Network security situation awareness method based on deep learning

Abstract

The invention discloses a network security situation awareness method based on deep learning, and the method comprises the following steps: carrying out the unified structure processing and time alignment of multi-source data, and generating a standardized high-dimensional sample; constructing a disturbance sample set through disturbance sampling, executing low-dimensional embedding by utilizing multiple groups of orthogonal random projection functions, and generating a disturbance embedding matrix; constructing a stability map based on the disturbance path similarity between the samples; constructing an attack type coding matrix by adopting an error correction output coding model and training a plurality of binary sub-classifiers to realize robust multi-class attack recognition; and finally, outputting an optimal attack type label through the ECOC model, and generating a network security situation map in combination with the map. Aiming at the problems of low data processing efficiency and weak identification capability of a multi-source heterogeneous network, the invention provides a situation modeling path fusing disturbance sampling, random projection and an ECOC model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security situation awareness method based on deep learning. BACKGROUND

[0002] With the continuous development of large-scale network infrastructure and the increasing diversification of network attack means, network security situation awareness has become an important technical direction to ensure the safe operation of critical information systems. Currently, real-time collection and analysis of multi-source heterogeneous network data often rely on deep learning models to identify patterns in high-dimensional inputs, and attack type recognition and situation analysis are achieved with the help of graph structures or classification models.

[0003] Existing network situation awareness technologies have the following significant limitations: on the one hand, in the face of high-dimensional, complex and dynamically changing data environment, existing models generally lack robustness and cannot accurately capture the behavior stability of samples under perturbation, which easily leads to attack recognition results sensitive to input perturbation; on the other hand, most of the mainstream multi-classification methods rely on traditional independent classifier training mechanism and lack structured coding design, which is difficult to support efficient fault-tolerant classification under large-scale attack label space, and the prediction results do not have global consistency and repairability.

[0004] Therefore, how to provide a network security situation awareness method based on deep learning is a problem that those skilled in the art need to solve. SUMMARY

[0005] One object of the present application is to provide a network security situation awareness method based on deep learning. The present application generates perturbation samples using a perturbation sampling function, realizes perturbation embedding mapping through orthogonal random projection, constructs a stability atlas, and combines an error correction output coding model (ECOC) to perform fault-tolerant identification of network attack types, and finally generates a network security situation map. The present application combines perturbation robust modeling and structured fault-tolerant classification technology, and has the advantages of strong stability, accurate identification, and high fault-tolerant classification capability.

[0006] The network security situation awareness method based on deep learning according to the embodiment of the present application comprises the following steps:

[0007] Collecting multi-source heterogeneous data in the network environment, performing structure unification processing and time alignment, and generating standardized high-dimensional sample sequences;

[0008] Calling a perturbation sampling function on the standardized high-dimensional sample sequences to generate a perturbation sample set, and establishing an index mapping relationship between the perturbation samples and the corresponding standardized samples;

[0009] Calling a plurality of orthogonal random projection functions on the perturbation sample set to respectively perform linear embedding mapping, and generating corresponding low-dimensional perturbation embedding matrices;

[0010] Based on the low-dimensional perturbation embedding matrix, a perturbation similarity graph structure is constructed, the nodes in the graph are embedded samples, and the edge weight represents the perturbation path similarity, forming a stability graph;

[0011] An ECOC model is called to construct a binary coding matrix covering all attack types, and multiple binary sub-classifiers are trained based on the binary coding matrix, and all classifiers take the nodes in the stability graph as input samples;

[0012] The output results of all sub-classifiers are spliced into a predicted code word, the ECOC model is called to perform Hamming distance matching and fault tolerance recovery on the predicted code word, and the optimal attack type label is output;

[0013] The attack type label is mapped back to the standardized high-dimensional sample sequence through indexing, and a network security situation map is generated combining the path relationship in the stability graph.

[0014] Optionally, the generation of the standardized high-dimensional sample sequence includes structure unification processing and time alignment operation, the structure unification processing includes field mapping, format conversion and vector splicing, and the time alignment operation includes timestamp sorting, sliding window segmentation and window merging.

[0015] Optionally, the generation of the perturbation sample set includes:

[0016] The perturbation strategy parameters of the perturbation sampling function are set, the perturbation strategy parameters include the perturbation type, the perturbation amplitude range and the perturbation action dimension ratio, the perturbation type is used to define the generation mode of the perturbation increment, the perturbation amplitude range is used to limit the perturbation value size interval, and the perturbation action dimension ratio is used to control the number of feature dimensions participating in the perturbation in each standardized high-dimensional sample;

[0017] For each standardized high-dimensional sample in the standardized high-dimensional sample sequence, a perturbation increment vector is generated according to the set perturbation strategy parameters, and the perturbation increment vector and the standardized high-dimensional sample are added in the selected perturbation action dimension to generate a corresponding perturbation sample, and all perturbation samples form a perturbation sample set.

[0018] For each perturbation sample in the perturbation sample set, an index binding relationship with the corresponding standardized high-dimensional sample is established, and a perturbation index mapping table is constructed.

[0019] Optionally, the generation of the low-dimensional perturbation embedding matrix includes:

[0020] Set the target embedding dimension and the number of calls, and generate multiple orthogonal random projection function groups based on the set target embedding dimension. Each orthogonal random projection function group consists of multiple orthogonal random vectors. Each orthogonal random vector has the same dimension as the sample vector in the perturbation sample set. The orthogonal random vectors are constructed by random initialization and orthogonalization. All orthogonal random projection function groups together constitute a mapping structure for low-dimensional embedding.

