Deep learning based network threat detection and response system

Abstract

The application relates to the technical field of network threat detection, and discloses a network threat detection and response system based on deep learning. The system comprises a collection module, a statistical module and an instruction generation module. The collection module is used for collecting standardized data sets from a plurality of preset security areas. The statistical module is used for statistically calculating attack equivalent cumulative values, defense strength indexes and asset attack exposure degrees based on the standardized data sets. The instruction generation module is used for calculating a threat comprehensive score according to the attack equivalent cumulative values, the asset attack exposure degrees and the defense strength indexes, and generating blocking instructions, isolation instructions and flow limiting instructions according to the threat comprehensive score. The application can automatically generate an access control strategy according to an attack chain analysis result and execute the access control strategy, thereby forming a complete closed loop from threat detection to strategy optimization, and improving the synergy, accuracy and real-time performance of network security operation.

Description

Technical Field

[0001] This invention relates to the field of network threat detection technology, and in particular to a network threat detection and response system based on deep learning. Background Technology

[0002] As cyberattack methods become increasingly sophisticated, traditional cybersecurity protection systems face severe challenges. Existing threat detection systems mainly rely on independent monitoring of a single security zone, lacking effective coordination mechanisms between zones. This makes it difficult to fully trace cross-regional attack chains, allowing attackers to exploit blind spots in regional protection to carry out penetration.

[0003] Current threat assessment methods often focus on the attack itself, failing to comprehensively consider the dynamic balance between defensive capabilities and asset exposure. This leads to biases in threat level determination and a mismatch between response strategies and the actual threat landscape. Furthermore, existing security response mechanisms mostly employ fixed policy configurations, lacking the ability to dynamically adjust based on real-time threat conditions and flexibly allocate security resources according to the load status of different areas. Summary of the Invention

[0004] The main objective of this invention is to provide a network threat detection and response system based on deep learning. This invention can automatically generate access control policies and issue them for execution based on attack chain analysis results, forming a complete closed loop from threat detection to policy optimization, thereby improving the synergy, accuracy and real-time performance of network security operations.

[0005] To achieve the above objectives, this invention provides a deep learning-based network threat detection and response system, comprising the following steps: The acquisition module is used to acquire standardized datasets from multiple preset security zones; The statistics module is used to calculate the cumulative attack equivalent, defense strength index, and asset exposure based on the standardized dataset. The instruction generation module is used to calculate a comprehensive threat score based on the cumulative attack equivalent value, the asset's exposure to attack, and the defense strength index, and to generate blocking instructions, isolation instructions, and flow restriction instructions based on the comprehensive threat score.

[0006] Optionally, in a first implementation of the first aspect of the present invention, the acquisition module is specifically used for: Collect security logs from the multiple preset security zones; The attack source IP address, attack target IP address, attack type identifier, and attack timestamp are extracted from the security log. A standardized quadruple is constructed based on the attack source IP address, the attack target IP address, the attack type identifier, and the attack timestamp. Collect asset IP addresses, asset types, and zone identifiers for each security zone to form an asset list, and count the number of layers in the defense-in-depth architecture that includes multiple protection layers; The standardized quadruple, the asset list, and the number of defense-in-depth architecture layers are used as a standardized dataset.

[0007] Optionally, in a second implementation of the first aspect of the present invention, the statistics module is specifically used for: The attack frequency of each attack type in the standardized quadruple in the standardized dataset is counted, and the cumulative attack equivalent value is calculated based on the attack frequency and the preset severity weight. The ratio of the number of layers of the defense-in-depth architecture in the standardized dataset to the preset standard number of layers is calculated and summed to obtain the defense strength index; The number of times an asset is attacked in the standardized dataset is counted, and the product of the preset asset weight and the number of times it is attacked is calculated and accumulated to obtain the asset attack exposure.

[0008] Optionally, in a third implementation of the first aspect of the present invention, the deep learning-based network threat detection and response system further includes: The profiling and analysis module is used to extract attack records of the same attack source IP against targets in different regions at different timestamps to form an attack profile; it collects security handling logs to extract the number of completed events and the total number of alarm events to calculate alarm response efficiency, and counts the number of completed tasks and the total number of planned tasks to obtain a defense profile; it counts the number of attacks suffered by each region to obtain an attack profile.

[0009] Optionally, in a fourth implementation of the first aspect of the present invention, the deep learning-based network threat detection and response system further includes: The event association module is used to establish an event association matrix based on the attack profile and the attacked profile; The attack chain construction module is used to extract event asset pairs whose matrix element values ​​are greater than a preset association threshold from the event association matrix, and arrange the event asset pairs into an attack chain path that includes a complete attack path, a list of attacked assets, and defensive weaknesses. The judgment module is used to divide the cumulative attack equivalent value by the defense strength index to obtain the defense gap value, and to determine whether the defense gap value is greater than a preset gap threshold. When the defense gap value is greater than the preset gap threshold, it marks that the current defense strength is insufficient relative to the attack pressure.

[0010] Optionally, in a fifth implementation of the first aspect of the present invention, the event association module is specifically used for: The time correlation is calculated based on the attack event timestamp of the attack profile and the attack asset timestamp of the attacked profile. Determine if there is a direct route between the attack source region and the region where the asset is located; When a directly connected route exists, the spatial correlation is taken as the first spatial correlation value; when no directly connected route exists, the spatial correlation is taken as the second spatial correlation value. Calculate the correlation between behaviors based on preset matching rules between attack type and asset type; The temporal correlation, spatial correlation, and behavioral correlation are multiplied to obtain matrix element values, and an event correlation matrix is ​​established based on the matrix element values.

