Network security defense system, method, device and storage medium

Abstract

The application provides a network security defense system, method, device and storage medium, and relates to the technical field of network security, wherein the network security defense system comprises a network security module, an active defense module, a strategy evaluation module and a passive defense module; the network security module is connected with the active defense module and the strategy evaluation module respectively; the strategy evaluation module is connected with the passive defense module; the network security module determines a target attack category and target countermeasure strategy cluster information for coping with the target attack category by self-learning intrusion warning information through the active defense module in response to acquired intrusion warning information; when the target strategy effectiveness information generated after the network security module executes the target countermeasure strategy cluster information represents that the strategy is successful, the strategy evaluation module generates indication information of active defense success, and the passive defense module is caused to execute passive defense. The use of the network security defense system can greatly improve the reliability and security of the network security defense system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security defense system, method, device and storage medium. Background Technology

[0002] As a product of technological development, the Internet plays an important role in human society. However, the resulting cybersecurity issues have become a common pain point for both users and service providers. Due to the characteristics of malicious attacks on computer networks, such as high harm, ease of implementation, wide range, and strong concealment, how to establish cybersecurity defenses has become a research hotspot in the field of cybersecurity.

[0003] In related technologies, existing network security defense systems typically use pre-set identification rules to identify the attack category of network intrusion information. When an attack category is identified, a corresponding countermeasure strategy is selected from the existing countermeasure strategy library, and then the selected countermeasure strategy is used to block the malicious attack. When no attack category is identified, passive defense is carried out using methods such as vulnerability patching and firewalls.

[0004] However, determining the attack category solely through fixed identification rules cannot guarantee the accuracy of attack category identification. Furthermore, when the identification rules fail to identify the attack category, passive defense alone cannot ensure network security, resulting in low reliability and security of existing network security defense systems. Summary of the Invention

[0005] This invention provides a network security defense system, method, device, and storage medium to address the shortcomings of existing network security defense systems, which rely solely on fixed identification rules to determine attack categories and passively defend against malicious attacks when no attack category is identified using the identification rules. This results in low reliability and security. The invention achieves a significant improvement in the reliability and security of the network security defense system by first using target adversarial strategy cluster information obtained through self-evolutionary learning of network intrusion information to proactively defend against malicious attacks, followed by passive defense.

[0006] This invention provides a network security defense system, comprising a network security module, an active defense module, a policy evaluation module, and a passive defense module. The network security module is connected to both the active defense module and the policy evaluation module, and the policy evaluation module is connected to the passive defense module.

[0007] The network security module is used to obtain intrusion warning information;

[0008] The active defense module is used to determine target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and multiple target countermeasure strategies for dealing with the target attack category;

[0009] The network security module is used to execute the target adversarial strategy cluster information and determine the target strategy effectiveness information;

[0010] The strategy evaluation module is used to generate indication information indicating that the active defense is effective when the target strategy effectiveness information characterizes the strategy as successful.

[0011] The passive defense module is used to perform passive defense based on the indication information.

[0012] According to a network security defense system provided by the present invention, the active defense module includes a policy cluster library unit and a self-learning unit, wherein the policy cluster library unit and the self-learning unit are connected; wherein:

[0013] The strategy cluster library unit is used to identify attack categories based on the intrusion warning information, determine the first identified attack category, and determine the first countermeasure strategy cluster information of the first attack category based on the pre-stored mapping relationship between attack category and countermeasure strategy cluster information.

[0014] The network security module is used to execute the first adversarial strategy cluster information, determine the first strategy effectiveness information, and send an adversarial strategy learning instruction to the self-learning unit when the first strategy effectiveness information indicates that the strategy has failed.

[0015] The strategy evaluation module is used to close the connection path when the first strategy effectiveness information indicates that the strategy has failed.

[0016] The self-learning unit is used to perform self-learning on the intrusion warning information based on the adversarial strategy learning instruction, and determine the target adversarial strategy cluster information that matches the intrusion warning information.

[0017] According to a network security defense system provided by the present invention, the self-learning unit is further configured to perform self-learning on the intrusion warning information based on the adversarial strategy learning instruction, and predict a second attack category and second adversarial strategy cluster information for dealing with the second attack category; the second adversarial strategy cluster information contains adversarial strategy information that is different from the first adversarial strategy cluster information.

[0018] The network security module is configured to execute the second adversarial strategy cluster information, determine the second strategy effectiveness information, and continue to send adversarial strategy learning instructions to the self-learning unit when the second strategy effectiveness information indicates strategy failure; until the self-learning unit determines the target adversarial strategy cluster information through self-learning; or to determine the second adversarial strategy cluster information determined by the self-learning unit as the target adversarial strategy cluster information when the second strategy effectiveness information indicates strategy success.

[0019] According to a network security defense system provided by the present invention, the policy evaluation module is further configured to open a connection path and generate indication information indicating that the active defense is effective when the second policy effectiveness information characterizes the policy as successful.

[0020] According to a network security defense system provided by the present invention, an attack detection module is further included, which is connected to the network security module; the attack detection module is used to detect suspicious signals carrying network malicious intrusion identifiers in real time, generate intrusion warning information based on the suspicious signals, and send the intrusion warning information to the network security module.

[0021] According to a network security defense system provided by the present invention, an information collection module is further included, which is connected to the passive defense module and the active defense module respectively; the information collection module is used to collect and encapsulate the target attack category and the target countermeasure strategy cluster information when the active defense and passive defense against the intrusion warning information are completed.

