A Network Security Situation Assessment Method Based on BIPMU

Abstract

This invention relates to the field of network security technology, and in particular to a method for assessing the network security situation of wireless networks based on BIPMU. The method constructs a training model using bidirectional simplified memory units to learn and represent features of time-series data and provide theoretical analysis. Compared with traditional recurrent neural networks, this method considers not only past transmitted information but also future transmitted information, comprehensively and effectively managing the potential relationships between short-term and long-term dependencies in time-series data. Furthermore, by acquiring relevant network security elements to analyze and judge the network security status, it improves the effectiveness of network security situation assessment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for assessing the network security situation of wireless networks based on BIPMU. Background Technology

[0002] Significant progress has been made in research on Network Security Situation Assessment (NSSA). Existing NSSA methods mainly include those based on mathematical statistics, knowledge reasoning, and machine learning. However, with the continuous development of wireless network technology and the increasing number of network domain security incidents, assessment datasets are becoming increasingly large-scale and high-dimensional. Furthermore, assessment datasets are often time-series, posing challenges to existing NSSA methods.

[0003] Due to the rapid development of wireless networks, their data is typically large-scale and high-dimensional. This often leads to large-scale and complex calculations when applying existing mathematical statistics methods to current NSSA (Network Traffic Assistance Systems), reducing the accuracy of assessments. Simultaneously, the sheer size and complexity of the data impact expert judgment. This makes knowledge reasoning methods increasingly inadequate for current NSSA. While traditional machine learning methods can alleviate these problems to some extent, the advent of 5G has resulted in a geometrical increase in the scale of network traffic data. Traditional machine learning methods are also encountering bottlenecks in current NSSA.

[0004] Deep neural networks (NNNs) possess excellent representation capabilities for high-dimensional and complex data, and most existing deep neural network-based nonlinear symmetric analysis (NSSA) methods are based on backpropagation neural networks (BPNNs) and have achieved good results. However, they do not consider the typically high temporal sequence of existing network traffic data. Furthermore, existing recurrent neural networks, such as gated recurrent units (GRUs), often struggle to effectively handle short-term and long-term potential relationships between data points. Summary of the Invention

[0005] The purpose of this invention is to provide a network security situation assessment method for wireless networks based on BIPMU, aiming to overcome the technical problem that existing methods based on statistical analysis, knowledge reasoning and ordinary machine learning cannot effectively perform feature learning and representation, and to more accurately and effectively assess the current network status.

[0006] To achieve the above objectives, this invention provides a method for assessing the network security situation of a wireless network based on BIPMU, comprising the following steps:

[0007] Construct an evaluation dataset;

[0008] The evaluation dataset is divided into a training set and a test set, and the training set is input into the training model for training.

[0009] The evaluation elements of the test set are input into the trained model to obtain the situation value;

[0010] The effectiveness of the model is verified by comparing the stated situation value with the actual value.

[0011] The evaluation dataset is constructed by initializing and preprocessing the original network traffic dataset and then using a custom indicator system.

[0012] The aforementioned custom indicator system is generally a system of indicators that the user builds themselves. It can be constructed using methods such as AHP, and does not require specific standards. Everything is based on the user's own settings.

[0013] The training model is a recurrent neural network built on bidirectional simplified memory units, which includes two different simplified memory units.

[0014] The training cycle for the training model needs to be specified at the time of input.

[0015] The situational values ​​are divided into different ranges based on the values ​​of network security situational values, including safe, low risk, medium risk, high risk, and emergency.

[0016] This invention provides a wireless network security situation assessment method based on BIPMU. By constructing a training model through bidirectional simplified memory units, it performs feature learning and representation of time series data and provides theoretical analysis. Compared with traditional recurrent neural networks, this method not only considers information transmitted in the past but also information transmitted in the future, comprehensively and effectively managing the potential relationships between short-term and long-term dependencies in time series data. At the same time, by acquiring relevant network security elements to analyze and judge the network security status, it improves the effectiveness of network security situation assessment. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a wireless network security situation assessment method based on BIPMU according to the present invention.

[0019] Figure 2 This is a schematic diagram of the simplified memory unit (PMU) model structure.

[0020] Figure 3 This is a schematic diagram of the Bidirectional Minimalist Memory Unit (BIPMU) model structure.

[0021] Figure 4 This is a schematic diagram of the NSSA model structure based on BIPMU of the present invention.

[0022] Figure 5 This is a comparison chart of loss values ​​for different methods in experiments of specific embodiments of the present invention.