[0011] Optionally, in a sixth implementation of the first aspect of the present invention, the attack chain construction module is specifically used for: Determine whether the matrix element value in the event association matrix is ​​greater than a preset association threshold, and extract event asset pairs whose matrix element value is greater than the preset association threshold; The event asset pairs are arranged into an attack chain timeline according to the attack timestamps. The attack chain spatial topology map is formed by sequentially connecting the area identifiers of each attack event in the attack path sequence to identify the penetration path. The areas in the defense profile that meet the preset weak conditions are identified as weak points in the defense. The penetration path, the event asset pair, and the weak points in the defense are then combined to form an attack chain path.

[0012] Optionally, in the seventh implementation of the first aspect of the present invention, the instruction generation module is specifically used for: Calculate the reciprocal of the defensive strength index; The threat score is obtained by weighted summing of the cumulative attack equivalent value, the asset exposure degree, and the reciprocal of the defense strength index. Based on the comprehensive threat score, blocking commands, isolation commands, and flow restriction commands are generated.

[0013] Optionally, in an eighth implementation of the first aspect of the present invention, the deep learning-based network threat detection and response system further includes: The configuration module is used to extract attack source IPs with an attack equivalent contribution rate greater than a preset contribution rate threshold from the attack profile to form an attack source IP list, and to set the target firewall identifier as a boundary protection device for the blocking command based on the attack source IP list; to extract asset IPs with the highest asset exposure rate from the attacked profile as attacked asset IPs, to set the isolation VLAN identifier and the network access device identifier of the area where the attacked asset IP is located for the isolation command based on the attacked asset IPs, and to set the attack source IP and preset rate limiting bandwidth parameters for the rate limiting command.

[0014] Optionally, in a ninth implementation of the first aspect of the present invention, the deep learning-based network threat detection and response system further includes: The instruction issuing module is used to issue the blocking instruction to the boundary protection device through a first communication protocol, issue the isolation instruction to the network access device in the area where the attacked asset is located through a second communication protocol, and issue the flow limiting instruction to the traffic management device through a third communication protocol.

[0015] In summary, by establishing an event correlation matrix and calculating the three-dimensional correlation of time, space, and behavior, this invention can accurately identify cross-regional attack chain paths and trace the complete penetration process from the Internet exit zone to the core data center. Based on a tiered response command generation mechanism using a comprehensive threat scoring system, it can automatically generate differentiated blocking, isolation, and rate-limiting commands based on a weighted calculation of cumulative attack value, asset exposure, and defense strength index. These commands are then distributed to devices in various security zones through multi-protocol linkage, achieving intelligent and automated threat response. Furthermore, this invention can automatically generate and execute access control policies based on attack chain analysis results, forming a complete closed loop from threat detection to policy optimization, thus improving the synergy, accuracy, and real-time performance of network security operations. Attached Figure Description

[0016] Figure 1 This is a block diagram of a deep learning-based network threat detection and response system according to an embodiment of the present invention.

[0017] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Reference Figure 1 This embodiment provides a deep learning-based network threat detection and response system, including the following steps: The acquisition module 101 is used to acquire standardized datasets from multiple preset security areas; Specifically, the data collection module is deployed in various pre-defined security zones under the control of a unified management center, including the internet egress zone, core switching zone, data center zone, office access zone, and security management zone. It collects raw security log data in real time through log collection agents deployed within each zone, including heterogeneous sources such as firewall blocking logs, Intrusion Detection System (IDS) alarm logs, endpoint protection logs, and network traffic analysis logs. The collection module synchronizes its clock based on a unified timestamp benchmark, ensuring all log events have uniform time precision (deviation not exceeding 10 milliseconds). From the collected logs, four basic fields are parsed: attack source IP address, attack target IP address, attack type identifier, and attack timestamp. These four data items are integrated into standardized four-tuples to form a unified data structure. Simultaneously, an attack type mapping table normalizes various attack events into encoded fields, such as mapping DDoS to 1 and APT penetration to 2. Asset information for each security zone is extracted synchronously, including asset IP address, asset type (e.g., target system, centralized system, internet publishing system), zone identifier, and asset importance level. A mapping relationship between assets and attack logs is established based on IP addresses. Simultaneously, protection architecture configuration parameters within the region are collected, extracting indicators such as the number of border firewall policy entries, the number of intrusion prevention rules, the deployment rate of host protection agents, and the data encryption coverage rate, thereby calculating the number of defense-in-depth architecture layers for each region. A four-layer structure is used as the complete defense reference benchmark (border firewall layer, intrusion detection layer, host protection layer, and data encryption layer), and the number of defense-in-depth layers for each region is assigned a value based on its actual deployment. The extracted standardized quadruplets, security asset inventory, and the number of defense-in-depth architecture layers for each region are categorized, organized, and merged according to region identifiers to construct a standardized dataset.