[0022] The active defense module is also used to perform strategy self-evolution based on the encapsulated target attack category and the target adversarial strategy cluster information.

[0023] According to a network security defense system provided by the present invention, the self-learning unit includes an autoencoder, a softmax classifier, and a generalized filter, wherein the autoencoder is sequentially connected to the softmax classifier and the generalized filter; wherein:

[0024] The autoencoder is used to autoencode the intrusion warning information to determine the target feature data and target tag data of the intrusion warning information;

[0025] The softmax classifier is used to perform probability prediction on the target feature data and the target label data to determine the target prediction probability of the intrusion warning information;

[0026] The generalization filter is used to determine the target attack category corresponding to the target prediction probability and the policy generalization condition of this self-learning based on the target prediction probability, and then filter out target adversarial policy cluster information matching the target attack category from the policy cluster library unit based on the policy generalization condition; wherein, the policy generalization condition is determined based on the generalization step size of this self-learning, the target prediction probability policy generalization condition, and the maximum prediction probability in the classification domain.

[0027] According to a network security defense system provided by the present invention, the training process of the self-learning unit is a process of training an initial autoencoder and an initial softmax classifier, including:

[0028] Construct a trainable network model containing an initial autoencoder and an initial softmax classifier;

[0029] A training sample set is determined, wherein each training sample in the training sample set is a sample intrusion warning message, and the sample attack category corresponding to each sample intrusion warning message is determined;

[0030] The training sample set is used to train the network model to be trained, and the sample prediction probability set output by the intermediate network model after a preset number of training times is obtained. The sample prediction probability set is used to characterize the predicted probability that each sample intrusion warning information belongs to a different sample attack category.

[0031] Determine the maximum sample prediction probability in the sample prediction probability set, and determine the predicted attack category corresponding to the maximum sample probability;

[0032] Based on the successful matching results between the predicted attack category and the sample attack category, the corresponding autoencoder and softmax classifier are determined when training stops.

[0033] According to a network security defense system provided by the present invention, the self-learning unit is further used to optimize learning parameters during the process of determining the target adversarial strategy cluster information.

[0034] This invention provides a network security defense method, comprising:

[0035] Obtain intrusion warning information;

[0036] Determine target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category;

[0037] Execute the target adversarial strategy cluster information to determine the target strategy effectiveness information;

[0038] When the target strategy effectiveness information characterization strategy is determined to be successful, an indication message characterizing the active defense is generated.

[0039] Passive defense is executed based on the indicated information.

[0040] According to a network security defense method provided by the present invention, determining the target adversarial strategy cluster information matching the intrusion warning information includes:

[0041] Based on the pre-stored mapping relationship between attack categories and countermeasure strategy cluster information, the intrusion warning information is used to identify the attack category;

[0042] Based on the failure of attack category identification, the intrusion warning information is self-learned to determine the target attack category and the target countermeasure strategy cluster information corresponding to the target attack category.

[0043] According to a network security defense method provided by the present invention, the method further includes:

[0044] Based on the successful attack category identification result, the first attack category is determined, and based on the mapping relationship between the attack category and the adversarial strategy cluster information, the first adversarial strategy cluster information is determined.

[0045] When the first strategy effectiveness information obtained after executing the first countermeasure strategy cluster information indicates that the strategy has failed, the intrusion warning information is self-learned to determine the second attack category and the second countermeasure strategy cluster information for dealing with the second attack category.

[0046] When the second strategy effectiveness information obtained after executing the second adversarial strategy cluster information indicates that the strategy is successful, the second attack category is determined to be the target attack category, and the second adversarial strategy cluster information is the target adversarial strategy cluster information.

[0047] According to a network security defense method provided by the present invention, the method further includes:

[0048] When it is determined that active and passive defenses against the intrusion warning information have been completed, collect and encapsulate the target attack category and the target countermeasure strategy cluster information;

[0049] The strategy self-evolution is performed based on the encapsulated target attack category and the target adversarial strategy cluster information.

[0050] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the network security defense methods described above.

[0051] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network security defense method as described above.

[0052] The network security defense system, method, device, and storage medium provided by this invention, wherein the network security defense system, upon receiving intrusion alarm information, first uses an active defense module to determine the target attack category and target adversarial strategy cluster information for countering the target attack category through self-learning of the intrusion alarm information. After the network security module executes the target adversarial strategy cluster information, the generated target policy effectiveness information indicates successful policy implementation. Then, the policy evaluation module generates an indication of successful active defense, causing the passive defense module to execute passive defense. This combination with a self-learning approach effectively improves the reliability and accuracy of attack category identification. Furthermore, by first using the target adversarial strategy cluster information obtained through self-evolutionary learning of network intrusion information to actively defend against malicious attacks, and then implementing passive defense, the reliability and security of the network security defense system are significantly improved. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0054] Figure 1 This is one of the structural schematic diagrams of the network security defense system provided by the present invention;

[0055] Figure 2 This is the second structural schematic diagram of the network security defense system provided by the present invention;

[0056] Figure 3 This is one of the flowcharts illustrating the network security defense method provided by the present invention;

[0057] Figure 4 This is the second flowchart illustrating the network security defense method provided by the present invention;

[0058] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0060] The following is combined with Figures 1-5 This invention describes a network security defense system, method, device, and storage medium.