[0023] Figure 6 This is a comparison chart of the evaluation effects of different algorithms under macroscopic average in a specific embodiment of the present invention.

[0024] Figure 7 This is a comparison chart of the evaluation effects of different algorithms under weighted average in specific embodiments of the present invention.

[0025] Figure 8 This is a line graph showing the fitted values ​​of the evaluated values ​​and the true values ​​in a specific embodiment of the present invention.

[0026] Figure 9 This is a comparison chart of the efficiency of different evaluation methods in specific embodiments of the present invention. Detailed Implementation

[0027] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0028] Please see Figure 1 This invention proposes a method for assessing the network security situation of wireless networks based on BIPMU, comprising the following steps:

[0029] S1: Construct the evaluation dataset;

[0030] S2: Divide the evaluation dataset into a training set and a test set, and input the training set into the training model for training;

[0031] S3: Input the evaluation elements of the test set into the trained model to obtain the situation value;

[0032] S4: Compare the stated situation value with the actual value to verify the effectiveness of the model.

[0033] The evaluation dataset is constructed by initializing and preprocessing the original network traffic dataset and then using an indicator system.

[0034] The training model is a recurrent neural network built on bidirectional simplified memory units, which include two different simplified memory units.

[0035] The training cycle for the training model needs to be specified at the time of input.

[0036] The situational values ​​are divided into different ranges based on the values ​​of network security situational values, including safe, low risk, medium risk, high risk, and emergency.

[0037] Furthermore, this invention will be illustrated by combining the basic structure and specific embodiments of the bidirectional parsimonious memory unit (BIPMU):

[0038] 1. Simple Memory Unit (PMU)

[0039] Before introducing BIPMU, let's first introduce PMU. PMU is a recurrent neural network derived from the gated recurrent unit (GRU). Unlike the GRU, which has two types of gate structures, PMU has only one type of gate structure, namely the unit gate, such as... Figure 1 As shown. It has fewer parameters. Compared to GRU, PMU can better manage the potential relationships between short-term and long-term dependencies. Therefore, PMU can achieve better results when trained on time series data.

[0040] Please see Figure 2 ,exist Figure 2 In the middle, using U t These represent cell gates, replacing the GRU's reset and update gates to control the long-term and short-term correlations of the data. The PMU forward propagation learning method is as follows:

[0041] First, U t The state is determined by the current input state X. t and the hidden state h of the previous node t-1 Decide:

[0042] U t =σ(W u ·[h t-1 ,x t (1)

[0043] Secondly, the candidate set used to record the current state It can be represented as:

[0044]

[0045] Third, h t The update formula is as follows:

[0046]

[0047] 2. Bidirectional Minimalist Memory Unit (BIPMU)

[0048] Typically, recurrent neural networks (RNNs) predict the future output of the next time step based on information from the time series data of the previous time step. However, the output of the current time step often depends not only on the state information of the previous time step but also on the state information of future time steps. Therefore, a novel bidirectional recurrent neural network, BIPMU, is proposed, such as... Figure 3 As shown, unlike primitive bidirectional recurrent neural networks such as BIGRU, BIPMU has fewer parameters and is more efficient. Furthermore, because the PMU can effectively manage the potential connections between short-term and long-term dependencies, BIPMU performs better in processing time series data.

[0049] exist Figure 3 In the middle, h' i and h i This represents the current time information output by two different PMUs. X i This represents the input. You can see the current PMU output, such as Y0, which consists of two parts: h b0 and h f0 Among them, h b0 h represents the output of the PMU that learns future state information. f0 This represents the output of the PMU, which learns information from past states. This allows the BIPMU to comprehensively learn information from both the past and future, and then obtain the output at the current moment. The output process of the BIPMU combined with the fully connected layer is as follows:

[0050] First, concatenate the current state information of two different PMUs:

[0051] h ti =cat(h bi ,h fi (4)

[0052] Secondly, the current state of the splicing is passed to the fully connected layer to obtain the output Y. i :

[0053] Y i =softmax(W o ·h ti (5)

[0054] 3. System Model Based on BIPMU

[0055] Please see Figure 4 Specifically, this invention proposes a novel bidirectional recurrent neural network, called BIPMU, and then uses BIPMU as the main implementation method for NSSA. Compared with other deep neural networks, BIPMU can not only use the state information of the previous time step as the basis for the current output, but also use the state information of future time steps as the basis for the current output. In addition, BIPMU has the advantages of PMU. Compared with other recurrent neural networks such as bidirectional gated recurrent units (BIGRU), it can better manage the potential relationships between short-term and long-term dependencies in time-series data, and has fewer parameters. This makes the proposed BIPMU-based NSSA model have better performance.

