula wherein μ is a preset mean vector, and Σ is a preset covariance matrix. The deviation degree score calculation module is configured to calculate a deviation degree score by a formula min(1, D / Dmax), wherein Dmax is a preset maximum allowable distance, that is, the Mahalanobis distance D is divided by the maximum allowable distance Dmax in the historical baseline and clipped to [0, 1] to obtain the deviation degree score.

[0059] The CPU utilization rate calculation module is configured to calculate a CPU utilization rate u_t at time t by a formula u_t=φ1*u_{t-1}+φ2 * u_{t-2}+ε_t+θ1*ε_{t-1}+θ2 *ε_{t-2}, wherein φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is white noise residual error. The CPU utilization rate statistical module is configured to count a proportion of the CPU utilization rates at N time points that exceed a set threshold value, and take the proportion as a CPU overload probability. Specifically, the CPU utilization rate statistical module is specifically configured to take the utilization rates u_t, u_{t−1} and the residual errors ε_t, ε_{t−1} at the current time T as a starting point, and calculate the utilization rates u_{t+1}, u_{t+2}, …, u_{t+5} at the next five time points in sequence through a recursive equation of the model, and the five values are the CPU utilization rate prediction values in the next 5 seconds. Then, a proportion of the five prediction values that exceed the threshold value of 85% is counted, and the proportion is taken as the CPU overload probability.

[0060] The time slope calculation module is configured to calculate a time slope β by a formula wherein t i is the memory utilization rate at the i-th second, is the mean value of time, is the mean value of the memory utilization rate, and m i is the memory utilization rate at the i-th second. The memory usage trend score obtaining module is configured to compare the time slope β with a set value to obtain a memory usage trend score. Specifically, when β>0.1% per second, it is determined as an “upward trend”; when β<-0.1% per second, it is determined as a “downward trend”; otherwise, it is determined as a “steady state”. In this embodiment, the “upward trend” corresponds to 1 point, the “downward trend” corresponds to 0 point, and the “steady state” corresponds to 0.5 point.

[0061] An attack graph construction module is configured to construct an attack graph with assets as nodes and paths as directed edges based on a preset exploit chain; A PageRank iteration module is configured to assign a maximum probability value to a corresponding source node in the attack graph as an initial weight of a PageRank algorithm; when the PageRank is iterated, the score of each node is updated according to the following formula: PR_i(t+1) = (1-d) / N + d*∑_{j→i}[PR_j(t) / outdeg(j)]; where PR_i(t+1) is the PageRank score of node i after the t+1 iteration, d is a damping factor, N is the total number of nodes in the attack graph, j→i is all predecessor nodes j pointing to node i, and outdeg(j) is the number of out-edges of node j; A total risk score calculation module is configured to calculate a total risk score according to the formula total risk score = feature application function(w d * deviation score + w c * (overload probability of CPU + memory usage trend score) + w s * max(PageRank score)); where w d , w c , and w s are preset weights; A risk level mapping module is configured to map a risk level after comparing the total risk score with a preset threshold; specifically, if the total risk score > 0.9, the risk level is unacceptable risk; if 0.7 < total risk score ≤ 0.9, the risk level is high risk; if 0.5 < total risk score ≤ 0.7, the risk level is medium risk; otherwise, the risk level is low risk.

[0062] A threat assessment result obtaining module is configured to integrate the risk level, the maximum probability value, and the final threat type into a final threat assessment result.

[0063] In order to obtain a recommended action of a threat event, the method further includes: A risk asset obtaining module is configured to compare the PageRank score of each node in the attack graph with a preset comparison threshold to obtain a corresponding asset with a PageRank score greater than the comparison threshold; A query module is configured to search for a corresponding subnet identifier and terminal device in the network topology information with the corresponding asset as a starting point; A policy template indexing module is configured to perform two-level indexing according to the risk level and the final threat type to obtain a matched policy template; An operation matching module is configured to query a preset database according to the risk level to obtain a matched execution level, a speed limit value, and a rollback strategy; The threat event recommended action obtaining module is configured to fill the subnet identifier, the terminal device, the risk level, the final threat type, the matched execution level, the speed limit value, and the rollback strategy into the policy template to obtain the recommended action of the threat event. In this case, the threat assessment result obtaining module is specifically configured to integrate the risk level, the maximum probability value, the final threat type, and the recommended action of the threat event into the final threat assessment result.