[0061] Reference Figure 1 This is a schematic diagram of the network security defense system provided by the present invention, as shown below. Figure 1 As shown, the network security defense system includes a network security module, an active defense module, a policy evaluation module, and a passive defense module. The network security module is connected to both the active defense module and the policy evaluation module, and the policy evaluation module is connected to the passive defense module.

[0062] The network security module is used to obtain intrusion warning information;

[0063] The proactive defense module is used to determine the target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and multiple target countermeasure strategies to deal with the target attack category;

[0064] The network security module is used to execute target adversarial strategy cluster information and determine target strategy effectiveness information;

[0065] The strategy evaluation module is used to determine the effectiveness of the target strategy and generate indication information indicating that the proactive defense is effective when the strategy is successful.

[0066] The passive defense module is used to perform passive defense based on indication information.

[0067] Specifically, intrusion warning information is used to characterize suspicious signals of malicious attacks. When the network security module receives an intrusion warning information, it first sends the intrusion warning information to the active defense module to instruct the active module to determine the target attack category corresponding to the intrusion warning information and the target countermeasure strategy cluster information for dealing with the target attack category. At this time, the network security module executes the target countermeasure strategy cluster information for the intrusion warning information and determines the target policy effectiveness information generated after executing the target countermeasure strategy cluster information. If the target policy effectiveness information indicates that the policy is successful, the target policy effectiveness information is sent to the policy evaluation module, so that the policy evaluation module generates indication information indicating that the active defense is effective. Finally, the passive defense module performs passive defense when the active defense is effective.

[0068] The intrusion warning information includes, but is not limited to, detailed intrusion information such as intrusion timestamp, target ID, identification status, and attack category; the intrusion warning information includes, but is not limited to, the following fields: intrusion timestamp (string type, used to indicate the time of intrusion); source IP (string type, used to indicate the origin of the intrusion); target IP (string type, used to indicate the target IP of the intrusion); source port (integer type, used to indicate the source port of the intrusion); destination port (integer type, used to indicate the destination port of the intrusion); identification status (boolean type, used to indicate whether the malicious attack category was successfully identified); attack category (string type, used to indicate the identified attack category); policy effectiveness information is a boolean type indicating whether the policy was successful, for example, "true" for a successful policy and "false" for a failed policy; and passive defense includes, but is not limited to, vulnerability patching, firewalls, virus protection, and methods such as packet filtering using Access Control Lists (ACLs).

[0069] The network security defense system provided by this invention involves a network security module that, upon receiving intrusion alarm information, first uses an active defense module to self-learn the intrusion warning information to determine the target attack category and the target adversarial strategy cluster information for countering that attack category. Once the network security module executes the target adversarial strategy cluster information and generates target policy effectiveness information indicating successful policy execution, a policy evaluation module generates an active defense success indication, causing the passive defense module to execute passive defense. This combination with a self-learning approach effectively improves the reliability and accuracy of attack category identification. Furthermore, by first using the target adversarial strategy cluster information obtained through self-evolutionary learning of network intrusion information to actively defend against malicious attacks, and then implementing passive defense, the reliability and security of the network security defense system are significantly improved.

[0070] Optionally, the proactive defense module may specifically include a policy cluster library unit and a self-learning unit, with the policy cluster library unit and the self-learning unit connected; wherein:

[0071] The strategy cluster library unit is used to identify attack categories based on intrusion warning information, determine the first identified attack category, and determine the first countermeasure strategy cluster information for the first attack category based on the pre-stored mapping relationship between attack category and countermeasure strategy cluster information.

[0072] The network security module is used to execute the first adversarial strategy cluster information, determine the first strategy effectiveness information, and send an adversarial strategy learning instruction to the self-learning unit when the first strategy effectiveness information indicates that the strategy has failed.

[0073] The strategy evaluation module is used to determine the first strategy effectiveness information to close the connection path when the strategy fails.

[0074] The self-learning unit is used to learn from intrusion warning information based on adversarial strategy learning instructions, and determine the target adversarial strategy cluster information that matches the intrusion warning information.

[0075] Specifically, the cluster policy library unit of the proactive defense module, in response to intrusion warning information, first identifies the attack category by combining the field identifiers carried in the intrusion warning information. If the identification is successful, the first attack category is determined. Then, based on the pre-stored mapping relationship between attack category and countermeasure policy cluster information, the first countermeasure policy cluster information for dealing with the first attack category is determined. If the network security module fails to execute the first countermeasure policy information, it means that the determined first countermeasure policy information is invalid. At this time, the policy evaluation module can close the connection path to prevent malicious attacks from entering the system, and after learning the intrusion warning information through the self-learning unit, it determines the target countermeasure policy cluster information that matches the intrusion warning information.

[0076] The network security defense system provided by this invention, through a cluster policy library unit, first identifies the attack category of the intrusion warning information and identifies the first attack category. If the first countermeasure policy cluster information corresponding to the first attack category fails after the network security module executes it, a self-learning unit then determines the target countermeasure policy cluster information that matches the intrusion warning information through self-learning. This achieves both flexibility and reliability in proactive defense.

[0077] Optionally, the self-learning unit is also used to perform self-learning on intrusion warning information based on adversarial strategy learning instructions, predict the second attack category and the second adversarial strategy cluster information for dealing with the second attack category; the second adversarial strategy cluster information contains adversarial strategy information that is different from the first adversarial strategy cluster information.