[0021] For each perturbed sample vector in the perturbed sample set, all orthogonal random projection function groups are called in sequence, and matrix multiplication operations are performed on the perturbed sample vector and the orthogonal random vectors in each group respectively. The linear embedding operation of the perturbed sample vector into the low-dimensional subspace is completed in the linear space, and the corresponding low-dimensional embedding representation vector is output;

[0022] The low-dimensional embedding representation vectors of all perturbed samples in the perturbed sample set are numbered in the order of the perturbed samples, and the embedding representation vectors corresponding to each orthogonal random projection function group are concatenated to construct a joint low-dimensional expression structure corresponding to the number of perturbed samples;

[0023] The joint low-dimensional expression structure of all perturbation samples is arranged in rows to form a low-dimensional perturbation embedding matrix, where each row corresponds to a joint embedding vector of a perturbation sample, and each column corresponds to an embedding dimension value output by an orthogonal random projection function group.

[0024] Optionally, the formation stability map includes:

[0025] Receiving a low-dimensional perturbation embedding matrix, taking each row of embedding vectors in the low-dimensional perturbation embedding matrix as a feature representation of a perturbation sample, and constructing a perturbation sample node set, wherein each perturbation sample node in the perturbation sample node set corresponds one-to-one to a perturbation sample in the perturbation sample set;

[0026] Constructing a disturbance sample node pair set in the disturbance sample node set, and combining all disturbance sample nodes in the disturbance sample node set in pairs to generate a disturbance sample node pair set;

[0027] For each set of perturbation sample nodes in the perturbation sample node pair set, the perturbation similarity calculation function is called based on the corresponding low-dimensional perturbation embedding vector to calculate the perturbation similarity score between the perturbation sample nodes;

[0028] Set the perturbation similarity connection condition, establish a connection edge for the perturbation sample node pairs whose perturbation similarity score values ​​meet the set threshold condition, and the edge weight of the connection edge is the corresponding perturbation similarity score value. All connection edges that meet the connection condition constitute a perturbation connection edge set;

[0029] The disturbance sample node set and the disturbance connection edge set are combined to construct a disturbance similarity graph structure, which is a weighted undirected graph, the nodes of which are all the disturbance sample nodes in the disturbance sample node set, and the edges of which are all the connection edges in the disturbance connection edge set.

[0030] Optionally, constructing the binary coding matrix covering all attack types comprises:

[0031] All the disturbance sample nodes in the stability graph are received, the original attack labels in the standardized high-dimensional sample sequence corresponding to each disturbance sample node are extracted, the types of all the attack labels are counted, and an attack label number index set is constructed, which is used to define a classification label space.

[0032] The coding length parameter of the binary coding matrix is set, and a binary coding matrix with a dimension of attack type label quantity x coding length is generated according to the attack type label index set and the set coding length parameter, each row of the binary coding matrix corresponds to an attack type label, each column corresponds to a binary sub-classification task, and the matrix elements only take values +1 or -1, which are used to indicate the positive or negative category attribution of the attack type label in the corresponding binary sub-classification task.

[0033] The ECOC model initialization module is called, the binary coding matrix is received as the model input structure, and a plurality of binary sub-classifiers are initialized, each binary sub-classifier corresponding to a column of the binary coding matrix to form a sub-classifier set.

[0034] The disturbance sample node set in the stability graph is called, the low-dimensional disturbance embedding vector corresponding to each disturbance sample node is taken as a training input sample, and the attack type label corresponding to the disturbance sample is mapped to a plurality of binary label values through the binary coding matrix, which are taken as the training output sample of each binary sub-classifier.

[0035] The training process is performed on each binary sub-classifier, the training data pair is composed of the low-dimensional disturbance embedding vector of the disturbance sample and the corresponding binary label value, all the binary sub-classifiers are trained in parallel, and the trained binary sub-classifier set is output.

[0036] Optionally, outputting the optimal attack type label comprises:

[0037] The trained binary sub-classifier set is received, which is composed of a plurality of binary sub-classifiers, each binary sub-classifier corresponding to a column of the binary coding matrix.

[0038] The low-dimensional disturbance embedding vector corresponding to the disturbance sample to be classified is input into each binary sub-classifier in the binary sub-classifier set, the prediction output values of all the binary sub-classifiers are obtained, and the prediction output values are +1 or -1.

[0039] sequentially splicing all the prediction output values in the order of column index in the binary coding matrix to construct a prediction code word, the prediction code word has the same dimension as the number of columns of the binary coding matrix, and is used to represent the coding structure of the to-be-classified perturbation sample in all binary classification tasks;

[0040] calling the ECOC model, receiving the prediction code word, calculating the Hamming distance between the prediction code word and each coding row based on all attack type label encodings in the binary coding matrix, the Hamming distance representing the number of bit differences between the prediction code word and the attack type label encoding;

[0041] selecting the attack type label encoding row index corresponding to the minimum value in all Hamming distances, and mapping the coding row index to the target attack type label by calling the attack type label index mapping table, the target attack type label being the optimal attack type label of the current perturbation sample;

[0042] If there are multiple coding row indexes with the same minimum Hamming distance, calling the fault tolerance recovery module in the ECOC model to select the optimal attack type label from the candidate attack type labels according to a preset priority discrimination rule.