[0064] In the embodiment, the subnet identifier is used to limit the network segment range of the protection rule; all affected terminal devices in the subnet are used to explicitly specify the specific host to be protected / isolated in the policy; the risk level is used to let the template select a suitable execution level and severity; the final threat type is used to let the template load the special defense logic corresponding to the threat; and the maximum probability value is used to display the threat confidence in the log or alarm message if necessary.

[0065] In order to obtain the defense policy, the method further includes: The IP address mapping module is configured to map the IP address of the corresponding asset to the VLAN to which the asset belongs. The risk level obtaining module is configured to take the highest risk level of the mapped assets under each VLAN as the risk level of the VLAN; specifically, all the mapped assets under each VLAN are traversed, the corresponding risk levels of the assets are read, the highest risk level under the VLAN is taken out according to the risk levels from high to low, the maximum risk level of the subordinate assets is counted, and a priority ranking list of the VLANs is obtained. For example, assuming that there are asset A (“high risk”) and asset B (“unacceptable risk”) under VLAN 100, the risk level of VLAN 100 is determined as “unacceptable risk”; and there are asset C (“medium risk”) and asset D (“high risk”) under VLAN 200, the “high risk” is selected. After the maximum value selection of each VLAN is completed, all the VLANs are sorted according to their risk levels from high to low.

[0066] The CPU core number calculating module is configured to calculate the CPU core number of each VLAN by the formula CPU core number = ⌈1 x number of carried service n x risk factor corresponding to the risk level x time delay factor based on the service⌉, and round up the calculated CPU core number; The memory quota calculating module is configured to calculate the memory quota of each VLAN by the formula memory quota = ⌈base memory unit x number of carried service n x risk factor corresponding to the risk level x time delay factor based on the service⌉. A model construction module is configured to construct a network model with resource constraints and risk labels based on the number of CPU cores of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, corresponding assets, and network topology information. A Monte Carlo tree search module is configured to start a Monte Carlo tree search with the network model with resource constraints and risk labels as a root node. A cumulative return record integration module is configured to simulate a set action at each expansion node during the Monte Carlo tree search process, and calculate the attack blocking rate (the proportion of blocked malicious traffic), the false positive rate (the proportion of normal traffic mistakenly blocked), the response delay (the additional network delay affected by the action), and the energy efficiency (the calculation / memory overhead required by the new action) for each set action during the simulation process, and integrate the attack blocking rate, the false positive rate, the response delay, and the energy efficiency into a cumulative return record. The simulation continues until a preset number of iterations or convergence, and all paths and their cumulative return records are recorded. In this embodiment, the set actions include XDP blocking, token bucket rate limiting, honeypot redirection, etc.

[0067] An optimal strategy combination obtaining module is configured to filter out the optimal strategy combination in four dimensions of "blocking rate increase", "false positive rate decrease", "delay decrease", and "efficiency increase" from the cumulative return records. A defense strategy combination generation module is configured to associate the optimal strategy combination with real-time resource status and network topology to generate a defense strategy combination.

[0068] In this embodiment, the real-time resource status includes CPU core allocation and memory quota.

[0069] In order to dynamically update the defense strategy, the application further comprises: A defense strategy dynamic updating module is configured to monitor the protection effect indicators, i.e., the attack blocking rate, the false positive rate, the response delay, and the energy efficiency in real time, and compare them with preset target thresholds. If any indicator deviates from the target by more than a tolerance range, an adaptive feedback mechanism is triggered. The new parameters after adaptation are mapped to the strategy template placeholders to generate a dynamic defense strategy.