[0078] The network security module is used to execute the second adversarial strategy cluster information, determine the second strategy effectiveness information, and continue to send adversarial strategy learning instructions to the self-learning unit when the second strategy effectiveness information fails to represent the strategy; until the self-learning unit determines the target adversarial strategy cluster information through self-learning; or when the second strategy effectiveness information successfully represents the strategy, determine that the second adversarial strategy cluster information determined by the self-learning unit is the target adversarial strategy cluster information.

[0079] Specifically, the self-learning unit of the proactive defense module, upon receiving the initial adversarial strategy learning instruction, first performs self-learning on the intrusion warning information. If the second attack category and the corresponding second adversarial strategy cluster information determined through self-learning are successful, the second adversarial strategy cluster information is identified as the target adversarial strategy cluster information. If the second adversarial strategy cluster information fails, self-learning continues. Each time, the adversarial strategy cluster information determined through self-learning contains adversarial strategy information different from the previous or first adversarial strategy cluster information. This process continues until the target adversarial strategy cluster information is determined.

[0080] The network security defense system provided by this invention, in the case of a failure of the currently determined first adversarial strategy cluster information policy, the self-learning unit of the active defense module, through self-learning, can successfully predict a second attack category and determine a second adversarial strategy cluster information policy to deal with the second attack category, thus determining the target adversarial strategy cluster information; or, if the second adversarial strategy cluster information policy fails, it continues self-learning. Since each adversarial strategy cluster information determined through self-learning contains adversarial strategy information different from the previous adversarial strategy cluster information or the first adversarial strategy cluster information, self-learning can significantly improve the defense level of the target adversarial strategy cluster information, thereby effectively improving the reliability and stability of network security defense.

[0081] Optionally, the strategy evaluation module is also used to open the connection path and generate indication information indicating that the active defense is effective when the second strategy effectiveness information characterizes the strategy successfully.

[0082] Specifically, when the second strategy effectiveness information characterizes the strategy successfully, if the second countermeasure strategy cluster information is the target countermeasure strategy cluster information that matches the intrusion warning information and the second attack category is the target attack category that matches the intrusion warning information, the strategy evaluation module can open the connection path and generate indication information that the active defense is effective, so that the passive defense module can start and enter the passive defense mode.

[0083] The network security defense system provided by this invention opens the connection path and generates a prompt message indicating that the active defense is effective when the policy evaluation module determines that the active defense is successful. This achieves the purpose of informing the subsequent passive defense module that the active defense is completed and the passive defense is started, thereby improving the security and reliability of the active defense.

[0084] Optionally, the network security defense system provided by the present invention may further include an attack detection module, which is connected to the network security module; the attack detection module is used to detect suspicious signals carrying network malicious intrusion identifiers in real time, generate intrusion warning information based on the suspicious signals, and send the intrusion warning information to the network security module.

[0085] Specifically, the attack detection module pre-configures suspicious signals with suspicious characteristics. These suspicious characteristics also serve as field identifiers for the generated intrusion alarm information, including but not limited to: intrusion timestamp, source IP, target IP, source port, destination port, source port, attack type identification, attack category, and policy effectiveness information. Based on this, the attack detection module can detect suspicious signals containing suspicious characteristics in real time, generate intrusion alarm information based on these suspicious signals, and then send the intrusion alarm information to the network security module.

[0086] The network security defense system provided by this invention achieves the purpose of sending intrusion alarm information to the network security module in a timely manner by setting up an attack detection module to detect suspicious signals in real time and generating intrusion alarm information based on the detected suspicious signals, thereby improving the timeliness and reliability of preventing malicious attacks.

[0087] Optionally, the network security defense system provided by the present invention may further include an information collection module, which is connected to the passive defense module and the active defense module respectively; the information collection module is used to collect and encapsulate target attack category and target countermeasure strategy cluster information when the active defense and passive defense against intrusion warning information are completed; the active defense module is also used to perform strategy self-evolution based on the encapsulated target attack category and target countermeasure strategy cluster information.

[0088] Specifically, when the target attack category and target countermeasure strategy cluster information are determined by the self-learning unit through self-learning, the target attack category and target countermeasure strategy cluster information can be stored in the strategy cluster library unit when both active and passive defense are completed. This achieves the purpose of strategy self-evolution, so that when intrusion alarm information containing the target attack category is detected again, the corresponding target countermeasure strategy cluster information can be quickly selected for active defense.

[0089] It should be noted that each attack category in the pre-stored mapping relationship of attack category-countermeasure strategy cluster information in the strategy cluster library unit can also carry a corresponding field identifier. If the attack category identification is performed on the mapping relationship of attack category-countermeasure strategy cluster information based on the field identifier carried by the intrusion warning information and the identification fails, it is considered that there is no target attack category matching the intrusion warning information stored in the mapping relationship, nor is there target countermeasure strategy cluster information to deal with the target attack category. At this time, the cluster strategy library unit can directly send a countermeasure strategy learning instruction to the self-learning unit, and encapsulate the target attack category and target countermeasure strategy cluster information determined after self-learning and store them in the corresponding mapping relationship of attack category-countermeasure strategy cluster information. This can also complete the self-evolution of the strategy.

[0090] The network security defense system provided by this invention, by setting up an information collection module to encapsulate the newly determined target attack categories and target countermeasure strategy cluster information during self-learning, and then sending them to the active defense module for strategy self-evolution, achieves the purpose of timely expanding the cluster strategy library unit within the active defense module, thereby providing a reliable guarantee for the timeliness and effectiveness of subsequent active defense.