[0043] Optionally, generating the network security situation map comprises:

[0044] receiving the optimal attack type labels corresponding to all perturbation samples, and mapping the perturbation sample index of each perturbation sample node to the standardized high-dimensional sample index in the corresponding standardized high-dimensional sample sequence by calling the perturbation index mapping table;

[0045] performing a merging operation on the sample indexes of all perturbation sample nodes that have completed label mapping to establish a correspondence table between the standardized high-dimensional sample indexes and the optimal attack type labels;

[0046] combining the perturbation similarity connection relationship of each perturbation sample node in the stability atlas, mapping each connection edge in the stability atlas to the relationship edge between the standardized high-dimensional samples by calling the perturbation index mapping table, and constructing a set of association paths between the standardized high-dimensional samples;

[0047] binding the attack type labels of the samples at both ends of each relationship edge in the set of association paths of the standardized high-dimensional samples, and recording the attack state transition features between the samples in each connection edge;

[0048] constructing a network security situation map based on the standardized high-dimensional samples, the attack type labels, and the attack state transition features, wherein the nodes of the network security situation map are the standardized high-dimensional samples, the edges are the attack state transition relationships between the samples, and an attack type label state field is additionally attached to each node.

[0049] The beneficial effects of the present application are:

[0050] (1) The present application enhances the diversity and robustness of sample generation by introducing a perturbation sampling function and a perturbation strategy parameter control mechanism, so that the system can still maintain stable discrimination ability when facing small sample or boundary fuzzy attack types, significantly improving the modeling adaptability and attack recognition accuracy of multi-source heterogeneous network data.

[0051] (2) The present application performs linear embedding mapping on the perturbation samples by using multiple sets of orthogonal random projection functions, effectively compressing high-dimensional feature information while preserving the stability of the perturbation structure, and combining with a perturbation similarity calculation function to construct a stability atlas, realizing efficient fusion and discriminative expression of high-dimensional network flow data under low resource conditions.

[0052] (3) The present application uses the ECOC model to construct a binary encoding matrix and train multiple binary sub-classifiers, combines Hamming distance matching and fault tolerance recovery mechanism of predicted code words, realizes the structured, multi-redundancy discriminative path of attack recognition task in large class space, and improves the classification fault tolerance and prediction consistency in the case of complex inter-class distribution.

[0053] (4) The present application generates a network security situation map based on the index mapping relationship between the perturbation samples and the standardized high-dimensional samples, combined with the path connection information in the graph structure, enhances the traceability and explainability of the situation awareness process, and improves the controllability and trustworthiness of the system in the network security practical environment. BRIEF DESCRIPTION OF DRAWINGS

[0054] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation on the present application. In the drawings:

[0055] Fig. 1 The flowchart of the network security situation awareness method based on deep learning proposed by the present application;

[0056] Fig. 2 The structure diagram of the ECOC model encoding matrix construction and binary sub-classifier training proposed by the present application;

[0057] Fig. 3 The structure diagram of the low-dimensional perturbation embedding matrix generation proposed by the present application. DETAILED DESCRIPTION

[0058] The present application will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, and only illustrate the basic structure of the present application in a schematic manner, and therefore only show the components related to the present application.

[0059] REFERENCE Figs. 1-3, a deep learning-based network security situation awareness method, comprising the following steps:

[0060] Collecting multi-source heterogeneous data in a network environment, performing structure unification processing and time alignment, and generating standardized high-dimensional sample sequences;

[0061] Calling a perturbation sampling function on the standardized high-dimensional sample sequences to generate a perturbation sample set, and establishing an index mapping relationship between the perturbation samples and the corresponding standardized samples;

[0062] Calling a plurality of orthogonal random projection functions on the perturbation sample set to respectively perform linear embedding mapping and generate corresponding low-dimensional perturbation embedding matrices;

[0063] Constructing a perturbation similarity graph structure based on the low-dimensional perturbation embedding matrices, with nodes in the graph being embedded samples and edge weights representing perturbation path similarity, forming a stability graph;

[0064] Calling an ECOC model to construct a binary coding matrix covering all attack types, training a plurality of binary sub-classifiers based on the binary coding matrix, and taking the nodes in the stability graph as input samples for all classifiers;

[0065] Splicing the output results of all sub-classifiers into a predicted code word, calling the ECOC model to perform Hamming distance matching and fault tolerance recovery on the predicted code word, and outputting an optimal attack type label;

[0066] Mapping the attack type label back to the standardized high-dimensional sample sequence through the index, and generating a network security situation graph combining the path relationship in the stability graph.

[0067] In the embodiment, the generation of the standardized high-dimensional sample sequence includes structure unification processing and time alignment operations, the structure unification processing includes field mapping, format conversion and vector splicing, and the time alignment operation includes timestamp sorting, sliding window division and window merging.

[0068] In the embodiment, the generation of the perturbation sample set includes:

[0069] Setting perturbation strategy parameters of the perturbation sampling function, the perturbation strategy parameters including a perturbation type, a perturbation amplitude range and a perturbation action dimension ratio, the perturbation type being used to define a generation mode of a perturbation increment, the perturbation amplitude range being used to limit a perturbation value size interval, and the perturbation action dimension ratio being used to control the number of feature dimensions participating in perturbation in each standardized high-dimensional sample;

[0070] For each standardized high-dimensional sample in the standardized high-dimensional sample sequence, a perturbation increment vector is generated according to the set perturbation strategy parameters, and the perturbation increment vector and the standardized high-dimensional sample are subjected to additive processing on the selected perturbation action dimensions to generate a corresponding perturbation sample, and all perturbation samples constitute a perturbation sample set.