[0020] The statistics module 102 is used to calculate the cumulative attack equivalent value, defense strength index, and asset exposure based on the standardized dataset. Specifically, the statistics module receives a standardized dataset from the acquisition module. This dataset includes a set of standardized quadruplets consisting of the attack source IP address, the attack target IP address, the attack type identifier, and the attack timestamp; an asset list containing the IP addresses, asset types, and region identifiers of each asset; and information on the number of layers in the defense-in-depth architecture for each security zone. The dataset is then categorized according to a preset time window, identifying and traversing all standardized quadruplets. Based on the attack type field, the quadruplets are grouped and statistically analyzed. The frequency of each type of attack event within the current time window is extracted. Combined with the weight values ​​assigned to different attack types in the attack severity weight table (e.g., DDoS attack weight is 3, APT attack weight is 5, ransomware weight is 4, etc.), the product of the frequency and corresponding weight of all attack types is calculated and summed to obtain the cumulative attack equivalent value, quantitatively representing the total attack intensity observed within the current time range. The defense configuration of each security zone is analyzed. Based on the standard layer reference value (set as a complete four-layer defense system, namely boundary firewall, intrusion detection, host protection, and data encryption) as the denominator, the actual number of layers of the defense-in-depth architecture in each zone is divided by the standard value to calculate the defense coverage ratio of each zone. The defense coverage ratios are then summed to obtain the defense strength index, which measures the overall defense-in-depth capability of the entire network in the current time. The higher the value, the more complete the defense architecture and the stronger the ability to resist attacks. The system associates and matches the IP addresses of all assets in the asset list with the target IP field in the standardized quadruple. It counts the total number of times each asset is hit by attacks within a specified time window. Based on the preset weight value corresponding to the asset type (e.g., target system weight is 5, Internet publishing system weight is 4, centralized system weight is 5, etc.), the number of hits for each asset is multiplied by its type weight. All product values ​​are summed to obtain the asset's attack exposure degree, which reflects the degree of exposure and threat intensity of critical assets in the network environment. The higher the attack exposure degree, the more likely attackers are to focus on high-value assets to launch attacks, reflecting blind spots in the defense deployment or the attacker's target intent.

[0021] The instruction generation module 103 is used to calculate a comprehensive threat score based on the cumulative attack equivalent value, the asset exposure degree, and the defense strength index, and to generate blocking instructions, isolation instructions, and flow restriction instructions based on the comprehensive threat score.

[0022] Specifically, the reciprocal calculation of the defense strength index reflects the degree of inadequacy in current defense capabilities; a higher value indicates weaker defense. Based on a pre-defined weighted scoring model, the cumulative attack equivalent value, asset exposure, and the reciprocal of the defense strength index are multiplied by their respective weighting coefficients. The weighting coefficient for the cumulative attack equivalent value is set to 0.4 to reflect the dominance of attack intensity; the weighting coefficient for asset exposure is set to 0.3 to emphasize the importance of critical assets in the overall situation; and the weighting coefficient for the reciprocal of defense capability is set to 0.3 to highlight the amplifying effect of defense gaps on risk levels. The three weighted values ​​are summed to obtain the comprehensive threat score. The score ranges from 0 to 120, with higher values ​​indicating a higher level of threat to the current network environment. The response strategy is determined based on the threat comprehensive score range. When the score exceeds the Level 1 response threshold, a blocking instruction is generated. This instruction includes a list of attack source IP addresses with the highest attack contribution rate in the attack profile, specifying that these addresses be added to the border firewall of the Internet egress zone with a blacklist rule and a blocking duration of 24 hours. If the score is between the Level 1 and Level 2 thresholds, a rate limiting instruction is generated, instructing the traffic control device in the core switching area to implement bandwidth rate limiting on the attack source IPs, with a default rate limiting bandwidth of 10Mbps. When the score exceeds the Level 1 response threshold and the asset's exposure exceeds a preset percentile threshold, an isolation instruction is generated. This migrates the access port of the attacked asset from the service VLAN to the isolation VLAN and restricts its communication range with external systems through access control rules, allowing access only to the emergency response server in the security management zone. All response instructions are automatically appended with an instruction sequence number, a timestamp, a target device identifier, and a priority level, and are uniformly stored in the instruction queue of the unified management center.

[0023] In one example, the acquisition module 101 is specifically used for: Collect security logs from the multiple preset security zones; The attack source IP address, attack target IP address, attack type identifier, and attack timestamp are extracted from the security log. A standardized quadruple is constructed based on the attack source IP address, the attack target IP address, the attack type identifier, and the attack timestamp. Collect asset IP addresses, asset types, and zone identifiers for each security zone to form an asset list, and count the number of layers in the defense-in-depth architecture that includes multiple protection layers; The standardized quadruple, the asset list, and the number of defense-in-depth architecture layers are used as a standardized dataset.

[0024] In this example, log collection agents are deployed across multiple logically defined security domains, including the internet egress zone, core switching zone, data center zone, office access zone, and security management zone. These agents maintain bidirectional communication with the unified management center and calibrate system time according to a unified time synchronization protocol (such as NTP) to ensure consistency in time across all collected logs. During log collection, the collection module accesses firewalls, intrusion detection systems, endpoint protection platforms, and traffic analysis engines within the region to acquire raw data such as firewall blocking logs, intrusion alarm logs, host protection logs, and network traffic event logs. A unified parsing process is performed on these multi-source heterogeneous logs, extracting four core fields: attack source IP address, attack target IP address, attack type identifier, and attack timestamp. These fields are then used to construct a standardized threat quadruple, where the attack type identifier is uniformly encoded using a lookup table mapping mechanism; for example, DDoS is mapped to 1, APT penetration to 2, and ransomware to 3. Simultaneously, asset information from each security zone is collected synchronously through horizontal interfaces, including asset IP addresses, asset types (such as centralized systems, internet publishing systems, privileged accounts, target hosts, production control terminals, etc.), unique identifiers of the asset's region, and importance level identifiers for some assets. All collected asset data is uniformly constructed into an asset list. During the list construction process, each asset is marked with its assigned security zone, and its IP address is mapped to the attack target IP address in the security log. To assess the protection capabilities of each region, the protection policies and configuration files deployed in each region are collected, including parameters such as the number of perimeter firewall policies, the number of intrusion prevention rules, the deployment status of host protection agents, and the coverage of data encryption technologies. These parameters are used to calculate the number of layers of defense-in-depth architecture possessed by the region. For example, a complete deployment of a firewall layer, an intrusion prevention layer, a host protection layer, and a data encryption layer constitutes a four-layer architecture. All standardized quadruplets, regional asset lists, and defense-in-depth architecture layer numbers are categorized and organized, archived using the unique identifier of each region, and packaged into a unified, structured, standardized dataset.

