Communication data analysis system and method for network security

Abstract

The invention discloses a communication data analysis system and method for network security, and relates to the technical field of computer internet. Time sequence features, protocol semantic features and interactive topology features of communication session historical data are extracted based on network flow data; the method comprises the following steps of: acquiring a time sequence feature, a protocol semantic feature and an interactive topology feature, fusing the time sequence feature, the protocol semantic feature and the interactive topology feature into a unified high-dimensional feature vector, acquiring a communication behavior record and a communication behavior dynamic feature vector of network equipment in a communication network, calculating a digital feature of a coupling relationship evaluation value, and when a certain communication session occurs, judging whether the communication session occurs or not. The method comprises the following steps of: calculating real-time coupling relationship evaluation values among network equipment, quantifying the difference degree of the real-time coupling relationship evaluation values through digital characteristics, accumulating the coupling relationship evaluation values in the process of performing a certain communication session, calculating the total anomaly degree of the communication session, and calculating the abnormal degree of the communication session. The method aims at solving the problems that advanced persistent threats are difficult to effectively recognize, feature expression is insufficient and the perceptual ability is weak in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer internet, in particular to a communication data analysis system and method for network security. BACKGROUND

[0002] With the rapid development of information technology and the increasing popularity of network infrastructure, network space has deeply integrated into various aspects of social production and daily life, and the data volume and business complexity it carries have shown explosive growth. Correspondingly, network space security threats have also evolved, with attack methods becoming diversified, concealed and sophisticated, posing unprecedented challenges to the safe and stable operation of various information systems.

[0003] In the prior art, the mainstream network security detection mechanism mainly relies on rule matching or simple statistical threshold-based methods. For example, the rule matching mechanism based on predefined signatures encodes the characteristics of known threats into a series of static patterns. However, with the continuous evolution of network environment and the increasing sophistication of attack methods, the method based on static rules or simple statistics gradually reveals inherent limitations that are difficult to overcome. In the modern network environment, massive communication traffic presents complex characteristics of high dimensionality, high dynamics and multi-protocol interweaving. Attackers can easily evade detection by protocol obfuscation, traffic fragmentation, slow penetration or malicious communication using legitimate service ports, which makes the behavior characteristics of malicious traffic deviate from the preset rules, resulting in "unknown threats" becoming a blind area for security protection.

[0004] Therefore, how to construct a communication data analysis method that can effectively extract and fuse the multi-dimensional dynamic characteristics of communication sessions, assess the coupling relationship between communication behaviors of network entities through fine-grained modeling, and on this basis, efficiently and accurately identify new network attacks with strong concealment and complex behavior patterns, has become a key challenge and technical problem to be solved for those skilled in the art. SUMMARY

[0005] The purpose of the present application is to provide a communication data analysis system and method for network security to solve the problems in the prior art.

[0006] To achieve the above purpose, the present application provides the following technical scheme: a communication data analysis method for network security, the method comprising: S1, extracting the time sequence characteristics, protocol semantic characteristics and interaction topology characteristics of communication session history data based on network flow data, and fusing the time sequence characteristics, protocol semantic characteristics and interaction topology characteristics into a unified high-dimensional feature vector, and taking the high-dimensional feature vector as a communication behavior dynamic feature vector; S2, collect the communication behavior record and the communication behavior dynamic feature vector of the network device in the communication network, and quantitatively calculate the similarity, communication frequency and protocol diversity evaluation value of the network device; S3: collect the historical communication behavior and historical communication data of the network device, calculate the coupling relationship evaluation value between the network devices according to the quantitatively calculated communication behavior, and calculate the digital features of the coupling relationship evaluation value; S4: when a communication session occurs, calculate the real-time coupling relationship evaluation value between the network devices, quantitatively calculate the difference of the real-time coupling relationship evaluation value through the digital features, accumulate the coupling relationship evaluation value during the communication session, and calculate the total abnormality of the communication session; S5, set an alarm threshold to evaluate the total abnormality of the communication session, and alarm when the total abnormality exceeds the alarm threshold.

[0007] Further, S1 includes: Step S1-1: obtaining all network devices in a certain network region, collecting all network devices into a network device set Sall, obtaining network stream data in a certain network region, and the network stream data including source IP address, destination IP address, source port, destination port, protocol type, transmission byte number, packet number and timestamp information; Step S1-2: analyzing and preprocessing the communication session between the network devices, extracting the time sequence features of the communication session, and the time sequence features including: session duration, data transmission rate, data packet interval time statistics, session start time, session end time and session frequency in a preset unit time period; Step S1-3: performing protocol analysis on each communication session to extract the protocol semantic features of the communication session, and the protocol semantic features including: application layer protocol type, protocol field statistics, protocol header feature, flag bit distribution and load entropy value; Step S1-4: obtaining the network topology relationship of all network devices in a certain network region, and extracting the interaction topology features of the communication session, and the interaction topology features including: the number of other network devices connected by each network device, session directionality, the role played by the network device in the network, communication path length and network hop number; Step S1-5: converting the protocol semantic features and the interaction topology features into feature values by feature coding or obtaining the corresponding relationship between the protocol semantic features and the interaction topology features and the feature values from a related knowledge base, respectively, splicing the data in the time sequence features, and forming a high-dimensional feature vector , wherein, as the dynamic feature vector of a certain communication session s at t moment.