[0091] Optionally, the self-learning unit includes an autoencoder, a softmax classifier, and a generalization filter, with the autoencoder connected sequentially to the softmax classifier and the generalization filter; wherein:

[0092] An autoencoder is used to encode intrusion warning information to determine the target feature data and target label data of the intrusion warning information.

[0093] The softmax classifier is used to predict the probability of target feature data and target label data to determine the target prediction probability of intrusion warning information.

[0094] The generalization filter is used to determine the target attack category corresponding to the target prediction probability and the policy generalization condition of this self-learning based on the target prediction probability. Then, based on the policy generalization condition, it filters the target adversarial policy cluster information that matches the target attack category from the policy cluster library unit. The policy generalization condition is determined based on the generalization step size of this self-learning, the target prediction probability policy generalization condition, and the maximum prediction probability in the classification domain.

[0095] Specifically, the autoencoder preprocesses the intrusion warning information and then extracts feature labels to determine the target feature data and target label data of the intrusion warning information. The target feature data and target label data are used to predict the target prediction probability of the attack category to which the intrusion warning information belongs. The softmax classifier normalizes the target feature data and target label data and then performs probability prediction to determine the target prediction probability of the intrusion warning information. The target prediction probability represents the maximum predicted probability that the intrusion warning information belongs to the target attack category. The generalization filter has a pre-set classification domain containing at least one prediction probability and the attack category corresponding to each prediction probability. Each prediction probability is the maximum prediction probability obtained by the autoencoder and softmax classifier after each training iteration. After the intrusion warning information is encoded by the autoencoder and predicted by the softmax classifier, the target prediction probability is determined. Then, the classification domain within the generalization filter determines the target attack category corresponding to the target prediction probability and determines the generalization condition of the self-learning strategy. Target adversarial strategy cluster information that meets the strategy generalization condition is selected from the strategy cluster library unit, that is, the clusters that satisfy θ'*p'>p' are selected from the strategy cluster library unit. maxθ' is the generalization step size of this self-learning, and p' is the target prediction probability. max The maximum predicted probability in the classification domain; θ′' is the previous self-learning or initial generalization step size, a is the learning rate, and f(s) min ) represents the probability density of the adversarial strategy information with the lowest probability in the strategy cluster library unit.

[0096] It should be noted that preprocessing includes at least one of symbolic numericalization, dimensionless data processing, and data redundancy removal. Symbolic numericalization is the conversion of character data into numerical data. Dimensionless data processing is the process of making data dimensionless into a unified data dimension. Data redundancy removal is the deletion of duplicate data and noisy data that appear multiple times.

[0097] The network security defense system provided by this invention has a self-learning unit that first performs self-encoding and probability prediction on intrusion warning information, and then generalizes and filters matching target adversarial strategy cluster information based on the determined target attack category. This combination of self-learning and strategy generalization improves the reliability and accuracy of identifying target attack categories and target adversarial strategy cluster information, thereby also improving the security and reliability of the network security defense system.

[0098] Optionally, the training process of the self-learning unit is the process of training the initial autoencoder and the initial softmax classifier, including:

[0099] First, a training network model containing an initial autoencoder and an initial softmax classifier is constructed. Then, a training sample set is determined, where each training sample is an intrusion warning message, and the attack category corresponding to each intrusion warning message is defined. Next, the training sample set is used to train the training network model, obtaining a sample prediction probability set output by the intermediate network model after a preset number of training iterations. This sample prediction probability set represents the predicted probability that each intrusion warning message belongs to a different attack category. Then, the maximum sample prediction probability in the sample prediction probability set is determined, and the predicted attack category corresponding to the maximum sample probability is determined. Finally, based on the successful matching result between the predicted attack category and the sample attack category, the corresponding autoencoder and softmax classifier are determined when training stops.

[0100] Specifically, the training sample set includes a large number of training samples. The network model to be trained is trained using this set, which can be achieved by using gradient descent to train the model a predetermined number of times. Each time, multiple training samples are selected for training. The intermediate network model output sample prediction probability set after each training iteration contains multiple sets of sample feature data and multiple sets of sample label data. Each set of sample feature data and its corresponding set of sample label data can predict a sample prediction probability. The sum of all the sample prediction probabilities in the sample prediction probability set is 1. The prediction probability y of a sample intrusion warning message belonging to k attack categories is... k The formula is:

[0101]

[0102] Where n is the total number of attack categories, and z represents the multiple sets of sample feature data and multiple sets of sample label data contained in the sample prediction probability set. k Let z be the predicted probability that the feature data and label data of the k-th sample group belong to the k-th attack category. j The probability that the j-th sample feature data and j-th sample label data belong to the j-th attack category is predicted.

[0103] Then, determine the maximum predicted probability of the sample in the sample prediction probability set, and determine the predicted attack category corresponding to the maximum sample probability. If the predicted attack category successfully matches the sample attack category, determine that the loss of the intermediate network model after a preset number of training iterations has reached its minimum, at which point training can be stopped, and determine the corresponding autoencoder and softmax classifier at the time of training stop. If the predicted attack category fails to match the sample attack category, obtain the intermediate network model with optimized parameters, and then retrain the optimized intermediate network model by selecting multiple training samples from the training sample set; this process continues until the loss of the intermediate network model after a preset number of training iterations reaches its minimum. The loss function of the intermediate network model after each training iteration is:

[0104]

[0105] The network security defense system provided by this invention determines self-learning units by training the network model to be trained, which is constructed from an initial autoencoder and an initial softmax classifier, using a training sample set. This improves the reliability and accuracy of determining target adversarial strategy cluster information in subsequent applications.