[0025] In one example, the statistics module 102 is specifically used for: The attack frequency of each attack type in the standardized quadruple in the standardized dataset is counted, and the cumulative attack equivalent value is calculated based on the attack frequency and the preset severity weight. The ratio of the number of layers of the defense-in-depth architecture in the standardized dataset to the preset standard number of layers is calculated and summed to obtain the defense strength index; The number of times an asset is attacked in the standardized dataset is counted, and the product of the preset asset weight and the number of times it is attacked is calculated and accumulated to obtain the asset attack exposure.

[0026] In this example, the standardized quadruples in the standardized dataset are classified and statistically processed. Each quadruple consists of the attack source IP address, the attack target IP address, the attack type identifier, and the attack timestamp. Within a set time window, all quadruples are categorized according to the attack type identifier. The frequency of the number of quadruples corresponding to each attack type is counted to obtain the occurrence frequency of each type of attack event. A set of preset attack severity weight parameters is used, with weights assigned according to the severity of the attack method. For example, the severity weight of DDoS attacks is set to 3, APT penetration to 5, ransomware to 4, SQL injection to 2, lateral movement to 3, and privilege escalation to 4. The frequency of each type of attack is multiplied by its corresponding weight value, and all product results are summed to calculate the cumulative attack equivalent value, reflecting the attack pressure intensity on the overall network within the current time window. Types with high attack frequency and high severity contribute more significantly to the total value. This value is used to establish a quantitative attack surface index. Based on the information on the number of defense-in-depth architecture layers collected from each region, the actual defense architecture deployed in each security region is standardized, defining the defense-in-depth architecture as a four-layer structure, including perimeter firewall, intrusion detection, host protection, and data encryption. The standard number of layers is set to 4. For any region, the actual number of defense layers is divided by the standard number of layers to obtain the defense integrity ratio for that region. The ratios of all regions are summed to obtain the overall network defense strength index, which measures the integrity and coverage of the current network protection deployment. When the protection strategies of each region are fully configured, the defense strength index reaches its theoretical maximum value. Conversely, if some regions have gaps in defense layers or incomplete deployment, the index value will be relatively lower, thus quantifying the overall level of defense capability. Simultaneously, the exposure of attacked targets is assessed. Based on the asset list in the standardized dataset, all recorded assets are traversed, and the attack target IP field in the four-tuple is mapped and identified by comparing it with the IP address in the asset list. The number of times each asset is attacked within the current time window is counted. A set of asset type weight parameters is introduced. Different types of assets are assigned different weight values ​​according to their criticality in the network. For example, the target system is set to 5, the Internet publishing system is set to 4, the centralized system is set to 5, the privileged account is set to 4, and the production system is set to 3. The number of times each asset is attacked is multiplied by the weight corresponding to its type. Then, the product results of all assets are summed to calculate the asset attack exposure index, which measures the degree to which high-value target assets are exposed to attack paths in the current threat environment. The higher the exposure, the more likely the attacker is to concentrate attacks on critical assets.

[0027] In one example, the deep learning-based network threat detection and response system further includes: The profiling and analysis module is used to extract attack records of the same attack source IP against targets in different regions at different timestamps to form an attack profile; it collects security handling logs to extract the number of completed events and the total number of alarm events to calculate alarm response efficiency, and counts the number of completed tasks and the total number of planned tasks to obtain a defense profile; it counts the number of attacks suffered by each region to obtain an attack profile.

[0028] In this example, a deep analysis is performed across time and regions based on all attack quadruple information extracted from a standardized dataset. Using the attack source IP address as the primary index, all standardized quadruples are traversed, collecting attack records initiated by each attack source IP against target IPs in different security zones at different timestamps. These attack behaviors are then sorted and merged along the time axis. By labeling the unique identifier field of the region to which the attack target belongs, a lateral diffusion path of the attack source in the network structure is constructed, forming a structured attack profile. This profile includes the frequency and type of attacker activity and can reconstruct the attack path sequence from external intrusion to critical core areas, identifying the existence of typical multi-stage attack behaviors, such as attack chain paths that penetrate from the Internet exit zone to the data center zone. Simultaneously, security handling logs are collected from security devices and handling systems in each security zone. The handling status field of each alarm event is extracted through log parsing. The number of successfully handled events is used as the number of completed events, which, together with the total number of alarm events, constitutes the numerator and denominator of the alarm response index. The alarm response efficiency is calculated, quantifying the system's real-time response capability to threats. Data on security response tasks assigned by all security management platforms within the same time window is statistically analyzed. The number of completed tasks and the total number of planned tasks are extracted to calculate the security task implementation rate, measuring the effectiveness of the overall security governance strategy at the execution level and generating a defense profile. Attack target IP fields in all security logs are mapped to their respective regions. The total number of attacks suffered by each region within a specified time window is summarized according to region identifiers. Combined with region weight parameters, a region attack vulnerability index is constructed, forming an attack vulnerability profile reflecting the attack severity and vulnerability of each region.