[0008] Further, S2 includes: Step S2-1: Obtain the i-th network device Ei and the j-th network device Ej in the network device set, wherein the network device Ei and the network device Ej have at least one communication session in a unit time period, and the high-dimensional feature vectors of the two network devices are obtained as V1 and V2 respectively after any communication session between the network device Ei and the network device Ej, and the similarity of V1 and V2 is calculated as sim(V1, V2); Step S2-2: Obtain the number Nij of communication sessions between the network device Ei and the network device Ej in a unit time period, and obtain the number Nim of communication sessions between the network device Ei and the m-th network device Em in the network device set in a unit time period, and normalize the number of communication sessions between the network device Ei and the network device Ej in a unit time period to obtain the normalized frequency Freq(Ei, Ej) of the network device Ei and the network device Ej in a unit time period; wherein M represents the total number of network devices in the network device set; Step S2-3: Collect all communication protocols of communication sessions between the network device Ei and the network device Ej in a unit time period to form a communication protocol set, and calculate the protocol diversity evaluation value Ent(Ei, Ej) through the frequency of each communication protocol in a unit time period, wherein the frequency of the p-th communication protocol in a unit time period is denoted as P(p). wherein q represents the total number of communication protocols in the communication protocol set.

[0009] Further, S3 includes: Step S3-1: Establish the coupling relationship evaluation value R(Ei, Ej) of the network device Ei and the network device Ej, wherein w1, w2 and w3 are weight coefficients of the similarity, the normalized frequency and the protocol diversity evaluation value respectively, and w1+w2+w3=1. Step S3-2: Collect communication session history data corresponding to several unit time periods, calculate the coupling relationship evaluation value corresponding to each unit time period respectively, and calculate the average value μ and the variance σ of all coupling relationship evaluation values 2 .

[0010] Further, S4 includes: Step S4-1: Record the time of detecting a certain communication session s in the communication session of the current network device Ei and the network device Ej as the target time τ, obtain a unit time period including the target time as the target time period, and calculate the coupling relationship evaluation value of the network device Ei and the network device Ej in the target time period as R(Ei, Ej, τ); Step S4-2: Obtain the average value and variance of the coupling relationship evaluation value, quantify the abnormal degree of the coupling relationship evaluation value in the target time period, and calculate the abnormal degree quantization value A(s, τ) of the current communication session, ; Step S4-3: Obtain the duration interval [Tstart, Tend] of a communication session s, where Tstart represents the start time of a communication session s, and Tend represents the end time of a communication session s. Divide the duration interval into N equal time subintervals, select a time point in each time subinterval as a sampling time point, and calculate the abnormal degree quantization value corresponding to each sampling time point. The abnormal degree quantization value corresponding to the kth time subinterval is denoted as A(s, t k ), and the abnormal degree quantization value corresponding to the k-1th time subinterval is denoted as A(s, t k-1 ), where t k represents the sampling time point corresponding to the kth time subinterval, and t k-1 represents the sampling time point corresponding to the k-1th time subinterval. Step S4-4: Calculate the total abnormality TA of the target time period, .

[0011] In order to better realize the above method, a communication data analysis system for network security is also proposed, which comprises a multi-dimensional feature extraction module, a behavior quantization module, a coupling relationship modeling module, a dynamic anomaly evaluation module and an alarm decision module. The multi-dimensional feature extraction module is used to extract the time sequence features, protocol semantic features and interaction topology features of the communication session history data based on the original network flow data, and fuse the time sequence features, protocol semantic features and interaction topology features into a unified high-dimensional feature vector, which is used as a communication behavior dynamic feature vector. The behavior quantization module is used to collect the communication behavior records and communication behavior dynamic feature vectors of network devices in the communication network, and to quantize the communication behavior to calculate the similarity, communication frequency and protocol diversity evaluation values of the network devices. The coupling relationship modeling module is used to collect the historical communication behavior and historical communication data of the network devices, calculate the coupling relationship evaluation values between the network devices according to the quantized communication behavior, and calculate the numerical features of the coupling relationship evaluation values. The dynamic anomaly evaluation module is used to calculate the real-time coupling relationship evaluation values between the network devices when a communication session occurs, and to quantify the difference of the real-time coupling relationship evaluation values through the numerical features. The total abnormality of the communication session is calculated by accumulating the coupling relationship evaluation values during the communication session. The alarm decision module is used to set an alarm threshold to evaluate the total abnormality of the communication session, and to alarm when the total abnormality exceeds the alarm threshold.

[0012] Further, the multi-dimensional feature extraction module includes a data collection unit, a time sequence feature extraction unit, a protocol semantic feature extraction unit, an interaction topology feature extraction unit, and a feature fusion unit. The data collection unit is configured to collect all network devices in a certain network region, aggregate the network devices into a network device set, and collect network flow data in the certain network region, the network flow data including source IP address, destination IP address, source port, destination port, protocol type, transmission byte number, packet number, and timestamp information. The time sequence feature extraction unit is configured to analyze and preprocess a communication session between network devices, and extract time sequence features of the communication session, the time sequence features including session duration, data transmission rate, packet interval time statistics, session start time, session end time, and session frequency in a preset unit time period. The protocol semantic feature extraction unit is configured to perform protocol analysis on each communication session to extract protocol semantic features of the communication session, the protocol semantic features including application layer protocol type, protocol field statistics, protocol header feature, flag bit distribution, and load entropy value. The interaction topology feature extraction unit is configured to obtain a network topology relationship of all network devices in a certain network region, and extract interaction topology features of the communication session, the interaction topology features including a number of other network devices connected to each network device, session directionality, a role played by the network device in the network, communication path length, and network hop number. The feature fusion unit is configured to convert the protocol semantic features and the interaction topology features into feature values by feature encoding or obtaining a correspondence between the protocol semantic features and the interaction topology features and the feature values from a related knowledge base, and splice the feature values with data in the time sequence features to form a high-dimensional feature vector.