[0071] An index binding relationship is established for each perturbation sample in the perturbation sample set and the corresponding standardized high-dimensional sample, a perturbation index mapping table is constructed, and the perturbation index mapping table records the number of each standardized high-dimensional sample in the standardized high-dimensional sample sequence and the storage location of the corresponding perturbation sample in the perturbation sample set;

[0072] The perturbation sample set is used as an input sample for subsequent low-dimensional embedding mapping, and the perturbation index mapping table is used as an index path basis for attack type label backtracking and network security situation map generation, so as to realize structural mapping and prediction result tracking between the perturbation sample and the standardized high-dimensional sample.

[0073] In the embodiment, the generation of the low-dimensional perturbation embedding matrix comprises:

[0074] A target embedding dimension and a call number are set, a plurality of orthogonal random projection function groups are generated based on the set target embedding dimension, each orthogonal random projection function group is composed of a plurality of orthogonal random vectors, each orthogonal random vector has the same dimension as a sample vector in the perturbation sample set, and the orthogonal random vector is constructed through random initialization and orthogonalization processing, and all orthogonal random projection function groups together form a mapping structure for low-dimensional embedding;

[0075] For each perturbation sample vector in the perturbation sample set, all orthogonal random projection function groups are called in sequence, and matrix multiplication operations are performed on the perturbation sample vector and the orthogonal random vectors in each group, respectively, to complete linear embedding operations of the perturbation sample vector to a low-dimensional subspace in a linear space, and output corresponding low-dimensional embedding representation vectors;

[0076] The low-dimensional embedding representation vectors of all perturbation samples in the perturbation sample set are numbered in the order of the perturbation samples, and the embedding representation vectors are spliced respectively corresponding to each orthogonal random projection function group, to construct a joint low-dimensional expression structure corresponding to the number of perturbation samples;

[0077] All joint low-dimensional expression structures of the perturbation samples are arranged in rows to form a low-dimensional perturbation embedding matrix, each row of the low-dimensional perturbation embedding matrix corresponds to a joint embedding vector of a perturbation sample, and each column corresponds to an embedding dimension value output by an orthogonal random projection function group;

[0078] The linear embedding operation refers to projecting each high-dimensional perturbation sample vector in the perturbation sample set to a subspace with lower dimension through a preset set of orthogonal random projection functions, specifically, inputting the perturbation sample vector as a column vector, performing matrix multiplication operation with a projection matrix composed of the corresponding set of orthogonal random projection functions, and mapping to a low-dimensional embedding vector, thereby maintaining the geometric relationship structure between the perturbation samples, each set of orthogonal random projection functions taking a set of mutually orthogonal random vectors as a projection basis, and the linear embedding operation completes the conversion from the original feature space to the target low-dimensional space through the mapping space composed of the projection basis, so that the high-dimensional perturbation samples maintain sufficient distinguishability in the low-dimensional space and have a unified vector representation structure.

[0079] In the embodiment, the forming of the stability graph includes:

[0080] Receiving the low-dimensional perturbation embedding matrix, taking each row embedding vector in the low-dimensional perturbation embedding matrix as a feature representation of one perturbation sample, and constructing a perturbation sample node set, each perturbation sample node in the perturbation sample node set corresponding to one perturbation sample in the perturbation sample set;

[0081] Constructing a perturbation sample node pair set in the perturbation sample node set, combining all the perturbation sample nodes in the perturbation sample node set in pairs to generate the perturbation sample node pair set;

[0082] For each group of perturbation sample nodes in the perturbation sample node pair set, calling a perturbation similarity calculation function based on the corresponding low-dimensional perturbation embedding vector to calculate the perturbation similarity score value between the perturbation sample nodes;

[0083] Setting a perturbation similarity connection condition, establishing a connection edge for the perturbation sample node pair that satisfies the set threshold condition, and the edge weight of the connection edge is the corresponding perturbation similarity score value, and all connection edges that satisfy the connection condition constitute a perturbation connection edge set;

[0084] Combining the perturbation sample node set and the perturbation connection edge set to construct a perturbation similarity graph structure, the perturbation similarity graph structure being a weighted undirected graph, the nodes being all the perturbation sample nodes in the perturbation sample node set, the edges being all the connection edges in the perturbation connection edge set, and the edge weight being used to represent the structural stability measurement between the perturbation samples;

[0085] Taking the perturbation similarity graph structure as a graph structure representation form of the stability graph, and taking the stability graph as an input structure of a plurality of binary sub-classifiers in an error correction output coding model, to provide spatial correlation information between the perturbation samples;

[0086] The perturbation similarity calculation function is used to measure the structural similarity between the perturbation sample nodes in the low-dimensional embedding space, and the perturbation similarity calculation function is based on the low-dimensional perturbation embedding vector pair corresponding to the perturbation sample nodes to perform similarity score calculation. The perturbation similarity calculation function can adopt a cosine similarity function or a Euclidean distance function. When the cosine similarity function is adopted, the similarity score value is obtained by calculating the cosine value of the unit vector angle of the two embedding vectors. When the Euclidean distance function is adopted, the similarity score value is obtained by calculating the distance between the two embedding vectors in the Euclidean space and combining the set distance conversion function to map to the similarity score. The output of the perturbation similarity calculation function is a normalized score value, which is limited in the interval [0, 1] and is used to represent the structural proximity between the perturbation sample nodes.