[0056] 4. Time Complexity Analysis

[0057] Time complexity is one of the important metrics for evaluating the performance of an algorithm. For the purpose of subsequent comparative experiments, this invention will analyze and compare the time complexities of PMU, BPNN, and DAE. As shown in Table 1...

[0058] Before calculating the time complexity of BIPMU, assume the input data dimension is m and the hidden layer dimension of BIPMU is n. The time complexity of BIPMU will then be calculated because a BIPMU consists of two different PMUs, such as... Figure 3 As shown. Therefore, the total number of operations of the PMU is calculated first. First, according to formula (1), U t The number of operations can be expressed as T(n×m+n) 2 +n). Next, according to formula (2), calculate... The number of operations is T(n×m+2×n) 2 +n). Third, according to formula (3), h t The number of operations is T(n) 2 +2×n). Finally, the total number of operations for the PMU is T(2×n×m+4×n). 2 +4×n), with a time complexity of O(n). 2 Therefore, the total number of operations for BIPMU is T(2×(2×n×m+4×n)). 2 +4×n). In summary, the time complexity is O(n^2). 2 ).

[0059] Generally, a BPNN consists of multiple fully connected layers, and the total number of operations can be considered as the sum of the operations between network layers. Assuming the output dimension is l and k is the number of hidden layers, the number of operations in the input layer can be considered as T(m×n), the operations in the remaining hidden layers as T(n×n), and the output layer as T(n×l). Therefore, the total number of operations in a BPNN can be considered as T(m×n+k(n×n)+n×l), with a time complexity of O(n^2). 2 Furthermore, the total number of operations and time complexity of DAE based on fully connected layers are the same as those of BPNN.

[0060] Table 1 Comparison of Time Complexity

[0061]

[0062] The present invention also uses experiments to compare and analyze specific embodiments.

[0063] 5. Experimental Environment and Dataset

[0064] All experiments were conducted on a desktop computer equipped with an AMD Ryzen 5 3500X 6-core CPU running at 3.60GHz, an NVIDIA GeForce GTX 2060 SUPER graphics card, and 16GB of RAM. The desktop computer ran Windows 10, CUDA 10.0 driver, and cuDNN 7.4.2 driver.

[0065] The dataset used in the simulation experiment was the UNSW-NB15 dataset, created by the Australian Cyber ​​Security Centre using the IXIA PerfectStorm tool. The IXIA PerfectStorm tool supports over 35,000 malicious attacks across more than 245 application protocols, simulating millions of real-world end-user environments to generate large-scale network traffic data. This is currently the most widely recognized public dataset for network intrusion detection in the cybersecurity field.

[0066] The IXIA traffic generator is configured with three virtual servers. Servers 1 and 3 are configured to propagate normal traffic, while server 2 generates anomalous / malicious activity in network traffic. The servers are connected to the host via two routers, which are in turn connected to firewall devices. The UNSW-NB15 dataset was captured using the method shown in the topology diagram, employing the tcpdump5 tool to capture network traffic in packet form twice, once for 15 hours and once for 16 hours. A total of 100GB of network traffic was captured, and 2,540,044 data entries were stored in four CSV files.

[0067] The UNSW-NB15 dataset covers nine modern and common network attacks. Each record consists of 47 distinct features and 2 labels, totaling 300,000 anomalous records, as shown in Table 2.

[0068] Table 2 UNSW-NB15 dataset

[0069]

[0070] As shown in Table 2, the dataset covers 9 different attack categories, detailed as follows:

[0071] (1) Analysis: Intrusion methods for penetrating web applications through email, web, scripts, ports, etc.;

[0072] (2) Backdoor: An intrusion method that bypasses system security mechanisms through technical principles to evaluate a computer or its data;

[0073] (3) DoS: Intentionally attacking network protocol implementation defects or directly using brute force to exhaust the resources of the attacked object, thereby making the target network unable to use services or resources;

[0074] (4) Vulnerability Exploitation: An attack that exploits an attacker's information about security vulnerabilities in an operating system or software;

[0075] (5) Obfuscator: A type of attack in which an attacker supplies a program or network with a large number of random numbers to shut it down;

[0076] (6) Attribute method: Regardless of the password configuration, a hash function is used to resolve collisions;

[0077] (7) Probing: an attack used to collect computer information, also known as probing;

[0078] (8) Shellcode: Attackers use shell commands and a small amount of code to control the attack mode of the attacked host;

[0079] (9) Worm: A worm attack is a virus attack that can replicate to the controlling host without any operation.