[0013] Further, the device behavior quantification module includes a similarity calculation unit, a frequency normalization unit, and a protocol diversity evaluation unit. The similarity calculation unit is configured to obtain high-dimensional feature vectors of two network devices respectively after any communication session occurs between the network devices, and calculate a similarity of the high-dimensional feature vectors. The frequency normalization unit is configured to normalize a number of communication sessions of a network device in a unit time period to obtain a normalized frequency of the network device in the unit time period. The protocol diversity evaluation unit is configured to collect all communication protocols of communication sessions between network devices in a unit time period to form a communication protocol set, and calculate a protocol diversity evaluation value through a frequency of each communication protocol in the unit time period.

[0014] Further, the coupling relationship modeling module includes a coupling evaluation unit and a statistical feature calculation unit. The coupling evaluation unit is configured to establish a coupling relationship evaluation value between network devices; and the statistical feature calculation unit is configured to collect communication session history data corresponding to a plurality of unit time periods, calculate the coupling relationship evaluation value corresponding to each unit time period, and calculate the mean and variance of all coupling relationship evaluation values.

[0015] Further, the dynamic anomaly evaluation module comprises a real-time coupling calculation unit, an anomaly quantification unit, a session division unit, and a total anomaly degree calculation unit. The real-time coupling calculation unit is configured to record a time point of detecting a certain communication session in a current communication session as a target time point, obtain a unit time period including the target time point as a target time period, and calculate the coupling relationship evaluation value of the network device within the target time period; the anomaly quantification unit is configured to obtain the mean and variance of the coupling relationship evaluation value, quantize the coupling relationship evaluation value of the target time period, and calculate the anomaly degree quantification value of the current communication session; the session division unit is configured to obtain the duration interval of a certain communication session, divide the duration interval into N equal-length time subintervals, select a time point in each time subinterval as a sampling time point, take the time subinterval as a time period corresponding to the sampling time point, and calculate the anomaly degree quantification value corresponding to each sampling time point; and the total anomaly degree calculation unit is configured to calculate the total anomaly degree of the target time period.

[0016] Compared with the prior art, the present application has the following advantages: 1. By fusing the time sequence feature, the protocol semantic feature, and the interaction topology feature, a high-dimensional, multi-source, and heterogeneous dynamic feature vector is constructed, the present application can comprehensively and finely depict the behavior mode of the communication session, and overcomes the limitations of the single feature expression and the lack of correlation in the traditional method, so that more complex and hidden attack features can be captured; 2. The coupling relationship evaluation mechanism based on the feature similarity, the communication frequency, and the protocol diversity is introduced, the deep behavior correlation and dependency relationship between network devices can be deeply revealed, the normal and abnormal interaction modes can be effectively distinguished, and the shortage of the traditional method in capturing the deep semantic correlation in the multi-dimensional and high-dynamic scene is made up; 3. By establishing the historical baseline of the normal behavior coupling relationship between network devices, and quantifying the difference between the communication session and the baseline in real time, the present application can effectively identify new and hidden attack behaviors such as variant attacks, zero-day exploit, slow penetration, and persistent threats, which cannot be detected by the traditional signature matching or simple statistical threshold method. The cumulative calculation of the total anomaly degree is especially good at finding low-speed and complex attacks that are not conspicuous in the short term but continue for a long time; BRIEF DESCRIPTION OF DRAWINGS

[0017] Fig. 1 FIG. 1 is a structural schematic diagram of a communication data analysis system for network security according to the present application; Fig. 2 A flowchart of a communication data analysis method for network security according to the present application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0019] Embodiment: As shown in the accompanying drawings, the present application provides a technical solution, a communication data analysis system and method for network security. Figs. 1-2

[0020] S1, extracting time sequence features, protocol semantic features and interaction topology features of communication session history data based on network flow data, and fusing the time sequence features, the protocol semantic features and the interaction topology features into a unified high-dimensional feature vector, taking the high-dimensional feature vector as a communication behavior dynamic feature vector; S1 includes: Step S1-1: obtaining all network devices in a certain network area, collecting all network devices into a network device set Sall, obtaining network flow data in a certain network area, and the network flow data including source IP address, destination IP address, source port, destination port, protocol type, transmission byte number, packet number and timestamp information; Step S1-2: analyzing and preprocessing the communication session between network devices, and extracting time sequence features of the communication session, the time sequence features including: session duration, data transmission rate, data packet interval time statistics, session start time, session end time and session frequency in a preset unit time period; The time sequence features aim to depict the dynamic behavior pattern of the communication session in the time dimension. Session duration: obtained by calculating the difference between the session end time and the session start time, with the unit of seconds.