[0106] Optionally, the self-learning unit is also used to optimize learning parameters during the process of determining target adversarial strategy cluster information. This results in faster self-learning and more accurate and reliable target adversarial strategy cluster information obtained through self-learning.

[0107] Reference Figure 2 This is a schematic diagram of the network security defense system provided by the present invention, as shown below. Figure 2 As shown, this network security defense system includes an attack detection module, a network security module, a policy evaluation module, an active defense module, a passive defense module, and an information collection module. The attack detection module is sequentially connected to the network security module, policy evaluation module, active defense module, passive defense module, and information collection module. The network security module is connected to the active defense module, and the information collection module is connected to the active defense module. Their functions are described in the aforementioned embodiment of the network security defense system, and will not be repeated here.

[0108] Reference Figure 3 The above is a flowchart illustrating the network security defense method provided by the present invention. Figure 3 As shown, this network security defense method, applied to the aforementioned network security defense system, may include the following steps:

[0109] Step 310: Obtain intrusion warning information;

[0110] Step 320: Determine the target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category;

[0111] Step 330: Execute target adversarial strategy cluster information and determine target strategy effectiveness information;

[0112] Step 340: When the target strategy effectiveness information representation strategy is successful, generate indication information representing the effectiveness of proactive defense.

[0113] Step 350: Perform passive defense based on the instruction information.

[0114] Specifically, in the network security defense system, the network security module acquires intrusion warning information; the proactive defense module determines the target countermeasure strategy cluster information that matches the intrusion warning information; the network security module executes the target countermeasure strategy cluster information to determine the target strategy effectiveness information; when the strategy evaluation module determines that the target strategy effectiveness information indicates the strategy is successful, it generates indication information indicating that the proactive defense is effective; the passive defense module executes passive defense based on the indication information. The specific execution process can be referred to in the aforementioned embodiment of the network security defense system, and will not be elaborated further here.

[0115] The network security defense method provided by this invention, upon receiving intrusion alarm information, first determines the target attack category and target adversarial strategy cluster information for countering the target attack category through self-learning of the intrusion alarm information. When the target strategy effectiveness information generated after executing the target adversarial strategy cluster information indicates successful strategy execution, an indication of successful proactive defense is generated, and passive defense is executed. This combination with a self-learning approach effectively improves the reliability and accuracy of attack category identification. Furthermore, by first using the target adversarial strategy cluster information obtained through self-evolutionary learning of network intrusion information to proactively defend against malicious attacks, and then implementing passive defense, the reliability and security of the network security defense system are significantly improved.

[0116] Optionally, the specific implementation process of step 320 may include:

[0117] First, based on the pre-stored mapping relationship between attack categories and countermeasure strategy cluster information, the intrusion warning information is used to identify the attack category. Then, based on the failure of attack category identification, the intrusion warning information is self-learned to determine the target attack category and the target countermeasure strategy cluster information corresponding to the target attack category.

[0118] Specifically, the proactive defense module of the network security defense system, based on a pre-stored mapping relationship between attack categories and countermeasure strategy cluster information, identifies the attack category of intrusion warning information. If identification fails, the self-learning unit determines the target attack category and the corresponding target countermeasure strategy cluster information through self-learning. The specific implementation process can be referred to the aforementioned embodiment of the network security defense system, and will not be elaborated upon here.

[0119] Optionally, the specific implementation process of step 320 may also include:

[0120] Based on the successful attack category identification, the first attack category is determined, and based on the mapping relationship between attack category and adversarial strategy cluster information, the first adversarial strategy cluster information is determined. When the first strategy effectiveness information obtained after executing the first adversarial strategy cluster information indicates that the strategy has failed, the intrusion warning information is self-learned to determine the second attack category and the second adversarial strategy cluster information for dealing with the second attack category. When the second strategy effectiveness information obtained after executing the second adversarial strategy cluster information indicates that the strategy has succeeded, the second attack category is determined to be the target attack category, and the second adversarial strategy cluster information is determined to be the target adversarial strategy cluster information.

[0121] Specifically, the proactive defense module of the network security defense system determines the first identified attack category based on the successful attack category identification result, and determines the first countermeasure strategy cluster information based on the mapping relationship between attack category and countermeasure strategy cluster information. When the network security module of the network security defense system fails to execute the first countermeasure strategy cluster information and the resulting first strategy effectiveness information indicates policy failure, it can use the self-learning unit in the proactive defense module to self-learn the intrusion warning information to determine the second attack category and the second countermeasure strategy cluster information to deal with the second attack category. When the network security module of the network security defense system successfully executes the second countermeasure strategy cluster information and the resulting second strategy effectiveness information indicates policy success, it can determine that the second attack category determined by the proactive defense module is the target attack category, and the second countermeasure strategy cluster information is the target countermeasure strategy cluster information. The specific implementation process can be referred to the aforementioned embodiment of the network security defense system. It will not be elaborated further here.