[0087] The set threshold condition is used to determine whether to establish a connection edge between the perturbation sample nodes in the perturbation similar graph structure. The threshold condition is set based on the score result of the perturbation similarity calculation function, and is used to divide the determination boundary of high-similarity sample pairs and low-similarity sample pairs. Specifically, the threshold condition can be set in a static manner or a dynamic adaptive manner. In the static setting manner, the threshold value is an empirical constant value, such as 0.85 or 0.9, which is suitable for the scene where the sample space distribution is stable. In the dynamic adaptive manner, the threshold value is calculated based on the mean, standard deviation or quantile point of the set of perturbation similarity scores, such as the fourth quantile or the mean plus one standard deviation as the determination threshold. All perturbation sample node pairs with a score greater than or equal to the threshold value will be connected by an edge and included in the perturbation connection edge set, and the remaining sample pairs will not be connected.

[0088] In this embodiment, the binary coding matrix covering all attack types is constructed as follows:

[0089] All perturbation sample nodes in the stability atlas are received, and the original attack label in the standardized high-dimensional sample sequence corresponding to each perturbation sample node is extracted. The types of all attack labels are counted, and an attack label number index set is constructed, which is used to define a classification label space.

[0090] The coding length parameter of the binary coding matrix is set, and a binary coding matrix with dimensions of attack type label quantity x coding length is generated according to the attack type label index set and the set coding length parameter. Each row in the binary coding matrix corresponds to an attack type label, and each column corresponds to a binary sub-classification task. The matrix elements only take values +1 or -1, which are used to indicate the positive or negative category of the attack type label in the corresponding binary sub-classification task.

[0091] The ECOC model initialization module is called to receive a binary coding matrix as a model input structure, initialize a plurality of binary sub-classifiers, each binary sub-classifier corresponding to a column of the binary coding matrix, and form a sub-classifier set;

[0092] The set of perturbed sample nodes in the stability graph is called, the low-dimensional perturbation embedding vector corresponding to each perturbed sample node is taken as a training input sample, and the attack type label corresponding to the perturbed sample is mapped into a plurality of binary label values through a binary coding matrix, which are taken as training output samples of each binary sub-classifier.

[0093] The training process is performed on each binary sub-classifier, the training data pair is composed of the low-dimensional perturbation embedding vector of the perturbed sample and the corresponding binary label value, all binary sub-classifiers are trained in parallel, and the trained binary sub-classifier set is output.

[0094] In the embodiment, outputting the optimal attack type label includes:

[0095] The trained binary sub-classifier set is received, the binary sub-classifier set is composed of a plurality of binary sub-classifiers, and each binary sub-classifier corresponds to a column in the binary coding matrix.

[0096] The low-dimensional perturbation embedding vector corresponding to the to-be-classified perturbed sample is input into each binary sub-classifier in the binary sub-classifier set, the prediction output values of all binary sub-classifiers are obtained, and the prediction output values are +1 or -1.

[0097] All prediction output values are sequentially spliced in the order of column index in the binary coding matrix to construct a prediction code word, the prediction code word has a dimension consistent with the number of columns of the binary coding matrix, and is used to represent the coding structure of the to-be-classified perturbed sample in all binary classification tasks.

[0098] The ECOC model is called to receive the prediction code word, calculate the Hamming distance between the prediction code word and each coding row in the binary coding matrix based on all attack type label encodings in the binary coding matrix, and the Hamming distance represents the number of bit differences between the prediction code word and the attack type label encoding.

[0099] The index of the attack type label encoding corresponding to the minimum value in all Hamming distances is selected, the attack type label index mapping table is called to map the coding row index to a target attack type label, and the target attack type label is the optimal attack type label of the current perturbed sample.

[0100] If there are a plurality of coding row indexes with the same minimum Hamming distance, a fault tolerance recovery module in the ECOC model is called to select the optimal attack type label from the candidate attack type labels according to a preset priority discrimination rule.

[0101] The calculation of the Hamming distance between the predicted codeword and each coding row refers to: for the predicted codeword vector generated by the current perturbation sample, a bit-by-bit comparison is performed with the coding row vector corresponding to each attack type label in the binary coding matrix, and the number of bits with inconsistent signs in the same dimensional position of the two vectors is counted as the Hamming distance value corresponding to the attack type label. Specifically, let the predicted codeword vector be P = [p1, p2, ..., p n ], a coding row vector is C=[c1,c2,...,c n ], then the Hamming distance d H (P, C) is defined as in each dimension from i = 1 to n, if p i ≠c i The count is then increased by one, and the final total count is the Hamming distance between the predicted codeword and the coding line. After calculating the corresponding Hamming distances for all coding lines, the result is used to select the attack type label corresponding to the minimum value;

[0102] The preset priority discrimination rule means that when there are multiple attack type labels with the same and minimum Hamming distance values, in order to avoid ambiguity in the classification results, the system needs to select a unique output label from the candidate labels based on a set of predefined rules. The priority discrimination rule may include but is not limited to the following strategies: according to the sorting order of the attack type labels in the label number index set, the ones with smaller numbers are given priority; according to the statistical distribution of the frequency of occurrence of the corresponding coding lines in the historical training samples, the labels with higher frequencies are given priority; or the labels with the best scores are selected based on the comprehensive evaluation scores of the response strength of each sub-classifier during the training process of the perturbation samples.