[0070] In summary, the embodiment of the application constructs a flexible and intelligent gateway self-protection system, and improves the overall security of the gateway device. The embodiment of the application is significantly superior to the prior art in terms of detection efficiency, accuracy, and resource consumption, and can significantly reduce operation and maintenance costs, providing an interpretable and scalable new practice for the gateway self-protection field.

[0071] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0073] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0074] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0075] Any details not described in the embodiments of the present invention are well-known to those skilled in the art. Finally, it should be noted that the above embodiments are only intended to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention may be modified or replaced with equivalents without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or equivalents should be included in the scope of the claims of the present invention.

Claims

1. A gateway device attack detection method, characterized in that: include: Get network data packets; Extracting a session identifier quintuple from the network data packet, copying a payload of a predefined maximum payload interception length in the network data packet into a ring buffer, and recording a starting offset and a copy length of the payload in the ring buffer; Reading a payload of preset bytes from the ring buffer as an original byte sequence based on the starting offset and the copy length; The byte distribution probability p(b) of the original byte sequence is counted in the preset window, and the formula is used Calculate the Shannon entropy ; Count the frequencies of adjacent byte pairs in the original byte sequence to obtain the conditional rate ;in, is the byte value at the current moment in the original byte sequence, is the byte value of the previous moment in the original byte sequence, and the formula The conditional entropy H2 is calculated; Using the source IP in the quintuple as a key, querying a preset reputation score database to obtain the corresponding autonomous system risk value, geographic area risk value, and historical attack hit count; By formula d i =t i −t i−1 Calculate the arrival interval sequence d of adjacent data packets i ; where t i is the timestamp of the arrival of the i-th data packet, t i-1 The timestamp of the arrival of the i-1th data packet; By formula Calculate the average arrival interval ; By formula Calculate the variance ; By formula The tenth-order autocorrelation value is calculated; The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographical area risk value, the number of historical attack hits, the average arrival interval , the variance and the tenth-order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output; Inputting the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network, and outputting a temporal embedding sequence; A fully connected network is stacked on the temporal embedding sequence, and a periodic representation PRE is calculated using the formula PRE = wᵀ (1 / T ∑t=1…Tht) + b; where wᵀ is the transposed weight vector of the fully connected network, ht is the hidden state of the bidirectional long short-term memory network at the t-th time step, T is the total number of time steps, and b is the bias of the fully connected network. The periodicity score is obtained by first subtracting a preset periodicity baseline mean from the periodicity representation PRE and then dividing the result by a preset periodicity standard deviation. The Shannon entropy is first subtracted from the preset entropy baseline mean, and then divided by the preset entropy standard deviation to obtain a load entropy score; The number of protocol types in the quintuple is first subtracted from the preset protocol flexibility baseline mean, and then divided by the preset protocol flexibility standard deviation to obtain a protocol flexibility score; Integrating the periodicity score, the load entropy score, and the protocol flexibility score into a core behavior feature vector a; The cosine similarity between the feature vector a and the pre-stored threat type vector is calculated using the formula cos_sim(a,bi)=(a·bi) / (‖a‖×‖bi‖); wherein bi is the pre-stored threat type vector; A core aggregation score is obtained by weighted summing the periodicity score, the load entropy score, and the protocol flexibility score; concatenating the cosine similarity and the core aggregate score into a comprehensive threat distribution vector; Normalizing the comprehensive threat distribution vector to obtain a maximum probability value in the normalized distribution, and matching to obtain a final threat type corresponding to the maximum probability value; Integrate the final threat type, the maximum probability value, and the cosine similarity, periodicity score, load entropy score, and protocol flexibility score corresponding to the maximum probability value into a cross-protocol threat feature x; By formula The Mahalanobis distance D is calculated; where μ is the preset mean vector and Σ is the preset covariance matrix; The deviation score is calculated using the formula min(1, D / Dmax); where Dmax is the preset maximum allowable distance; The CPU utilization u_t at time t is calculated using the formula u_t=φ1*u_{t-1}+φ2*u_{t-2}+ε_t+θ1*ε_{t-1}+θ2*ε_{t-2}. φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is the white noise residual. Count the proportion of CPU utilization exceeding a set threshold at N moments, and use the proportion as the CPU overload probability; By formula The time slope β is calculated; where t i is the i-th second, is the mean of time, is the mean memory utilization, m i is the memory utilization at the i-th second; Comparing the time slope β with a set value to obtain a memory usage trend score; Based on the preset vulnerability exploit chain, an attack graph is constructed with assets as nodes and paths as directed edges. The maximum probability value is assigned to the corresponding source node in the attack graph as the initial weight of the PageRank algorithm. During PageRank iteration, the score of each node is updated according to the following formula: PR_i(t+1)=(1-d) / N+d*Σ_{j→i}[PR_j(t) / outdeg(j)] Where PR_i(t+1) is the PageRank score of node i after the t+1th iteration, d is the damping factor, N is the total number of nodes in the attack graph, j→i is the number of predecessor nodes j pointing to node i, and outdeg(j) is the number of outgoing edges of node j; The overall risk score is calculated by the formula = feature application function (w d * Deviation score + w c *(CPU overload probability + memory usage trend score) + w s * max(PageRank score)) to calculate the overall risk score; where w d 、w c and w s is the preset weight; Comparing the overall risk score with a preset threshold to map out a risk level; The risk level, the maximum probability value, and the final threat type are integrated into a final threat assessment result.