[0029] In one example, the deep learning-based network threat detection and response system further includes: The event association module is used to establish an event association matrix based on the attack profile and the attacked profile; The attack chain construction module is used to extract event asset pairs whose matrix element values ​​are greater than a preset association threshold from the event association matrix, and arrange the event asset pairs into an attack chain path that includes a complete attack path, a list of attacked assets, and defensive weaknesses. The judgment module is used to divide the cumulative attack equivalent value by the defense strength index to obtain the defense gap value, and to determine whether the defense gap value is greater than a preset gap threshold. When the defense gap value is greater than the preset gap threshold, it marks that the current defense strength is insufficient relative to the attack pressure.

[0030] In this example, attack and victim profiles are loaded within the unified management center, and a two-dimensional event correlation matrix is ​​initialized based on this data. The row indices of the matrix correspond to the identified attack events in the attack profiles, and the column indices correspond to all attacked asset nodes marked in the victim profiles. Each element of the matrix represents the degree of correlation between a particular attack event and a particular asset. The event correlation module uses three factors—temporal correlation, spatial correlation, and behavioral correlation—to calculate the matching degree between temporal proximity, network path reachability, and attack type and asset vulnerability, respectively. These three factors are then multiplied to synthesize the matrix element values, giving each event-asset pair a multi-dimensional semantic meaning, including spatiotemporal causality and behavioral matching. The attack chain construction module filters all event-asset pairs whose matrix element values ​​are higher than a preset correlation threshold from the event correlation matrix, considering them to have a significant causal relationship. These event-asset pairs are sorted in ascending order by timestamp and, combined with the asset's region information and the logic of the cross-domain path of the attack source IP address, are linked to form a complete attack chain path. The attack chain path displays the starting point, jump path, and endpoint asset of the attack behavior, along with a list of attacked assets and security status labels of the regions traversed in the path. While constructing the attack chain, the defense capability indicators of each path node are extracted based on security handling logs and regional protection configurations to identify weak links such as low response efficiency, high vulnerability density, or insufficient depth. The judgment module introduces two values: the cumulative attack equivalent value and the defense strength index. It performs a ratio calculation operation, using the cumulative attack equivalent value as the numerator and the defense strength index as the denominator to obtain the defense gap value under the current network situation. The defense gap value is then compared with a preset gap threshold. When the defense gap value exceeds the preset threshold, it is determined that the current defense system is insufficient in response to external attack pressure, and this state is automatically marked as "defense inadequate".

[0031] In one example, the event association module is specifically used for: The time correlation is calculated based on the attack event timestamp of the attack profile and the attack asset timestamp of the attacked profile. Determine if there is a direct route between the attack source region and the region where the asset is located; When a directly connected route exists, the spatial correlation is taken as the first spatial correlation value; when no directly connected route exists, the spatial correlation is taken as the second spatial correlation value. Calculate the correlation between behaviors based on preset matching rules between attack type and asset type; The temporal correlation, spatial correlation, and behavioral correlation are multiplied to obtain matrix element values, and an event correlation matrix is ​​established based on the matrix element values.

[0032] In this example, within the unified management center, the timestamps recorded for each attack event in the attack profile are compared one-by-one with the timestamps of each attacked asset in the attacked asset profile to calculate the proximity in the time dimension. Using the timestamps of the attack events and the most recent timestamp of the attacked asset as input variables, and setting a time tolerance threshold of 300 seconds, the time correlation is obtained by calculating the absolute difference between the two, dividing by the time tolerance threshold, adding 1, and taking the reciprocal. The smaller the time difference, the closer the time correlation is to 1; when the time difference exceeds the threshold, the time correlation rapidly decays to a low value. Based on the logical network topology relationship between the attack source region and the network region of the attacked asset recorded in the attack event, it is determined whether there is a direct network path between them. If a direct physical or logical connection exists, it indicates that the attack has spatial reachability from the source region to the target asset, and the spatial correlation is assigned a value of 1.0. If the attack path requires passing through at least one transit region, it indicates that its spatial reachability is limited, and the spatial correlation is set to a suboptimal value of 0.5 to reflect the characteristics of higher penetration difficulty, longer links, and more indirect impact. Simultaneously, the degree of matching between attack behavior and asset vulnerability is judged at the behavioral semantic level. This involves assigning a value to the behavioral correlation based on a pre-defined mapping table between attack types and asset types. For example, if the asset type corresponding to an SQL injection attack is a database system, and the target asset is confirmed to be a database server, the behavioral correlation value is 1.0. Similarly, in scenarios such as APT penetration matching centralized systems or lateral movement matching privileged accounts, a high correlation value is set. When there is no clear logical correspondence between the attack type and the target asset type, the behavioral correlation is set to 0.3 to reflect the judgment logic of low event correlation when the behavioral matching degree is insufficient. The time correlation, spatial correlation, and behavioral correlation values ​​are multiplied to obtain the comprehensive correlation value between each pair of attack events and attacked assets. All matrix element values ​​are then filled into the event correlation matrix according to the row and column mapping relationship, where the row index corresponds to the attack event and the column index corresponds to the attacked asset. The matrix dimension is M×N.