[0103] In this embodiment, generating a network security situation map includes:

[0104] Receive the optimal attack type labels corresponding to all perturbation samples, call the perturbation index mapping table, and map the perturbation sample index of each perturbation sample node to the standardized high-dimensional sample index in the corresponding standardized high-dimensional sample sequence;

[0105] Perform a merge operation on the sample indexes that have completed label mapping in all perturbation sample nodes, and establish a correspondence table between the standardized high-dimensional sample index and the optimal attack type label. The correspondence table is used to identify the attack type label status of each standardized high-dimensional sample;

[0106] Combined with the perturbation similarity connection relationship of each perturbation sample node in the stability graph, the perturbation index mapping table is called to map each connection edge in the stability graph to a relationship edge between standardized high-dimensional samples, and a set of association paths between standardized high-dimensional samples is constructed;

[0107] For each relationship edge in the association path set of the standardized high-dimensional sample, the attack type label of the sample at both ends of the edge is bound respectively, and the attack state transition characteristics between the samples are recorded in each connection edge;

[0108] Based on the standardized high-dimensional sample, the attack type label and the attack state transition characteristics, a network security situation map is constructed, the nodes of the network security situation map are the standardized high-dimensional samples, the edges are the attack state transition relationships between the samples, and an attack type label state field is attached to each node.

[0109] Embodiment 1:

[0110] In order to verify the feasibility of the application in implementation, the application is applied to the enterprise-level network environment deployed by a certain key infrastructure operation enterprise. The security management personnel faces an increasingly complex network attack threat. In order to improve the accuracy of network attack detection and the real-time response, the enterprise decides to introduce the “network security situation awareness method based on deep learning” proposed by the application as the core detection framework, and combines the actual network operation environment for deployment and verification.

[0111] The network environment covers office networks, industrial control subnets and DMZ areas accessing the Internet. The network topology contains about 1200 terminal devices and 85 border security devices. The amount of raw traffic log and behavior event data generated every day is about 210GB. The data sources include IDS system, network flow log, host log, user behavior data and access control policy and other heterogeneous data sources.

[0112] In the deployment stage, by collecting the above-mentioned multi-source heterogeneous network data, first, the structure uniform processing and time alignment operation are performed to generate about 470,000 standardized high-dimensional samples. Each sample contains a vector representation with a dimension of 1024 generated by field mapping and vector splicing, covering communication behavior statistics, connection sequence characteristics, user operation path and other dimensions. Subsequently, the system calls the perturbation sampling function to generate perturbations under the strategy of Gaussian perturbation, perturbation amplitude [0.01, 0.05] and perturbation action dimension ratio 0.3, constructs a perturbation sample set of the same size, and establishes a perturbation index mapping table to facilitate subsequent label mapping and situation tracking.

[0113] In the low-dimensional mapping stage, the system sets the target embedding dimension to 64, calls 8 sets of orthogonal random projection functions, each set containing 64 orthogonal random vectors, performs linear projection on the perturbation samples to generate low-dimensional perturbation embedding matrices, and uses them to construct perturbation similarity graph structures. In the stability graph, each node represents a low-dimensional representation of a perturbation sample, and the edge represents the structural similarity between the perturbation samples. The graph structure dependence between the samples is constructed by calculating the cosine similarity function with a threshold value of 0.85.

[0114] The ECOC module receives the attack type label extracted by the stability graph node, generates a binary coding matrix (a total of 12 attack types, and the coding length is 15), and initializes 15 sub-classifiers. The training data is composed of node low-dimensional embedding vectors and mapped binary labels. After multiple rounds of training, the training accuracy of all sub-classifiers reaches more than 98%.

[0115] In the test phase, in the continuous five-day operation, the system accumulatively receives about 90,000 newly generated disturbance samples, sequentially calls the trained sub-classifiers, generates the predicted code word, performs the ECOC model Hamming distance matching, outputs the optimal attack type label corresponding to the disturbance sample, and maps the label back to the standardized high-dimensional sample in combination with the disturbance index mapping table. In combination with the graph structure of the stability graph, the network security situation graph between the standardized high-dimensional samples is finally generated.

[0116] The situation graph has good attack propagation path restoration ability, and significantly improves the horizontal penetration detection ability. In order to verify the effectiveness of the method, the running data in operation is selected, and the traditional random forest detection method and the non-disturbance embedding method are compared and tested respectively, and the results are shown in Table 1:

[0117] Table 1 Comparison table of network attack recognition accuracy

[0118]

[0119] Table 2 Attack path recognition coverage rate statistical table (five-day cumulative)

[0120]

[0121]

[0122] Through in-depth analysis of the experimental data in Table 1 and Table 2, it can be seen that the network security situation awareness method based on the disturbance generation, orthogonal random projection mapping and ECOC multi-classification fusion mechanism proposed in the application is significantly superior to the traditional method in multiple core indicators. In Table 1, the method of the application realizes a daily average attack recognition accuracy of 97.81%, which is about 6.49 percentage points higher than the traditional deep method without disturbance embedding, and 10.57 percentage points higher than the traditional random forest model, showing stronger adaptability to complex sample structure and disturbance robustness. In terms of false alarm rate and false negative rate, the method of the application is 1.02% and 1.17% respectively, which is significantly better than other methods, indicating that it has stronger discrimination ability and error tolerance. Especially, in the horizontal attack detection rate index, the method of the application reaches 93.64%, which is much higher than the 72.01% of the non-disturbance deep method and the 61.86% of the traditional model, verifying the effectiveness of the stability graph structure in modeling the attack diffusion path.