2. The attack detection method for a gateway device according to claim 1, wherein: Also includes: The average arrival interval , the variance and the tenth-order autocorrelation value to obtain a smoothed average arrival interval, variance, and tenth-order autocorrelation value; The Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographical area risk value, the number of historical attack hits, the average arrival interval , the variance The tenth-order autocorrelation value is input into the pre-trained shared encoder for spatial mapping, and the protocol-independent feature vector is output, including: The Shannon entropy The conditional entropy H2, the autonomous system risk value, the geographic area risk value, the number of historical attack hits, the smoothed average arrival interval, variance and tenth-order autocorrelation value are input into the pre-trained shared encoder for spatial mapping, and the protocol-independent feature vector is output.

3. The attack detection method for a gateway device according to claim 1, wherein: Also includes: If the periodicity representation PRE>the preset periodicity baseline mean+the preset periodicity standard deviation, multiplying the periodicity score by a preset amplification factor to obtain a strengthened periodicity score; If the Shannon entropy is greater than the preset entropy baseline mean + the preset entropy standard deviation, the load entropy score is multiplied by a preset amplification factor to obtain the enhanced load entropy score; If the number of protocol types is greater than the preset protocol flexibility baseline mean + the preset protocol flexibility standard deviation, the protocol flexibility score is multiplied by a preset amplification factor to obtain an enhanced protocol flexibility score.

4. The attack detection method for a gateway device according to claim 1, wherein: Also includes: Compare the PageRank score of each node in the attack graph with a preset comparison threshold, and obtain corresponding assets whose PageRank scores are greater than the comparison threshold; Taking the corresponding asset as a starting point, searching for the corresponding subnet identifier and terminal device in the network topology information; Performing two-level indexing based on the risk level and the final threat type to obtain a matching policy template; Querying a preset database according to the risk level to obtain a matching execution level, speed limit value, and fallback strategy; Filling the subnet identifier, the terminal device, the risk level, the final threat type, the matching execution level, the rate limit value, and the fallback policy into the policy template to obtain a recommended action for the threat event; The integrating the risk level, the maximum probability value, and the final threat type into a final threat assessment result includes: The risk level, the maximum probability value, the final threat type, and the recommended action for the threat event are integrated into a final threat assessment result.