[0033] In one example, the attack chain building module is specifically used for: Determine whether the matrix element value in the event association matrix is ​​greater than a preset association threshold, and extract event asset pairs whose matrix element value is greater than the preset association threshold; The event asset pairs are arranged into an attack chain timeline according to the attack timestamps. The attack chain spatial topology map is formed by sequentially connecting the area identifiers of each attack event in the attack path sequence to identify the penetration path. The areas in the defense profile that meet the preset weak conditions are identified as weak points in the defense. The penetration path, the event asset pair, and the weak points in the defense are then combined to form an attack chain path.

[0034] In this example, the event correlation matrix is ​​scanned element-by-element. A fixed correlation threshold is set as the filtering criterion to determine whether the value of each element in the matrix is ​​greater than the preset threshold. When the correlation between an event and a attacked asset exceeds the correlation threshold, it is considered that there is an attack-attack relationship between the event and the asset. Event-asset pairs that meet this condition are extracted and temporarily stored in a temporary structure set. Using the timestamp of the attack event as the main sorting field, all extracted event-asset pairs are arranged in ascending order of time to form a linear attack chain timeline, allowing the development process of the attack behavior to be reconstructed according to the actual time progress. While constructing the timeline, the source IP and target IP regions associated with each event in the attack path are analyzed. A region jump chain is established based on the region identifier field. By sequentially connecting the network regions involved in each attack event, a spatial topology map of the attack chain is constructed, which intuitively shows the attacker's lateral movement and deep penetration path in the network structure, thereby identifying typical attack chain structures, such as multi-hop attack routes from the Internet exit area → office access area → core switching area → data center area. Simultaneously, the attack chain path is analyzed in conjunction with the defense profile. Indicators such as the number of defense-in-depth layers, protection task completion rate, alarm response efficiency, and vulnerability density for each security zone are extracted from the defense profile. These are then combined with pre-defined vulnerability condition judgment rules, such as fewer than 3 defense layers, response efficiency below 0.7, and vulnerability density above 0.2, to identify areas that meet any of these conditions as weak points in the current network defense. The event sequences in the attack chain timeline, the regional connectivity in the spatial topology path, and all identified weak defense areas are then integrated and summarized into an attack chain path structure.

[0035] In one example, the instruction generation module 103 is specifically used for: Calculate the reciprocal of the defensive strength index; The threat score is obtained by weighted summing of the cumulative attack equivalent value, the asset exposure degree, and the reciprocal of the defense strength index. Based on the comprehensive threat score, blocking commands, isolation commands, and flow restriction commands are generated.

[0036] In this example, the defense strength index is input into the command generation module as a quantitative characterization of the overall network defense capability within the current time window. Based on this, a reciprocal calculation is performed to obtain the inverse ratio of defense capability; a larger value indicates a weaker network defense capability. The cumulative attack equivalent value calculated by the attack profiling module, the asset exposure degree calculated by the attacked profiling module, and the reciprocal of the defense strength index are used as joint input parameters and substituted into a weighted scoring function for comprehensive calculation. The attack equivalent weight coefficient α is set to 0.4 to emphasize the dominant role of attack intensity in the overall score. The asset exposure weight coefficient β is set to 0.3, and the reciprocal of the defense capability weight coefficient γ is set to 0.3. The three indicators are multiplied by their respective weights and then summed to form a comprehensive threat score, with a value ranging from 0 to 120, dynamically reflecting the risk level faced by the current network environment. Based on the numerical range of the comprehensive threat score, a multi-level response strategy is executed. When the score exceeds the first-level response threshold (e.g., 80), a high-intensity response mode is automatically entered, generating a blocking command. The command includes a set of attack source IP addresses that contribute more than 10% of the attack volume in the current attack profile. The target of the command is the boundary firewall deployed in the Internet egress zone. The action is to add the relevant IPs to the access control list and set the blocking duration (e.g., 24 hours) to ensure that high-threat sources are isolated immediately. At the same time, if the asset exposure in the attacked profile is higher than the preset percentile threshold, an isolation command is generated simultaneously. The top 10% of attacked assets in terms of exposure are selected, and their corresponding IP addresses are used to issue VLAN isolation commands. The corresponding ports are migrated to the isolation VLAN (e.g., VLAN 999) through the access switch to achieve physical isolation of the target assets. An emergency response command is generated and sent to the on-duty personnel via SMS gateway and email gateway, along with a comprehensive threat score alarm, attack summary, and attacked list. If the score is between 50 and 80, the system enters a medium-intensity response mode, generating a rate-limiting command to restrict the traffic rate of the attacking source IP, specifying the rate-limiting bandwidth (e.g., 10Mbps), and pushing the rate-limiting policy to the traffic management devices in the core switching area. It also generates a monitoring enhancement command to send instructions to the situational awareness platform to increase log collection frequency, enable deep packet inspection, and mirror ports to enhance network monitoring capabilities. When the score is below 50, the system enters a basic-level response phase, generating a log retention command, specifying the event ID to be retained long-term and the log retention period (e.g., 90 days). All commands include a command number, priority, and target device identifier, and are stored in the command queue.