[0021] Data transmission rate: including uplink rate and downlink rate, and total transmission rate, with the common unit of bytes / second or bits / second.

[0022] Data packet interval time statistics: an index obtained by statistical analysis of the time interval between consecutive data packets in a communication session.

[0023] ​For example, the average data packet interval time is the sum of all data packet interval times divided by the number of data packets minus one; the median data packet interval time is the middle value of all data packet interval times arranged in ascending order, which reflects the typical interval of data packet transmission; the standard deviation of data packet interval time reflects the stability of transmission rate; the minimum data packet interval time is the fastest speed of data packet transmission in the session; the maximum data packet interval time is the slowest speed of data packet transmission in the session; the session start time is the initial timestamp of the communication session; the session end time is the termination timestamp of the communication session; and the session frequency in a preset unit time period is the number of communication sessions established between the source IP address and the destination IP address in a preset unit time period, which is used to capture the activity level of communication in a short time.

[0024] Through feature engineering for semantic analysis of protocol behavior, a pre-defined protocol parser and a feature extraction rule set, the collected semantic information is automatically encoded or mapped into feature values, realizing automatic extraction of protocol semantic features; In actual application, the collected objects include "application layer protocol type", "HTTP request method" or "device role", which are converted into a binary vector, for example, if there are K protocol types, a protocol will be represented as a vector of length K, where only the element corresponding to the protocol position is 1 and the rest are 0. For discrete features with sequential relationship or pre-defined semantics, they can be mapped to continuous numerical values through a knowledge base, for example, "TLS version" can be mapped to version number, or some protocol flag bit combination can be mapped to a pre-defined risk level score.

[0025] Step S1-3: protocol analysis is performed on each communication session to extract protocol semantic features of the communication session, including application layer protocol type, protocol field statistics, protocol header features, flag bit distribution and load entropy value; Step S1-4: the network topology relationship of all network devices in a certain network area is obtained, and the interactive topology features of the communication session are extracted, including the number of other network devices connected by each network device, session directionality, the role played by the network device in the network, communication path length and network hop number. The interactive topology features aim to describe the relative position and role of the communication parties in the network structure, thereby revealing the structural association of the communication behavior; the network topology relationship can be obtained through network discovery protocol, routing protocol information, ARP table, switch MAC address table, network device configuration data or a special network topology detection tool, and stored in a dynamically updated network topology database.

[0026] The interactive topology features include: Number of other network devices each network device is connected to: For the source and destination devices of a communication session, count the number of other devices they are directly connected to in the network topology. This metric reflects the connectivity of a device, and a device with high connectivity can be a core server or a potential attack hop.

[0027] Session directionality: Determine whether a communication session is initiated by a client to a server, or is a peer-to-peer communication between devices, or is a server reverse connection to a client. This can be done by analyzing whether the source port and destination port are well-known service ports; for example, if the source port is a high-bit random port and the destination port is a well-known service port, it is usually a client-initiated session.

[0028] Role of network device in the network: Based on the IP address of the device, service port, communication mode, asset tag and associated historical behavior data, infer its role in the network; for example, a device that frequently initiates HTTP / HTTPS requests to the outside world can be identified as a "Web client"; a device that continuously listens to a specific service port and responds to a large number of external requests can be identified as a "server"; and a device that acts as a gateway can play the role of "router / firewall". The identification of the role can be done using a rule-based or machine learning classification model.

[0029] Communication path length: The shortest path hop count from the source device to the destination device in the network topology, which can be inferred by querying the network topology database or by routing information.

[0030] Network hop count: The number of network devices that the communication session data packet passes through from the source device to the destination device, which can be inferred from the TTL field of the IP packet or obtained by network device probing. Significant decrease or abnormal change in TTL value can provide clues about the network path.

[0031] Step S1-5: Convert the protocol semantic features and interaction topology features into feature values by feature encoding or obtaining the correspondence between the protocol semantic features and interaction topology features and the feature values from the relevant knowledge base, respectively, and splice the data in the time sequence features to form a high-dimensional feature vector , wherein, is the dynamic feature vector of a certain communication session s at time t.

[0032] In an embodiment, in order to balance the different data quantities and dimensions among the parameters in the network, normalization can be used to unify the data in the [0, 1] interval; Set the maximum session duration to 600 seconds, the peak data flow rate to 100 KB / s, the average packet interval to 0.1 s, the maximum load entropy value to 8, the maximum hop count, and obtain the protocol type code, network role code and target port code; The collected network data and semantic information are classified and identified, and the normalized feature values ​​are concatenated to obtain a high-dimensional feature vector.