5. The attack detection method for a gateway device according to claim 4, wherein: Also includes: Mapping the IP address of the corresponding asset to the VLAN to which it belongs; The highest risk level of the assets mapped to each VLAN is used as the risk level of the VLAN; The number of CPU cores per VLAN is calculated using the formula: Number of CPU cores = ⌈1 × Number of services carried n × Risk factor corresponding to the risk level × Service-based delay factor ⌉; The memory quota for each VLAN is calculated using the formula: Memory quota = ⌈Basic memory unit × number of services carried n × risk factor corresponding to the risk level × service-based delay factor ⌉; Construct a network model with resource constraints and risk tags based on the number of CPU cores of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, the corresponding assets, and the network topology information; Starting a Monte Carlo tree search with the network model with resource constraints and risk markers as the root node; During the Monte Carlo tree search process, a set action is simulated at each expansion node, and during the simulation process, an attack blocking rate, a false alarm rate, a response delay, and an energy efficiency are calculated for each set action, and the attack blocking rate, the false alarm rate, the response delay, and the energy efficiency are integrated into a cumulative reward record; The simulation continues until the preset number of iterations or convergence, and all paths and their cumulative rewards are recorded; Filtering the optimal strategy combination in the four dimensions of "increased blocking rate", "decreased false alarm rate", "decreased latency", and "increased efficiency" from the cumulative return records; The optimal strategy combination is associated with the real-time resource status and network topology to generate a defense strategy combination.