[0080] For experimental convenience, the UNSW-15NB dataset was statistically analyzed every 10 minutes. UNSW-15NB was processed using evaluation metrics, generating 144 situation values ​​as experimental samples. The first 100 were used as the training set, and the last 44 as the test set. Furthermore, the network security situation values ​​ranged from 0 to 10. Therefore, a situation value of 0-2 indicates secure, 3-4 indicates low risk, 5-6 indicates moderate risk, 7-8 indicates high risk, and a situation value greater than 8 indicates an emergency situation.

[0081] 6. Experimental Standards

[0082] In this experiment, Accuracy, Precision, Recall, and F1 score were used to evaluate the effectiveness of our NSSA method. Some of these concepts are defined as follows:

[0083] True positive (TP): TP indicates that a positive sample was evaluated as a positive sample;

[0084] False positive (FP): FP indicates that a negative sample was evaluated as a positive sample;

[0085] True negative (TN): TN indicates that a negative sample was evaluated as a negative sample;

[0086] False negative (FN): FN means that a positive sample was evaluated as a negative sample.

[0087] The confusion matrices for TP, FP, TN, and FN are shown in Table 3.

[0088] Table 3 Confusion Matrix

[0089]

[0090] Accuracy: The proportion of correctly identified samples out of the total number of samples.

[0091]

[0092] Precision: The proportion of actual positive samples out of the total number of identified positive samples.

[0093]

[0094] Recall: The percentage of correctly predicted positive examples in the sample.

[0095]

[0096] F1 score: It takes into account both the precision and recall of the classification model.

[0097]

[0098] Macro-averaging: This method takes into account the significant role of small samples in the total sample. Precision, Recall, and F1 score for each class on each confusion matrix are calculated, and then the average is calculated.

[0099] Weighted average: This method takes into account the imbalance of each sample class. First, the Precision, Recall, and F1 score for each class on each confusion matrix are calculated, and then a weighted average is calculated.

[0100] 7. Model fit analysis

[0101] The model fit of the NSSA evaluation methods based on BIPMU, PMU, AEDNN, and GA-BP was compared using loss values. Figure 5 As shown.

[0102] like Figure 5 As shown in Table 4, the BIPMU-based NSSA evaluation method performs better in terms of loss reduction, exhibiting a faster rate of decrease compared to the other three methods. Table 4 also shows that the BIPMU-based NSSA evaluation method has the lowest final loss, followed by the PMU-based NSSA evaluation method. This indicates that the BIPMU-based NSSA evaluation method has a better model fit compared to the other three methods. In our analysis, this is because, compared to the other two methods, the BIPMU-based and PMU-based NSSA evaluation methods consider the temporal sequence of the dataset. Furthermore, the BIPMU-based NSSA evaluation method also considers future information compared to the PMU-based NSSA evaluation method.

[0103] Table 4 Loss Values

[0104]

[0105] 8. Effectiveness Assessment

[0106] The effectiveness of NSSA assessment methods based on BIPMU, PMU, AEDNN, and GA-BP was compared. While threat data constitutes a relatively small percentage of the assessment, its importance cannot be ignored. Therefore, macro-averaging and weighted averaging were used to calculate Precision, Recall, and F1 score. Experimental results for macro-averaging calculation are shown below. Figure 6 As shown.

[0107] Figure 6The performance of four different NSSA methods from Accuracy, Precision, Recall, and F1 score was evaluated. Under the macro-average method, the BIPMU-based NSSA evaluation method performed best in all aspects. This is because the GA-BP-based and AEDNN-based NSSA evaluation methods do not consider the temporal order of the dataset. The PMU-based NSSA evaluation method's output at the current time only refers to information transmitted in the past time and does not consider information transmitted in the future time.

[0108] Figure 7 The evaluation results of four different methods—Precision, Recall, and F1_score—under the weighted average method are shown. It can be seen that the NSSA evaluation method based on BIPMU still performs best under the weighted average method.

[0109] 9. Evaluation of the goodness of fit of the results

[0110] Please see Figure 8 In this invention, line graphs are used to show the fit between the evaluation results of the four methods and the actual results.