[0033] S2. Collect communication behavior records and dynamic feature vectors of network devices in the communication network, and quantitatively calculate the similarity, communication frequency and protocol diversity evaluation values ​​of network devices. S2 includes: Step S2-1: Obtain the i-th network device Ei and the j-th network device Ej in the network device set. In a unit time period, network device Ei and network device Ej have at least one communication session. After network device Ei and network device Ej have any communication session, obtain the high-dimensional feature vectors of the two network devices and denote them as V1 and V2 respectively. Calculate the similarity between V1 and V2 and denote it as sim(V1, V2). Step S2-2: Obtain the number of communication sessions Nij between network devices Ei and Ej in a unit time period, obtain the number of communication sessions Nim between network device Ei and the m-th network device Em in the network device set in a unit time period, normalize the number of communication sessions between network devices Ei and Ej in a unit time period, and obtain the normalized frequency Freq(Ei, Ej) of network devices Ei and Ej in a unit time period. , where M represents the total number of network devices in the network device set; Step S2-3: Collect all communication protocols of the communication session between network device Ei and network device Ej within a unit time period to form a communication protocol set. Calculate the protocol diversity evaluation value Ent(Ei, Ej) based on the frequency of occurrence of each communication protocol within a unit time period, where the frequency of occurrence of the p-th communication protocol within a unit time period is denoted as P(p). , where q represents the total number of communication protocol types in the communication protocol set.

[0034] S3: Collect historical communication behavior and historical communication data of network devices, calculate the coupling relationship evaluation value between network devices based on the quantified communication behavior, and calculate the digital characteristics of the coupling relationship evaluation value; S3 includes: Step S3-1: Establish the coupling relationship evaluation value R(Ei,Ej) between network device Ei and network device Ej. Where w1, w2 and w3 are the weight coefficients of similarity, normalized frequency and protocol diversity evaluation value, respectively, and w1+w2+w3=1; Step S3-2: Collect historical communication session data corresponding to several unit time periods, calculate the coupling relationship evaluation value for each unit time period, and calculate the average μ and variance σ of all coupling relationship evaluation values. 2 .

[0035] The weighting coefficients can be dynamically adjusted or pre-configured based on expert experience, network environment characteristics, or through machine learning algorithms (e.g., by minimizing the false alarm rate of normal communication and the false negative rate of abnormal communication). For example, w1 can be set higher in scenarios that emphasize behavioral similarity, while w2 and w3 can be adjusted in scenarios that emphasize communication frequency and diversity.

[0036] The present invention further evaluates the coupling relationship of communication behavior between network devices by analyzing historical interaction data and calculates the digital characteristics of the coupling relationship evaluation value in order to establish a historical baseline that reflects the normal behavior pattern between devices.

[0037] The mean reflects the long-term average level of the communication coupling relationship between Ei and Ej, while the variance reflects the volatility of this coupling relationship. These two numerical characteristics together constitute the statistical baseline for subsequent real-time anomaly detection.

[0038] S4: When a communication session occurs, calculate the real-time coupling relationship evaluation value between network devices, quantify the difference of the real-time coupling relationship evaluation value through digital features, accumulate the coupling relationship evaluation value during the process of a communication session, and calculate the total anomaly degree of the communication session. S4 includes: Step S4-1: Record the time when a certain communication session s is detected in the current communication session between network device Ei and network device Ej as the target time τ, obtain a unit time period including the target time as the target time period, and calculate the coupling relationship evaluation value of network device Ei and network device Ej within the target time period as R(Ei,Ej,τ). Step S4-2: Obtain the average and variance of the coupling relationship evaluation value, quantify the degree of anomaly of the coupling relationship evaluation value for the target time period, and calculate the degree of anomaly quantification value A(s, τ) of the current communication session. ; Step S4-3: Obtain the duration interval [Tstart, Tend] of a certain communication session s, where Tstart represents the start time of a certain communication session s and Tend represents the end time of a certain communication session s. Divide the duration interval into N equal-length time sub-intervals. Select a time in each time sub-interval as the sampling time. Use the time sub-interval as the time period corresponding to the sampling time. Calculate the anomaly quantization value corresponding to each sampling time. The anomaly quantization value corresponding to the k-th time sub-interval is denoted as A(s, t).k The quantification value of the anomaly degree corresponding to the (k-1)th time sub-interval is denoted as A(s, t). k-1 ), where t k Let t represent the sampling time corresponding to the k-th time sub-interval. k-1 This represents the sampling time corresponding to the (k-1)th time sub-interval; Step S4-4: Calculate the total anomaly TA for the target time period. .

[0039] When a communication session occurs, the real-time coupling relationship assessment value between network devices is calculated, and the difference in the real-time coupling relationship assessment value is quantified by the digital characteristics of the historical baseline mentioned above. Then, during a certain communication session, the total anomaly is calculated.

[0040] S5. Set an alarm threshold to evaluate the total anomaly rate of the communication session. When the total anomaly rate exceeds the alarm threshold, an alarm will be triggered.

[0041] Set an alarm threshold, and the real-time anomaly detection module will monitor the total anomaly rate of the communication session. Conduct an assessment. When the total anomaly... When the alarm threshold is exceeded, the real-time anomaly detection module generates and sends an alarm notification.

[0042] Example of the method's application in a real-world scenario: Assume there are devices in the network. and If 10 communication sessions occur within a 5-minute timeframe, the device... If there are a total of 50 communication sessions with other devices, then the normalized frequency is: , The protocol set contains three protocols with frequencies of 0.5, 0.3, and 0.2 respectively. Therefore, the protocol diversity assessment value is: , Feature vector similarity If the weights are taken as typical values, then the coupling relationship evaluation value is: , Historical average ,variance The abnormality quantification value is: , If the session lasts 120 seconds and is divided into 6 sub-intervals, with anomaly quantification values ​​of 0.33, 0.45, 0.52, 0.48, 0.41, and 0.35 for each sub-interval, then the total anomaly score is: , Set the alarm threshold to 30, and generate an alarm when TA=44.