6. A gateway device attack detection system, characterized in that: include: A network data packet acquisition module, used to acquire network data packets; a data feature extraction module, configured to extract a session identifier quintuple from the network data packet, copy a payload of a predefined maximum payload interception length in the network data packet into a ring buffer, and record a starting offset and a copy length of the payload in the ring buffer; an original byte sequence acquisition module, configured to read a payload of preset bytes from the ring buffer as an original byte sequence based on the starting offset and the copy length; The Shannon entropy calculation module is used to count the byte distribution probability p(b) of the original byte sequence within a preset window and calculate it through the formula Calculate the Shannon entropy ; The conditional entropy calculation module is used to count the frequencies of adjacent byte pairs in the original byte sequence to obtain the conditional rate ;in, is the byte value at the current moment in the original byte sequence, is the byte value of the previous moment in the original byte sequence, and the formula The conditional entropy H2 is calculated; A key query module is used to query a preset reputation score database using the source IP in the quintuple as a key to obtain the corresponding autonomous system risk value, geographic area risk value and historical attack hit count; Interval sequence calculation module, used to calculate the interval sequence using the formula d i =t i −t i−1 Calculate the arrival interval sequence d of adjacent data packets i ; where t i is the timestamp of the arrival of the i-th data packet, t i-1 The timestamp of the arrival of the i-1th data packet; The average arrival interval calculation module is used to calculate the average arrival interval using the formula Calculate the average arrival interval ; Variance calculation module, used to calculate the variance through the formula Calculate the variance ; The tenth-order autocorrelation value calculation module is used to calculate the The tenth-order autocorrelation value is calculated; Spatial mapping module, used to convert the Shannon entropy , the conditional entropy H2, the autonomous system risk value, the geographical area risk value, the number of historical attack hits, the average arrival interval , the variance and the tenth-order autocorrelation value are input into a pre-trained shared encoder for spatial mapping, and a protocol-independent feature vector is output; A time series embedding sequence acquisition module is used to input the protocol-independent feature vector into a pre-trained bidirectional long short-term memory network and output a time series embedding sequence; A periodic representation calculation module is used to stack a layer of fully connected network on the temporal embedding sequence and calculate the periodic representation PRE using the formula PRE = wᵀ (1 / T ∑t=1…Tht) + b; where wᵀ is the transposed weight vector of the fully connected network, ht is the hidden state of the bidirectional long short-term memory network at the t-th time step, T is the total number of time steps, and b is the bias of the fully connected network; a periodicity score calculation module, configured to first subtract a preset periodicity baseline mean from the periodicity representation PRE, and then divide the result by a preset periodicity standard deviation to obtain a periodicity score; A load entropy score calculation module is used to first subtract a preset entropy baseline mean from the Shannon entropy and then divide it by a preset entropy standard deviation to obtain a load entropy score; a protocol flexibility score calculation module, configured to obtain a protocol flexibility score by first subtracting a preset protocol flexibility baseline mean from the number of protocol types in the quintuple and then dividing the result by a preset protocol flexibility standard deviation; a score integration module, configured to integrate the periodicity score, the load entropy score, and the protocol flexibility score into a core behavior feature vector a; A cosine similarity calculation module is used to calculate the cosine similarity between the feature vector a and the pre-stored threat type vector using the formula cos_sim(a,bi)=(a·bi) / (‖a‖×‖bi‖); wherein bi is the pre-stored threat type vector; a weighted summation module, configured to perform weighted summation of the periodicity score, the load entropy score, and the protocol flexibility score to obtain a core aggregation score; a splicing module, configured to splice the cosine similarity and the core aggregate score into a comprehensive threat distribution vector; a final threat type acquisition module, configured to normalize the comprehensive threat distribution vector, obtain a maximum probability value in the normalized distribution, and match the final threat type corresponding to the maximum probability value; a cross-protocol threat signature acquisition module, configured to integrate the final threat type, the maximum probability value, and the cosine similarity, periodicity score, load entropy score, and protocol flexibility score corresponding to the maximum probability value into a cross-protocol threat signature x; The Mahalanobis distance calculation module is used to calculate the distance through the formula The Mahalanobis distance D is calculated; where μ is the preset mean vector and Σ is the preset covariance matrix; The deviation score calculation module is used to calculate the deviation score using the formula min(1, D / Dmax); wherein Dmax is the preset maximum allowable distance; The CPU utilization calculation module is used to calculate the CPU utilization u_t at time t using the formula u_t=φ1*u_{t-1}+φ2*u_{t-2}+ε_t+θ1*ε_{t-1}+θ2*ε_{t-2}. φ1 and φ2 are autoregressive coefficients, θ1 and θ2 are moving average coefficients, and ε_t is the white noise residual. A CPU utilization statistics module is used to count the proportion of CPU utilization exceeding a set threshold at N moments and use the proportion as the CPU overload probability; Time slope calculation module, used to calculate the time slope through the formula The time slope β is calculated; where t i is the i-th second, is the mean of time, is the mean memory utilization, m i is the memory utilization at the i-th second; a memory usage trend score obtaining module, configured to compare the time slope β with a set value to obtain a memory usage trend score; The attack graph construction module is used to construct an attack graph with assets as nodes and paths as directed edges based on the preset vulnerability exploitation chain; A PageRank iteration module is configured to assign the maximum probability value to the corresponding source node in the attack graph as the initial weight of the PageRank algorithm. During PageRank iteration, the score of each node is updated according to the following formula: PR_i(t+1)=(1-d) / N+d*Σ_{j→i}[PR_j(t) / outdeg(j)]; wherein PR_i(t+1) is the PageRank score of node i after the t+1th iteration, d is the damping factor, N is the total number of nodes in the attack graph, j→i is all predecessor nodes j pointing to node i, and outdeg(j) is the number of outgoing edges of node j. The overall risk score calculation module is used to calculate the overall risk score by the formula: overall risk score = feature application function (w d * Deviation score + w c *(CPU overload probability + memory usage trend score) + w s * max(PageRank score)) to calculate the overall risk score; where w d 、w c and w s is the preset weight; A risk level mapping module, configured to compare the overall risk score with a preset threshold and then map the risk level; The threat assessment result obtaining module is used to integrate the risk level, the maximum probability value, and the final threat type into a final threat assessment result.