[0123] Further analysis in combination with Table 2, in the task of reconstructing the attack chain in the lateral penetration attack, the method of the present application can restore the attack chain length by 4.8 nodes on average, which is much higher than the 3.9-4.1 nodes of the traditional method, and the proportion of identifiable nodes is as high as 92.7%, which is significantly higher than the 73.6% of the undisturbed method, indicating that the system can capture more potential diffusion nodes. In addition, the identification rate of the attack entry of the present application reaches 100%, that is, all attack starting points are successfully detected, and the identification accuracy rate of the attack endpoint is 94.2%, which reflects the system's ability to restore the complete attack path and the accuracy of identifying the terminal behavior. In summary, the present application is significantly superior to existing methods in multiple key performance indicators, fully verifying its practical value and technical advancement in the actual complex network environment.

[0124] The above describes only the preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art within the technical scope disclosed by the present application, according to the technical solution and inventive concept of the present application, makes equivalent replacement or changes, which should be covered within the protection scope of the present application.

Claims

1. A network security situation awareness method based on deep learning, characterized by: include: Collect multi-source heterogeneous data in a network environment, perform structural unification processing and time alignment, and generate standardized high-dimensional sample sequences; The perturbation sampling function is called on the standardized high-dimensional sample sequence to generate a perturbation sample set, and an index mapping relationship is established between the perturbation samples and the corresponding standardized samples; Call multiple sets of orthogonal random projection functions on the perturbation sample set, perform linear embedding mapping respectively, and generate the corresponding low-dimensional perturbation embedding matrix; A perturbation similarity graph structure is constructed based on a low-dimensional perturbation embedding matrix. The nodes in the graph are embedded samples, and the edge weights represent the similarity of the perturbation paths, forming a stability graph. Call the ECOC model to construct a binary encoding matrix covering all attack types, and train multiple binary sub-classifiers based on the binary encoding matrix. All classifiers use nodes in the stability graph as input samples. All sub-classifier output results are spliced ​​into predicted codewords. The ECOC model is called to perform Hamming distance matching and fault-tolerant recovery on the predicted codewords, and the optimal attack type label is output. The attack type labels are mapped back to the standardized high-dimensional sample sequence through indexing, and the network security situation map is generated by combining the path relationship in the stability map.

2. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: The generation of the standardized high-dimensional sample sequence includes structural unification processing and time alignment operations. The structural unification processing includes field mapping, format conversion and vector splicing. The time alignment operation includes timestamp sorting, sliding window segmentation and window merging.

3. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: Generating a disturbance sample set includes: Set the perturbation strategy parameters of the perturbation sampling function, which include the perturbation type, perturbation amplitude range, and perturbation dimension ratio. The perturbation type is used to define the generation mode of the perturbation increment, the perturbation amplitude range is used to limit the perturbation value size interval, and the perturbation dimension ratio is used to control the number of feature dimensions involved in the perturbation in each standardized high-dimensional sample. For each standardized high-dimensional sample in the standardized high-dimensional sample sequence, a perturbation increment vector is generated according to the set perturbation strategy parameters, and the perturbation increment vector is added to the standardized high-dimensional sample in the selected perturbation dimension to generate the corresponding perturbation sample. All perturbation samples constitute a perturbation sample set; An index binding relationship is established for each perturbed sample in the perturbation sample set and the corresponding standardized high-dimensional sample, and a perturbation index mapping table is constructed.

4. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: Generating a low-dimensional perturbation embedding matrix includes: Set the target embedding dimension and the number of calls, and generate multiple orthogonal random projection function groups based on the set target embedding dimension. Each orthogonal random projection function group consists of multiple orthogonal random vectors. Each orthogonal random vector has the same dimension as the sample vector in the perturbation sample set. The orthogonal random vectors are constructed by random initialization and orthogonalization. All orthogonal random projection function groups together constitute a mapping structure for low-dimensional embedding. For each perturbed sample vector in the perturbed sample set, all orthogonal random projection function groups are called in sequence, and matrix multiplication operations are performed on the perturbed sample vector and the orthogonal random vectors in each group respectively. The linear embedding operation of the perturbed sample vector into the low-dimensional subspace is completed in the linear space, and the corresponding low-dimensional embedding representation vector is output; The low-dimensional embedding representation vectors of all perturbed samples in the perturbed sample set are numbered in the order of the perturbed samples, and the embedding representation vectors corresponding to each orthogonal random projection function group are concatenated to construct a joint low-dimensional expression structure corresponding to the number of perturbed samples; The joint low-dimensional expression structure of all perturbation samples is arranged in rows to form a low-dimensional perturbation embedding matrix, where each row corresponds to a joint embedding vector of a perturbation sample, and each column corresponds to an embedding dimension value output by an orthogonal random projection function group.

5. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: The formation stability profile comprises: Receiving a low-dimensional perturbation embedding matrix, taking each row of embedding vectors in the low-dimensional perturbation embedding matrix as a feature representation of a perturbation sample, and constructing a perturbation sample node set, wherein each perturbation sample node in the perturbation sample node set corresponds one-to-one to a perturbation sample in the perturbation sample set; Constructing a disturbance sample node pair set in the disturbance sample node set, and combining all disturbance sample nodes in the disturbance sample node set in pairs to generate a disturbance sample node pair set; For each set of perturbation sample nodes in the perturbation sample node pair set, the perturbation similarity calculation function is called based on the corresponding low-dimensional perturbation embedding vector to calculate the perturbation similarity score between the perturbation sample nodes; Set the perturbation similarity connection condition, establish a connection edge for the perturbation sample node pairs whose perturbation similarity score values ​​meet the set threshold condition, and the edge weight of the connection edge is the corresponding perturbation similarity score value. All connection edges that meet the connection condition constitute a perturbation connection edge set; The perturbation sample node set and the perturbation connection edge set are combined to construct a perturbation similarity graph structure, where the perturbation similarity graph structure is a weighted undirected graph, whose nodes are all perturbation sample nodes in the perturbation sample node set and whose edges are all connection edges in the perturbation connection edge set.

6. The method for network security situation awareness based on deep learning according to claim 1, characterized in that: Constructing a binary coding matrix covering all attack types includes: Receive all perturbation sample nodes in the stability map, extract the original attack label in the standardized high-dimensional sample sequence corresponding to each perturbation sample node, count all attack label types, and construct an attack label number index set, which is used to define the classification label space; Set the encoding length parameter of the binary encoding matrix. Based on the attack type label index set and the set encoding length parameter, generate a binary encoding matrix with the dimension of the number of attack type labels × encoding length. Each row in the binary encoding matrix corresponds to an attack type label, and each column corresponds to a binary sub-classification task. The matrix elements only take the values ​​of +1 or -1, which are used to indicate whether the attack type label belongs to the positive or negative category in the corresponding binary sub-classification task. Call the ECOC model initialization module, receive the binary encoding matrix as the model input structure, initialize multiple binary sub-classifiers, each binary sub-classifier corresponds to a column of the binary encoding matrix, and form a sub-classifier set; Call the set of perturbation sample nodes in the stability map, use the low-dimensional perturbation embedding vector corresponding to each perturbation sample node as the training input sample, and map the attack type label corresponding to the perturbation sample into multiple binary label values ​​through the binary encoding matrix, which are used as the training output samples of each binary sub-classifier; The training process is performed on each binary sub-classifier. The training data pair consists of the low-dimensional perturbation embedding vector of the perturbation sample and the corresponding binary label value. All binary sub-classifiers are trained in parallel, and the set of trained binary sub-classifiers is output.

7. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: The output optimal attack type labels include: receiving a trained binary sub-classifier set, wherein the binary sub-classifier set consists of a plurality of binary sub-classifiers, each of which corresponds to a column in a binary encoding matrix; Input the low-dimensional perturbation embedding vector corresponding to the perturbation sample to be classified into each binary sub-classifier in the binary sub-classifier set, and obtain the predicted output value of all binary sub-classifiers, where the predicted output value is +1 or –1; Concatenate all predicted output values ​​in the order of column indices in the binary coding matrix to construct a predicted codeword. The predicted codeword dimension is consistent with the number of columns in the binary coding matrix, and is used to represent the coding structure of the perturbation sample to be classified in all binary classification tasks. Call the ECOC model, receive the predicted codeword, and calculate the Hamming distance between the predicted codeword and each encoding row based on all attack type label encoding rows in the binary encoding matrix. The Hamming distance represents the number of bit differences between the predicted codeword and the attack type label encoding. Select the attack type label encoding row index corresponding to the minimum value among all Hamming distances, call the attack type label index mapping table, and map the encoding row index to the target attack type label. The target attack type label is the optimal attack type label for the current perturbation sample. If there are multiple coding row indices with the same minimum Hamming distance, the fault-tolerant recovery module in the ECOC model is called to select the optimal attack type label from the candidate attack type labels according to the preset priority judgment rules.

8. The network security situation awareness method based on deep learning according to claim 1 is characterized in that: Generating a network security situation map includes: Receive the optimal attack type labels corresponding to all perturbation samples, call the perturbation index mapping table, and map the perturbation sample index of each perturbation sample node to the standardized high-dimensional sample index in the corresponding standardized high-dimensional sample sequence; Merge the sample indexes of all perturbation sample nodes that have completed label mapping, and establish a corresponding relationship table between the standardized high-dimensional sample index and the optimal attack type label; Combined with the perturbation similarity connection relationship of each perturbation sample node in the stability graph, the perturbation index mapping table is called to map each connection edge in the stability graph to a relationship edge between standardized high-dimensional samples, and a set of association paths between standardized high-dimensional samples is constructed; For each relationship edge in the association path set of standardized high-dimensional samples, the attack type labels of the samples at both ends of the edge are bound respectively, and the attack state transition characteristics between the samples are recorded in each connection edge; Based on standardized high-dimensional samples, attack type labels, and attack state transition characteristics, a network security situation map is constructed. The nodes of the network security situation map are standardized high-dimensional samples, the edges are the attack state transition relationships between samples, and an attack type label status field is attached to each node.

Images