[0043] The system includes: The module includes a multi-dimensional feature extraction module, a behavior quantification module, a coupling relationship modeling module, a dynamic anomaly assessment module, and an alarm decision module. A multi-dimensional feature extraction module is used to extract temporal features, protocol semantic features, and interaction topology features from historical communication session data based on raw network flow data, and to fuse these features into a unified high-dimensional feature vector, which is then used as a dynamic feature vector for communication behavior. The multi-dimensional feature extraction module includes a data acquisition unit, a temporal feature extraction unit, a protocol semantic feature extraction unit, an interaction topology feature extraction unit, and a feature fusion unit. The data acquisition unit acquires all network devices in a specific network area, aggregates all network devices into a network device set, and acquires network flow data within that network area. This network flow data includes source IP address, destination IP address, source port, destination port, protocol type, number of transmitted bytes, number of data packets, and timestamp information. The temporal feature extraction unit parses and preprocesses the communication sessions between network devices, extracting the temporal features of the communication sessions, including session duration, data transmission... The system includes: transmission rate, data packet interval statistics, session start time, session end time, and session frequency within a preset unit time period; the protocol semantic feature extraction unit performs protocol analysis on each communication session to extract the protocol semantic features of the communication session, which include application layer protocol type, protocol field statistics, protocol header features, flag distribution, and load entropy value; the interaction topology feature extraction unit obtains the network topology relationship of all network devices in a certain network area and extracts the interaction topology features of the communication session, which include the number of other network devices connected to each network device, session directionality, the role of the network device in the network, communication path length, and network hop count; the feature fusion unit converts the protocol semantic features and interaction topology features into feature values ​​by obtaining the correspondence between protocol semantic features and interaction topology features and feature values ​​from a relevant knowledge base through feature encoding, and concatenates them with the data in the time series features to form a high-dimensional feature vector; The behavior quantification module is used to collect communication behavior records and dynamic feature vectors of network devices in the communication network, and to quantify the communication behavior to calculate the similarity, communication frequency, and protocol diversity evaluation values ​​of the network devices. The device behavior quantification module includes a similarity calculation unit, a frequency normalization unit, and a protocol diversity evaluation unit. The similarity calculation unit is used to obtain the high-dimensional feature vectors of the two network devices after any communication session occurs between them, and calculate the similarity of the high-dimensional feature vectors. The frequency normalization unit is used to normalize the number of communication sessions conducted by the network devices within a unit time period to obtain the normalized frequency of the network devices within the unit time period. The protocol diversity evaluation unit is used to collect all communication protocols of the communication sessions between network devices within a unit time period, forming a communication protocol set, and calculate the protocol diversity evaluation value based on the occurrence frequency of each communication protocol within the unit time period. The coupling relationship modeling module is used to collect historical communication behavior and data of network devices, calculate the coupling relationship evaluation value between network devices based on the quantified communication behavior, and calculate the numerical characteristics of the coupling relationship evaluation value. The coupling relationship modeling module includes a coupling evaluation unit and a statistical feature calculation unit. The coupling evaluation unit is used to establish the coupling relationship evaluation value between network devices. The statistical feature calculation unit is used to collect historical communication session data corresponding to several unit time periods, calculate the coupling relationship evaluation value for each unit time period, and calculate the mean and variance of all coupling relationship evaluation values. A dynamic anomaly assessment module is used to calculate the real-time coupling relationship assessment value between network devices when a communication session occurs. It quantifies the difference in the real-time coupling relationship assessment value using digital features, accumulates the coupling relationship assessment values ​​during the communication session, and calculates the total anomaly degree of the communication session. The dynamic anomaly assessment module includes a real-time coupling calculation unit, an anomaly quantification unit, a session segmentation unit, and a total anomaly degree calculation unit. The real-time coupling calculation unit records the moment when the communication session is detected as the target moment, obtains a unit time period including the target moment as the target time period, and calculates the coupling relationship assessment value of network devices within the target time period. The anomaly quantification unit obtains the average and variance of the coupling relationship assessment values, quantifies the anomaly degree of the coupling relationship assessment values ​​in the target time period, and calculates the anomaly degree quantification value of the current communication session. The session segmentation unit obtains the duration interval of a communication session, divides the duration interval into N equal-length time sub-intervals, selects a moment in each time sub-interval as the sampling moment, uses the time sub-interval as the time period corresponding to the sampling moment, and calculates the anomaly degree quantification value corresponding to each sampling moment. The total anomaly degree calculation unit calculates the total anomaly degree of the target time period. The alarm decision module is used to set alarm thresholds to evaluate the total anomaly rate of communication sessions, and to issue an alarm when the total anomaly rate exceeds the alarm threshold.