[0111] from Figure 8 It can be seen that when the sample sizes are 2, 13, 31, and 33, the network assessment situation values ​​fluctuate significantly, indicating that the network threats in all four time periods are relatively strong. The third sample shows a "medium risk" warning, indicating that the network faces a higher level of attack threat during this time period, and corresponding security measures should be taken accordingly. Samples 12 and 31 show "high risk" warnings, indicating that the network state is extremely dangerous at this time, and security personnel should be dispatched to the network for timely rescue during this period. Based on the degree of fit between the evaluation curve and the actual curve, it can be seen that the evaluation scenario values ​​obtained by our proposed method are consistent with the actual scenario values. Among the other three assessment methods, the PMU-based NSSA assessment method has one error, while the AEDNN-based and GA-BP-based NSSA assessment methods have two errors each.

[0112] It is clear from the results and reasons above that the NSSA evaluation method based on BIPMU is more suitable for the current network environment.

[0113] 10. Efficiency Analysis

[0114] Among the four methods mentioned above, the GA-BP evaluation method introduces a new iteration cycle. Therefore, under the same conditions, its computational cost is often much higher than that of other neural networks. Therefore, in this paper, we only compare the efficiency of NSSA based on BIPMU, PMU, and AEDNN. Figure 9 As shown.

[0115] from Figure 9 It can be seen that the NSSA evaluation method based on BIPMU has the longest running time, followed by the NSSA evaluation method based on AEDNN, and the NSSA evaluation method based on PMU has the shortest running time. Previously, the total number of operations for AEDNN could be calculated as T(2×(m×n+n)). 2 +n×l)), with a time complexity of O(n 2 Although AEDNN performs fewer operations in total than PMU, its training cycle count is greater than the other two methods because AEDNN consists of DAE and DNN. Therefore, AEDNN has a longer runtime than PMU.

[0116] Comparing the total number of operations and time complexity reveals that although BIPMU has a higher total number of operations, it has the same time complexity as PMU and AEDNN. Experimental comparisons show that while the BIPMU-based NSSA evaluation method has the longest runtime, the difference in runtime compared to the other two evaluation methods is not significant. Furthermore, the BIPMU-based NSSA evaluation method significantly improves the overall performance of situation assessment.

[0117] In summary, in large-scale and complex network environments, network data exhibits high dimensionality, diversity, and randomness. This renders existing NSSA methods inadequate in terms of performance and efficiency. This invention proposes a BIPMU-based NSSA method. Specifically, a novel bidirectional recurrent neural network (BIPMU) is first proposed. Then, NSSA is implemented using BIPMU. The performance of NSSA is effectively improved by utilizing BIPMU. Finally, the proposed BIPMU-based NSSA method is implemented using a simulation model, and experimental analysis is provided. Experimental results show a significant improvement in evaluation performance compared to existing NSSA methods.

[0118] The above description discloses only one preferred embodiment of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A method for assessing the network security situation of a wireless network based on BIPMU, characterized in that, Includes the following steps: Construct an evaluation dataset; The evaluation dataset is divided into a training set and a test set, and the training set is input into the training model for training. The training model is a recurrent neural network built on bidirectional simplified memory units, which includes two different simplified memory units. The simplified memory units and the gated recurrent units have two different gate structures, while the gated recurrent units have only one gate structure, namely the unit gate. Unit door U t The state is determined by the current input state X. t and the hidden state h of the previous node t-1 The decision is expressed as follows: U t =σ(W u ·[h t-1 ,x t ]) The output process of the bidirectional simplified memory unit combined with the fully connected layer is as follows: First, concatenate the current state information of two different simplified memory units: h ti =cat(h bi ,h fi ) Secondly, the current state of the splicing is passed to the fully connected layer to obtain the output Y. i : Y i =softmax(W o ·h ti ) Among them, h bi h represents the output of the simplified memory unit that learns information about future states. fi The output of the simplified memory unit that learns past state information; The evaluation elements of the test set are input into the trained model to obtain the situation values; The effectiveness of the model is verified by comparing the stated situation value with the actual value.

2. The wireless network security situation assessment method based on BIPMU as described in claim 1, characterized in that, The evaluation dataset is constructed by initializing and preprocessing the original network traffic dataset and then using a custom indicator system.

3. The wireless network security situation assessment method based on BIPMU as described in claim 1, characterized in that, The training cycle for the training model needs to be specified at the time of input.

4. The wireless network security situation assessment method based on BIPMU as described in claim 1, characterized in that, The situational values ​​are divided into different ranges based on the values ​​of network security situational values, including safe, low risk, medium risk, high risk, and emergency.

Images