7. The attack detection system for a gateway device according to claim 6, wherein: Also includes: Smoothing module for the average arrival interval , the variance and the tenth-order autocorrelation value to obtain a smoothed average arrival interval, variance, and tenth-order autocorrelation value; The spatial mapping module is specifically used to convert the Shannon entropy The conditional entropy H2, the autonomous system risk value, the geographic area risk value, the number of historical attack hits, the smoothed average arrival interval, variance and tenth-order autocorrelation value are input into the pre-trained shared encoder for spatial mapping, and the protocol-independent feature vector is output.

8. The attack detection system for a gateway device according to claim 6, wherein: Also includes: a periodicity score enhancement module, configured to multiply the periodicity score by a preset amplification factor to obtain an enhanced periodicity score if the periodicity representation PRE is greater than the preset periodicity baseline mean value + the preset periodicity standard deviation; A load entropy score enhancement module is configured to multiply the load entropy score by a preset amplification factor to obtain an enhanced load entropy score if the Shannon entropy is greater than the preset entropy baseline mean value + the preset entropy standard deviation; The protocol flexibility score enhancement module is configured to multiply the protocol flexibility score by a preset amplification factor to obtain an enhanced protocol flexibility score if the number of protocol types is greater than the preset protocol flexibility baseline mean + the preset protocol flexibility standard deviation.

9. The attack detection system for a gateway device according to claim 6, wherein: Also includes: a risk asset acquisition module, configured to compare the PageRank score of each node in the attack graph with a preset comparison threshold, and obtain corresponding assets whose PageRank scores are greater than the comparison threshold; A query module, configured to search for a corresponding subnet identifier and terminal device in the network topology information, starting from the corresponding asset; A policy template indexing module, configured to perform two-level indexing based on the risk level and the final threat type to obtain a matching policy template; An operation matching module is used to query a preset database according to the risk level to obtain a matching execution level, speed limit value and fallback strategy; A recommended action acquisition module for a threat event, configured to fill the subnet identifier, the terminal device, the risk level, the final threat type, the matching execution level, the rate limit value, and the fallback policy into the policy template to obtain a recommended action for the threat event; The threat assessment result obtaining module is specifically configured to integrate the risk level, the maximum probability value, the final threat type, and the recommended action for the threat event into a final threat assessment result.

10. The attack detection system for a gateway device according to claim 9, wherein: Also includes: An IP address mapping module, configured to map the IP address of the corresponding asset to the VLAN to which it belongs; A risk level acquisition module is used to use the highest risk level of the assets mapped under each VLAN as the risk level of the VLAN; The CPU core number calculation module is used to calculate the number of CPU cores for each VLAN using the formula: CPU core number = ⌈1 × number of services carried n × risk factor corresponding to the risk level × service-based delay factor ⌉; The memory quota calculation module is used to calculate the memory quota of each VLAN using the formula: memory quota = ⌈ basic memory unit × number of services carried n × risk factor corresponding to the risk level × service-based delay factor ⌉; A model building module is used to build a network model with resource constraints and risk tags based on the number of CPU cores of each VLAN, the memory quota of each VLAN, the risk level of each VLAN, the corresponding assets, and the network topology information; A Monte Carlo tree search module, configured to start a Monte Carlo tree search with the network model with resource constraints and risk markers as a root node; a cumulative reward record integration module, configured to simulate a set action at each expansion node during the Monte Carlo tree search process, and calculate, for each set action, an attack blocking rate, a false alarm rate, a response delay, and an energy efficiency, and integrate the attack blocking rate, the false alarm rate, the response delay, and the energy efficiency into a cumulative reward record; and after the simulation continues for a preset number of iterations or convergence, record all paths and their cumulative reward records; An optimal strategy combination acquisition module is used to screen out the optimal strategy combination in the four dimensions of "blocking rate increase", "false alarm rate decrease", "delay decrease" and "efficiency increase" from the cumulative return records; The defense strategy combination generating module is used to associate the optimal strategy combination with the real-time resource status and network topology to generate a defense strategy combination.

Images