[0044] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A communication data analysis method for network security, characterized in that: The methods include: S1. Extract the temporal features, protocol semantic features and interaction topology features of historical communication session data based on network flow data, and fuse the temporal features, protocol semantic features and interaction topology features into a unified high-dimensional feature vector, and use the high-dimensional feature vector as a dynamic feature vector of communication behavior. S2. Collect communication behavior records and dynamic feature vectors of network devices in the communication network, and quantitatively calculate the similarity, communication frequency and protocol diversity evaluation values ​​of network devices. S3: Collect historical communication behavior and historical communication data of network devices, calculate the coupling relationship evaluation value between network devices based on the quantified communication behavior, and calculate the digital characteristics of the coupling relationship evaluation value; S4: When a communication session occurs, calculate the real-time coupling relationship evaluation value between network devices, quantify the difference of the real-time coupling relationship evaluation value through digital features, accumulate the coupling relationship evaluation value during the communication session, and calculate the total anomaly degree of the communication session. S5. Set an alarm threshold to evaluate the total anomaly rate of the communication session. When the total anomaly rate exceeds the alarm threshold, an alarm will be triggered.

2. The communication data analysis method for network security according to claim 1, characterized in that: S1 includes: Step S1-1: Obtain all network devices in a certain network area, aggregate all network devices into the network device set Sall, and obtain network flow data in the certain network area. The network flow data includes source IP address, destination IP address, source port, destination port, protocol type, number of bytes transmitted, number of data packets, and timestamp information. Step S1-2: Parse and preprocess the communication sessions between network devices, and extract the timing features of the communication sessions. The timing features include: session duration, data transmission rate, data packet interval statistics, session start time, session end time, and session frequency within a preset unit time period. Step S1-3: Perform protocol analysis on each communication session to extract the protocol semantic features of the communication session. The protocol semantic features include: application layer protocol type, protocol field statistics, protocol header features, flag bit distribution, and load entropy value. Step S1-4: Obtain the network topology relationship of all network devices in a certain network area, and extract the interaction topology features of the communication session. The interaction topology features include: the number of other network devices connected to each network device, session directionality, the role played by the network device in the network, communication path length, and network hop count. Steps S1-5: By using feature encoding or obtaining the correspondence between protocol semantic features and interaction topology features and feature values ​​from relevant knowledge bases, the protocol semantic features and interaction topology features are transformed into feature values, which are then concatenated with the data in the time series features to form a high-dimensional feature vector. ,in, This serves as the dynamic feature vector of a communication session s at time t.

3. The communication data analysis method for network security according to claim 2, characterized in that: S2 includes: Step S2-1: Obtain the i-th network device Ei and the j-th network device Ej in the network device set. In a unit time period, network device Ei and network device Ej have at least one communication session. After network device Ei and network device Ej have any communication session, obtain the high-dimensional feature vectors of the two network devices and denote them as V1 and V2 respectively. Calculate the similarity between V1 and V2 and denote it as sim(V1, V2). Step S2-2: Obtain the number of communication sessions Nij between network devices Ei and Ej in a unit time period, obtain the number of communication sessions Nim between network device Ei and the m-th network device Em in the network device set in a unit time period, normalize the number of communication sessions between network devices Ei and Ej in a unit time period, and obtain the normalized frequency Freq(Ei, Ej) of network devices Ei and Ej in a unit time period. , where M represents the total number of network devices in the network device set; Step S2-3: Collect all communication protocols of the communication session between network device Ei and network device Ej within a unit time period to form a communication protocol set. Calculate the protocol diversity evaluation value Ent(Ei, Ej) based on the frequency of occurrence of each communication protocol within a unit time period, where the frequency of occurrence of the p-th communication protocol within a unit time period is denoted as P(p). , where q represents the total number of communication protocol types in the communication protocol set.

4. The communication data analysis method for network security according to claim 3, characterized in that: S3 includes: Step S3-1: Establish the coupling relationship evaluation value R(Ei,Ej) between network device Ei and network device Ej. Where w1, w2 and w3 are the weight coefficients of similarity, normalized frequency and protocol diversity evaluation value, respectively, and w1+w2+w3=1; Step S3-2: Collect historical communication session data corresponding to several unit time periods, calculate the coupling relationship evaluation value for each unit time period, and calculate the average μ and variance σ of all coupling relationship evaluation values. 2 .

5. A communication data analysis method for network security according to claim 4, characterized in that: S4 includes: Step S4-1: The time when a certain communication session s is detected in the current communication session between network device Ei and network device Ej is recorded as the target time τ. A unit time period including the target time is obtained as the target time period. The coupling relationship evaluation value of network device Ei and network device Ej within the target time period is calculated and recorded as R(Ei,Ej,τ). Step S4-2: Obtain the average and variance of the coupling relationship evaluation value, quantify the degree of anomaly of the coupling relationship evaluation value for the target time period, and calculate the degree of anomaly quantification value A(s, τ) of the current communication session. ; Step S4-3: Obtain the duration interval [Tstart, Tend] of a certain communication session s, where Tstart represents the start time of the certain communication session s and Tend represents the end time of the certain communication session s. Divide the duration interval into N equal-length time sub-intervals. Select a time in each time sub-interval as the sampling time. Use the time sub-interval as the time period corresponding to the sampling time. Calculate the anomaly quantization value corresponding to each sampling time. The anomaly quantization value corresponding to the k-th time sub-interval is denoted as A(s, t). k The quantification value of the anomaly degree corresponding to the (k-1)th time sub-interval is denoted as A(s, t). k-1 ), where t k Let t represent the sampling time corresponding to the k-th time sub-interval. k-1 This represents the sampling time corresponding to the (k-1)th time sub-interval; Step S4-4: Calculate the total anomaly TA for the target time period. .