[0122] Optionally, the network security defense method provided by the present invention may further include:

[0123] When active and passive defenses against intrusion warnings are completed, target attack categories and target countermeasure strategy cluster information are collected and encapsulated; strategy self-evolution is performed based on the encapsulated target attack categories and target countermeasure strategy cluster information.

[0124] Specifically, when the information collection module of the network security defense system determines that active and passive defenses against intrusion warnings are completed, it collects and encapsulates target attack categories and target countermeasure strategy cluster information, and sends the encapsulated target attack categories and target countermeasure strategy cluster information to the active defense module for strategy self-evolution. The specific implementation process can be referred to the aforementioned embodiment of the network security defense system, and will not be elaborated further here.

[0125] Reference Figure 4 The above is a flowchart illustrating the network security defense method provided by the present invention. Figure 4As shown, this network security defense method is applied to the aforementioned network security defense system. First, the attack detection module detects suspicious signals in real time and generates intrusion warning information based on these signals. This warning information is then sent to the network security module, which in turn sends it to the active defense module. The active defense module provides information on a first attack category and a first countermeasure strategy cluster. If the network security module fails to execute the first countermeasure strategy cluster, the active defense module determines the target attack category and target countermeasure strategy cluster through self-learning and strategy generalization. If the network security module succeeds in executing the target countermeasure strategy cluster, the passive defense module executes passive defense. When both active and passive defense are complete, the information collection module collects and encapsulates the target attack category and target countermeasure strategy cluster information, and sends the encapsulated information to the active defense module for strategy self-evolution. The specific implementation process can be found in the embodiments of the aforementioned network security defense system, and will not be elaborated further here.

[0126] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device 500 may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a network security defense method, which includes:

[0127] Obtain intrusion warning information;

[0128] Determine the target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category;

[0129] Execute target adversarial strategy cluster information and determine target strategy effectiveness information;

[0130] When the target strategy effectiveness information is determined and the strategy is successful, an indication message indicating that the active defense is effective is generated.

[0131] Passive defense is implemented based on the indicated information.

[0132] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0133] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer being able to execute the network security defense methods provided by the above methods, the method comprising:

[0134] Obtain intrusion warning information;

[0135] Determine the target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category;

[0136] Execute target adversarial strategy cluster information and determine target strategy effectiveness information;

[0137] When the target strategy effectiveness information is determined and the strategy is successful, an indication message indicating that the active defense is effective is generated.

[0138] Passive defense is implemented based on the indicated information.

[0139] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the network security defense methods provided by the above methods, the method comprising:

[0140] Obtain intrusion warning information;

[0141] Determine the target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category;

[0142] Execute target adversarial strategy cluster information and determine target strategy effectiveness information;

[0143] When the target strategy effectiveness information is determined and the strategy is successful, an indication message indicating that the active defense is effective is generated.

[0144] Passive defense is implemented based on the indicated information.

[0145] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0146] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security defense system, characterized in that, It includes a network security module, an active defense module, a policy evaluation module, and a passive defense module. The network security module is connected to both the active defense module and the policy evaluation module, and the policy evaluation module is connected to the passive defense module. The network security module is used to obtain intrusion warning information; The active defense module is used to determine target countermeasure strategy cluster information that matches the intrusion warning information; the target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and multiple target countermeasure strategies for dealing with the target attack category; The network security module is used to execute the target adversarial strategy cluster information and determine the target strategy effectiveness information; The strategy evaluation module is used to generate indication information indicating that the active defense is effective when the target strategy effectiveness information characterizes the strategy as successful. The passive defense module is used to perform passive defense based on the indication information; The proactive defense module includes a policy cluster library unit and a self-learning unit, wherein the policy cluster library unit and the self-learning unit are connected; wherein: The strategy cluster library unit is used to identify attack categories based on the intrusion warning information, determine the first identified attack category, and determine the first countermeasure strategy cluster information of the first attack category based on the pre-stored mapping relationship between attack category and countermeasure strategy cluster information. The network security module is used to execute the first adversarial strategy cluster information, determine the first strategy effectiveness information, and send an adversarial strategy learning instruction to the self-learning unit when the first strategy effectiveness information indicates that the strategy has failed. The strategy evaluation module is used to close the connection path when the first strategy effectiveness information indicates that the strategy has failed. The self-learning unit is used to perform self-learning on the intrusion warning information based on the adversarial strategy learning instruction, and determine the target adversarial strategy cluster information that matches the intrusion warning information.

2. The network security defense system according to claim 1, characterized in that, The self-learning unit is further configured to perform self-learning on the intrusion warning information based on the adversarial strategy learning instruction, predict the second attack category and the second adversarial strategy cluster information for dealing with the second attack category; the second adversarial strategy cluster information contains adversarial strategy information that is different from the first adversarial strategy cluster information. The network security module is configured to execute the second adversarial strategy cluster information, determine the second strategy effectiveness information, and continue to send adversarial strategy learning instructions to the self-learning unit when the second strategy effectiveness information indicates strategy failure; until the self-learning unit determines the target adversarial strategy cluster information through self-learning; or to determine the second adversarial strategy cluster information determined by the self-learning unit as the target adversarial strategy cluster information when the second strategy effectiveness information indicates strategy success.

3. The network security defense system according to claim 2, characterized in that, The strategy evaluation module is also used to open the connection path and generate indication information indicating that the active defense is effective when the second strategy effectiveness information characterizes the strategy successfully.