[0037] In one example, the deep learning-based network threat detection and response system further includes: The configuration module is used to extract attack source IPs with an attack equivalent contribution rate greater than a preset contribution rate threshold from the attack profile to form an attack source IP list, and to set the target firewall identifier as a boundary protection device for the blocking command based on the attack source IP list; to extract asset IPs with the highest asset exposure rate from the attacked profile as attacked asset IPs, to set the isolation VLAN identifier and the network access device identifier of the area where the attacked asset IP is located for the isolation command based on the attacked asset IPs, and to set the attack source IP and preset rate limiting bandwidth parameters for the rate limiting command.

[0038] In this example, the attack contribution rate of each attack source IP in the attack profile is calculated and filtered one by one. The ranking is based on the contribution percentage of each attack source IP in the cumulative attack value, with a preset contribution rate threshold, such as 10%. After sorting all attack source IPs, those with an attack contribution rate greater than the threshold are selected, forming an attack source IP list. This list represents the external attack entities that dominate the network threat pressure during the current period. The configuration module binds the attack source IP list to the blocking command's data structure, configures the target device type for the blocking command as "border protection device," i.e., the border firewall of the Internet egress zone, and appends the target firewall identifier to the command parameters to ensure the command can be correctly routed and identified. Simultaneously, the configuration module calls the asset exposure index in the attacked profile, sorts all attacked assets from high to low, and sets a preset percentage threshold, such as the top 10%. Based on this, the top few asset IPs with the highest asset exposure are extracted from the sorting results to form an attacked asset IP set, used for setting the target objects of the isolation command. For each attacked asset IP, the access topology information of its network area is queried to locate the access switching device identifier connected to the attacked asset IP. Based on the isolation policy requirements, each port is configured to switch to a preset isolation VLAN, such as VLAN ID 999. Simultaneously, the VLAN identifier and corresponding access device number are written into the isolation command to ensure that the command is transmitted to the specific network access layer and the isolation action is accurately implemented. The isolation VLAN is pre-configured as a restricted communication environment, allowing communication only with the designated emergency response server in the security management area to avoid the risk of lateral connections between the attacked asset and the business network. In the rate limiting policy generation stage, the IP addresses in the attack source IP list are set as rate limiting targets, and the rate limiting bandwidth parameters (e.g., 10Mbps) are read from the system configuration library and written into the rate limiting command configuration body. The target device is the traffic management device deployed in the core switching area. The rate limiting policy will use the attack source IP as the filtering condition to limit the bandwidth of inbound or outbound traffic initiated by it, achieving risk control and resource protection without interrupting the connection. All configured instructions, along with timestamps, instruction numbers, and priority levels, are pushed to the instruction queue in the unified management center, where they are then scheduled for execution by the dispatch module based on priority.

[0039] In one example, the deep learning-based network threat detection and response system further includes: The instruction issuing module is used to issue the blocking instruction to the boundary protection device through a first communication protocol, issue the isolation instruction to the network access device in the area where the attacked asset is located through a second communication protocol, and issue the flow limiting instruction to the traffic management device through a third communication protocol.

[0040] In this example, based on the instruction queue generated by the configuration module, each instruction is pre-scheduled and sorted according to its bound device type, target device identifier, and priority level to ensure that high-threat-level instructions are processed first. The instruction delivery module selects the appropriate communication protocol channel for different types of target devices. For perimeter protection devices, such as firewalls in the internet egress zone, the first communication protocol, SNMP, is used to transmit blocking instructions. The module encapsulates the instruction content into an SNMP SET operation type data packet, containing fields such as OID identifier, attack source IP list, and blocking time parameters. After receiving the SNMP packet, the firewall dynamically adds the attack source IP to the deny entry in the access control list (ACL), setting the rule priority to the highest to ensure priority matching of blocking policies, and returns instruction execution confirmation via an SNMP response message, including the rule number and configuration status. Simultaneously, for the target device of the isolation instruction—the network access switch connected to the attacked asset—the instruction delivery module uses the second communication protocol, NETCONF, which is based on an XML data model for device management and configuration operations. The module encapsulates the isolation instruction into a NETCONF... <edit-config>The operation request message contains information such as the target port number, isolation VLAN ID, and activation mode. Upon receiving the instruction, the switch immediately performs a port VLAN switch operation, migrating the target port from the service VLAN to the preset isolation VLAN. It also automatically loads the access control policy under the isolation VLAN. This access control policy only allows one-way communication with the emergency response server; all other traffic is rejected. After configuration, the switch will communicate via NETCONF. <rpc-reply>The response message returns the configuration result and execution status. For the target device of the rate limiting command, i.e., traffic management devices such as QoS control gateways deployed in the core switching area or data center, the command issuance module interacts using a third-party communication protocol, RESTful API. The module initiates a request to the rate limiting interface provided by the device via the HTTP POST method. The request URL is such as https: / / deviceIP:8443 / api / v1 / ratelimit. The request body is encapsulated in JSON format, and the content includes parameters such as the attack source IP address, rate limiting bandwidth (e.g., 10Mbps), and rate limiting duration. After receiving the request, the traffic management device automatically generates the corresponding rate limiting policy and adds it to the policy matching table. After the policy is successfully applied, it returns a status code 200 and the policy ID. The command issuance module records the command execution confirmation information accordingly. Throughout the process, the module updates the command status tracking table in real time, recording the issuance time, target device response time, and execution result status. When a command times out or execution fails, an automatic retry mechanism is initiated, and a manual intervention alarm is issued after multiple failed retries. All operation logs are written to the command execution history database.

[0041] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or system that includes that element.