6. A communication data analysis system for network security, used to execute the communication data analysis method for network security as described in any one of claims 1-5, characterized in that: The system includes: The module includes a multi-dimensional feature extraction module, a behavior quantification module, a coupling relationship modeling module, a dynamic anomaly assessment module, and an alarm decision module. The multi-dimensional feature extraction module is used to extract the temporal features, protocol semantic features, and interaction topology features of the communication session history data based on the original network flow data, and to fuse the temporal features, protocol semantic features, and interaction topology features into a unified high-dimensional feature vector, which is used as the dynamic feature vector of communication behavior; the behavior quantification module is used to collect the communication behavior records and dynamic feature vectors of network devices in the communication network, and to quantify the communication behavior to calculate the similarity, communication frequency, and protocol diversity evaluation values ​​of network devices. The coupling relationship modeling module is used to collect historical communication behavior and historical communication data of network devices, calculate the coupling relationship evaluation value between network devices based on the quantified communication behavior, and calculate the digital characteristics of the coupling relationship evaluation value. The dynamic anomaly assessment module is used to calculate the real-time coupling relationship assessment value between network devices when a certain communication session occurs, quantify the difference of the real-time coupling relationship assessment value through digital features, accumulate the coupling relationship assessment value during the course of the certain communication session, and calculate the total anomaly degree of the communication session. The alarm decision module is used to set alarm thresholds to evaluate the total anomaly rate of communication sessions, and to issue an alarm when the total anomaly rate exceeds the alarm threshold.

7. A communication data analysis system for network security according to claim 6, characterized in that: The multidimensional feature extraction module includes a data acquisition unit, a temporal feature extraction unit, a protocol semantic feature extraction unit, an interaction topology feature extraction unit, and a feature fusion unit; The data acquisition unit is used to acquire all network devices in a certain network area, aggregate all network devices into a network device set, and acquire network flow data in the certain network area. The network flow data includes source IP address, destination IP address, source port, destination port, protocol type, number of transmitted bytes, number of data packets, and timestamp information. The timing feature extraction unit is used to parse and preprocess the communication sessions between network devices, extracting the timing features of the communication sessions. The timing features include session duration, data transmission rate, data packet interval statistics, session start time, session end time, and session frequency within a preset unit time period. The protocol semantic feature extraction unit is used to perform protocol analysis on each communication session to extract the communication semantic features. The protocol semantic features of the communication session include application layer protocol type, protocol field statistics, protocol header features, flag distribution, and load entropy value. The interaction topology feature extraction unit is used to obtain the network topology relationship of all network devices in a certain network area and extract the interaction topology features of the communication session. The interaction topology features include the number of other network devices connected to each network device, session directionality, the role of the network device in the network, communication path length, and network hop count. The feature fusion unit is used to convert the protocol semantic features and interaction topology features into feature values ​​by obtaining the correspondence between the protocol semantic features and interaction topology features and feature values ​​from a relevant knowledge base through feature encoding or by obtaining the correspondence between the protocol semantic features and interaction topology features and feature values. These feature values ​​are then concatenated with the data in the time series features to form a high-dimensional feature vector.

8. A communication data analysis system for network security according to claim 6, characterized in that: The device behavior quantification module includes a similarity calculation unit, a frequency normalization unit, and a protocol diversity evaluation unit; The similarity calculation unit is used to obtain the high-dimensional feature vectors of the two network devices after any communication session occurs between the network devices, and calculate the similarity of the high-dimensional feature vectors; the frequency normalization unit is used to normalize the number of communication sessions conducted by the network devices in a unit time period to obtain the normalized frequency of the network devices in a unit time period; the protocol diversity evaluation unit is used to collect all communication protocols of the communication sessions between the network devices in a unit time period, form a communication protocol set, and calculate the protocol diversity evaluation value by the occurrence frequency of each communication protocol in a unit time period.

9. A communication data analysis system for network security according to claim 6, characterized in that: The coupling relationship modeling module includes a coupling evaluation unit and a statistical feature calculation unit; The coupling evaluation unit is used to establish the coupling relationship evaluation value between network devices; the statistical feature calculation unit is used to collect communication session history data corresponding to several unit time periods, calculate the coupling relationship evaluation value corresponding to each unit time period, and calculate the mean and variance of all coupling relationship evaluation values.

10. A communication data analysis system for network security according to claim 6, characterized in that: The dynamic anomaly assessment module includes a real-time coupled calculation unit, an anomaly quantification unit, a session partitioning unit, and a total anomaly calculation unit; The real-time coupling calculation unit is used to record the time when a certain communication session is detected in the current communication session as the target time, obtain a unit time period including the target time as the target time period, and calculate the coupling relationship evaluation value of network devices within the target time period. The anomaly quantization unit is used to obtain the average value and variance of the coupling relationship evaluation value, quantify the anomaly degree of the coupling relationship evaluation value of the target time period, and calculate the anomaly degree quantization value of the current communication session. The session segmentation unit is used to obtain the duration interval of a certain communication session, divide the duration interval into N equal-length time sub-intervals, select a moment in each time sub-interval as the sampling moment, use the time sub-interval as the time period corresponding to the sampling moment, and calculate the quantification value of the abnormality degree corresponding to each sampling moment; the total abnormality calculation unit is used to calculate the total abnormality degree of the target time period.

Images