4. The network security defense system according to any one of claims 1 to 3, characterized in that, It also includes an attack detection module, which is connected to the network security module; the attack detection module is used to detect suspicious signals carrying network malicious intrusion identifiers in real time, generate intrusion warning information based on the suspicious signals, and send the intrusion warning information to the network security module.

5. The network security defense system according to any one of claims 1 to 3, characterized in that, It also includes an information collection module, which is connected to the passive defense module and the active defense module respectively; the information collection module is used to collect and encapsulate the target attack category and the target countermeasure strategy cluster information when the active defense and passive defense against the intrusion warning information are completed. The active defense module is also used to perform strategy self-evolution based on the encapsulated target attack category and the target adversarial strategy cluster information.

6. The network security defense system according to any one of claims 2 to 3, characterized in that, The self-learning unit includes an autoencoder, a softmax classifier, and a generalization filter, wherein the autoencoder is sequentially connected to the softmax classifier and the generalization filter; wherein: The autoencoder is used to autoencode the intrusion warning information to determine the target feature data and target tag data of the intrusion warning information; The softmax classifier is used to perform probability prediction on the target feature data and the target label data to determine the target prediction probability of the intrusion warning information; The generalization filter is used to determine the target attack category corresponding to the target prediction probability and the policy generalization condition of this self-learning based on the target prediction probability, and then filter out target adversarial policy cluster information matching the target attack category from the policy cluster library unit based on the policy generalization condition; wherein, the policy generalization condition is determined based on the generalization step size of this self-learning, the target prediction probability policy generalization condition, and the maximum prediction probability in the classification domain.

7. The network security defense system according to any one of claims 1 to 3, characterized in that, The training process of the self-learning unit is the process of training the initial autoencoder and the initial softmax classifier, including: Construct a trainable network model containing an initial autoencoder and an initial softmax classifier; A training sample set is determined, wherein each training sample in the training sample set is a sample intrusion warning message, and the sample attack category corresponding to each sample intrusion warning message is determined; The training sample set is used to train the network model to be trained, and the sample prediction probability set output by the intermediate network model after a preset number of training times is obtained. The sample prediction probability set is used to characterize the predicted probability that each sample intrusion warning information belongs to a different sample attack category. Determine the maximum sample prediction probability in the sample prediction probability set, and determine the predicted attack category corresponding to the maximum sample prediction probability; Based on the successful matching results between the predicted attack category and the sample attack category, the corresponding autoencoder and softmax classifier are determined when training stops.

8. The network security defense system according to any one of claims 2 to 3, characterized in that, The self-learning unit is also used to optimize learning parameters during the process of determining the target adversarial strategy cluster information.

9. A network security defense method, characterized in that, include: Obtain intrusion warning information; Determine the target countermeasure strategy cluster information that matches the intrusion warning information; The target countermeasure strategy cluster information includes the target attack category determined after self-learning the intrusion warning information and the countermeasure strategy cluster information for dealing with the target attack category; Execute the target adversarial strategy cluster information to determine the target strategy effectiveness information; When the target strategy effectiveness information characterization strategy is determined to be successful, an indication message characterizing the active defense is generated. Perform passive defense based on the indicated information; The determination of the target countermeasure strategy cluster information matching the intrusion warning information includes: Based on the intrusion warning information, attack category identification is performed to determine the first attack category, and based on the pre-stored mapping relationship between attack category and countermeasure strategy cluster information, the first countermeasure strategy cluster information of the first attack category is determined. The first adversarial strategy cluster information is executed to determine the first strategy effectiveness information, and when the first strategy effectiveness information indicates that the strategy has failed, an adversarial strategy learning instruction is sent to the self-learning unit. When the first strategy effectiveness information indicates that the strategy has failed, the connection path is closed. Based on the adversarial strategy learning instructions, the intrusion warning information is self-learned to determine the target adversarial strategy cluster information that matches the intrusion warning information.

10. The network security defense method according to claim 9, characterized in that, The determination of the target countermeasure strategy cluster information matching the intrusion warning information includes: Based on the pre-stored mapping relationship between attack categories and countermeasure strategy cluster information, the intrusion warning information is used to identify the attack category; Based on the failure of attack category identification, the intrusion warning information is self-learned to determine the target attack category and the target countermeasure strategy cluster information corresponding to the target attack category.

11. The network security defense method according to claim 10, characterized in that, The method further includes: Based on the successful attack category identification result, the first attack category is determined, and based on the mapping relationship between the attack category and the adversarial strategy cluster information, the first adversarial strategy cluster information is determined. When the first strategy effectiveness information obtained after executing the first countermeasure strategy cluster information indicates that the strategy has failed, the intrusion warning information is self-learned to determine the second attack category and the second countermeasure strategy cluster information for dealing with the second attack category. When the second strategy effectiveness information obtained after executing the second adversarial strategy cluster information indicates that the strategy is successful, the second attack category is determined to be the target attack category, and the second adversarial strategy cluster information is the target adversarial strategy cluster information.

12. The network security defense method according to claim 10, characterized in that, The method further includes: When it is determined that active and passive defenses against the intrusion warning information have been completed, collect and encapsulate the target attack category and the target countermeasure strategy cluster information; The strategy self-evolution is performed based on the encapsulated target attack category and the target adversarial strategy cluster information.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network security defense method as described in any one of claims 9 to 12.

14. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the network security defense method as described in any one of claims 9 to 12.

Images