[0042] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A network threat detection and response system based on deep learning, characterized in that, include: The acquisition module is used to acquire standardized datasets from multiple preset security zones; The statistics module is used to calculate the cumulative attack equivalent, defense strength index, and asset exposure based on the standardized dataset. The instruction generation module is used to calculate a comprehensive threat score based on the cumulative attack equivalent value, the asset exposure degree, and the defense strength index, and to generate blocking instructions, isolation instructions, and flow restriction instructions based on the comprehensive threat score. The deep learning-based network threat detection and response system also includes: The event association module is used to establish an event association matrix based on attack profiles and attacked asset profiles. Specifically, the event association module is used to: calculate the temporal correlation degree based on the attack event timestamp of the attack profile and the attacked asset timestamp of the attacked asset profile; determine whether there is a direct connection route between the attack source region and the asset location region; when a direct connection route exists, the spatial correlation degree is set to a first spatial correlation degree value; when no direct connection route exists, the spatial correlation degree is set to a second spatial correlation degree value; calculate the behavioral correlation degree according to a preset matching rule between attack type and asset type; multiply the temporal correlation degree, the spatial correlation degree, and the behavioral correlation degree to obtain matrix element values, and establish an event association matrix based on the matrix element values. The attack chain construction module is used to extract event asset pairs whose matrix element values ​​are greater than a preset association threshold from the event association matrix, and arrange the event asset pairs into an attack chain path that includes a complete attack path, a list of attacked assets, and defensive weaknesses. Specifically, the attack chain construction module is used to: determine whether the matrix element values ​​in the event association matrix are greater than a preset association threshold; extract event asset pairs whose matrix element values ​​are greater than the preset association threshold; arrange the event asset pairs into an attack chain timeline according to attack timestamps; connect them sequentially according to the region identifiers of each attack event in the attack path sequence to form an attack chain spatial topology map, and identify penetration paths; statistically analyze regions in the defense profile that meet preset weakness conditions as defensive weaknesses; and summarize the penetration paths, the event asset pairs, and the defensive weaknesses to form an attack chain path. The judgment module is used to divide the cumulative attack equivalent value by the defense strength index to obtain the defense gap value, and to determine whether the defense gap value is greater than a preset gap threshold. When the defense gap value is greater than the preset gap threshold, it marks that the current defense strength is insufficient relative to the attack pressure.

2. The deep learning-based network threat detection and response system according to claim 1, characterized in that, The acquisition module is specifically used for: Collect security logs from the multiple preset security zones; The attack source IP address, attack target IP address, attack type identifier, and attack timestamp are extracted from the security log. A standardized quadruple is constructed based on the attack source IP address, the attack target IP address, the attack type identifier, and the attack timestamp. Collect asset IP addresses, asset types, and zone identifiers for each security zone to form an asset list, and count the number of layers in the defense-in-depth architecture that includes multiple protection layers; The standardized quadruple, the asset list, and the number of defense-in-depth architecture layers are used as a standardized dataset.

3. The deep learning-based network threat detection and response system according to claim 2, characterized in that, The statistics module is specifically used for: The attack frequency of each attack type in the standardized quadruple in the standardized dataset is counted, and the cumulative attack equivalent value is calculated based on the attack frequency and the preset severity weight. The ratio of the number of layers of the defense-in-depth architecture in the standardized dataset to the preset standard number of layers is calculated and summed to obtain the defense strength index; The number of times an asset is attacked in the standardized dataset is counted, and the product of the preset asset weight and the number of times it is attacked is calculated and accumulated to obtain the asset attack exposure.

4. The deep learning-based network threat detection and response system according to claim 3, characterized in that, The deep learning-based network threat detection and response system also includes: The profiling and analysis module is used to extract attack records of the same attack source IP against targets in different regions at different timestamps to form an attack profile; it collects security handling logs to extract the number of completed events and the total number of alarm events to calculate alarm response efficiency, and counts the number of completed tasks and the total number of planned tasks to obtain a defense profile; it counts the number of attacks suffered by each region to obtain an attack profile.

5. The deep learning-based network threat detection and response system according to claim 1, characterized in that, The instruction generation module is specifically used for: Calculate the reciprocal of the defensive strength index; The threat score is obtained by weighted summing of the cumulative attack equivalent value, the asset exposure degree, and the reciprocal of the defense strength index. Based on the comprehensive threat score, blocking commands, isolation commands, and flow restriction commands are generated.

6. The deep learning-based network threat detection and response system according to claim 5, characterized in that, The deep learning-based network threat detection and response system also includes: The configuration module is used to extract attack source IPs with an attack equivalent contribution rate greater than a preset contribution rate threshold from the attack profile to form an attack source IP list, and to set the target firewall identifier as a boundary protection device for the blocking command based on the attack source IP list; to extract asset IPs with the highest asset exposure rate from the attacked profile as attacked asset IPs, to set the isolation VLAN identifier and the network access device identifier of the area where the attacked asset IP is located for the isolation command based on the attacked asset IPs, and to set the attack source IP and preset rate limiting bandwidth parameters for the rate limiting command.

7. The deep learning-based network threat detection and response system according to claim 6, characterized in that, The deep learning-based network threat detection and response system also includes: The instruction issuing module is used to issue the blocking instruction to the boundary protection device through a first communication protocol, issue the isolation instruction to the network access device in the area where the attacked asset is located through a second communication protocol, and issue the flow limiting instruction to the traffic management device through a third communication protocol.

Images