A network behavior security early warning method and system

Abstract

This invention provides a network behavior security early warning method and system, relating to the field of network security technology. The method includes: acquiring attack event data; preprocessing and clustering the attack event data to obtain a first clustering result; acquiring a first key feature of network behavior corresponding to attack events in the same cluster, constructing a network abnormal behavior feature set; predicting subsequent network behavior based on a prediction model; determining the risk value of the predicted subsequent network behavior based on network behavior association principles; when the risk value is not less than a first preset threshold, collecting a second key feature from the predicted subsequent network behavior features; performing feature matching between the second key feature and the network abnormal behavior feature set; determining whether the predicted subsequent behavior will face an attack event based on the matching degree; and issuing a security early warning. By analyzing attack event data and predicting subsequent network behavior, the risk value of subsequent network behavior being attacked is determined, thus achieving a security early warning.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network behavior security early warning method and system. Background Technology

[0002] The continuous advancement and widespread adoption of computer network technology have truly ushered society into the information age, constantly improving people's efficiency in production and daily life, as well as their living standards. However, with the continuous development of the internet, the risks of cybersecurity threats are also increasing, leading to many cases of huge mistakes and losses caused by malicious network activities, such as vulnerability attacks, ransomware attacks, and virus attacks.

[0003] Currently, responses to cybersecurity threats either involve addressing the issue after it occurs or requiring customers to refuse access to unknown files or websites, significantly impacting user experience. Therefore, effectively ensuring stable network operation without compromising user experience is crucial.

[0004] Therefore, this invention proposes a network behavior security early warning method and system. Summary of the Invention

[0005] This invention provides a network behavior security early warning method and system, which obtains and analyzes attack event data by acquiring historical network behavior data packets of target users; predicts subsequent network behaviors based on a prediction model; determines the risk value of the predicted subsequent network behaviors being attacked; and combines the feature matching between the subsequent network behaviors and the network behaviors corresponding to the attack events to effectively determine whether the subsequent behaviors will be attacked, so as to achieve security early warning.

[0006] This invention provides a network behavior security early warning method, comprising:

[0007] Step 1: Capture the target user's historical network behavior data packets and filter them to obtain attack event data;

[0008] Step 2: Preprocess and cluster the attack event data to obtain the first clustering result;

[0009] Step 3: Obtain the first key features of network behavior corresponding to attack events in similar results, and construct a network abnormal behavior feature set;

[0010] Step 4: Train the neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors;

[0011] Step 5: Based on the principle of network behavior association, determine the risk value of the predicted subsequent network behavior. If the risk value is less than the first preset threshold, continue to monitor network behavior security.

[0012] Otherwise, feature collection is performed on the predicted subsequent network behavior to obtain a second key feature. The second key feature is then matched with the network abnormal behavior feature set. If the matching degree is greater than a second preset threshold, it is determined that the predicted subsequent behavior will face an attack event, and a security warning is issued.

[0013] Preferably, historical network behavior data packets of the target user are captured, and attack event data is obtained by filtering from the historical network behavior data packets, including:

[0014] Monitor the network and obtain historical network behavior data packets of the target user;

[0015] Detect the target user's historical network behavior data packets and filter out abnormal data information that may pose security risks;

[0016] Abnormal data is analyzed and filtered to extract valuable data for output as attack event data.

[0017] Preferably, the attack event data is preprocessed and clustered to obtain a first clustering result, including:

[0018] The attack event data is preprocessed to obtain standard feature values;

[0019] The standard feature values ​​are input into the cluster analysis model for clustering to obtain the first clustering result. The steps are as follows:

[0020] Step 01: Input the sample data set X constructed using the standard feature values ​​as samples into the clustering model for clustering;

[0021] Step 02: Obtain the initial cluster centers by performing density analysis on the sample distribution in each initial clustering result;

[0022] Step 03: Calculate the first distance between each sample in each initial clustering result and its corresponding initial cluster center;

[0023] Step 04: If all first distances are less than or equal to the preset threshold, the corresponding first sample is classified into this class;

[0024] If there is a second sample whose first distance is greater than a preset threshold, the second sample is excluded from its class, an isolated point set is constructed, and the corresponding second cluster center is determined based on density analysis;

[0025] Step 05: Obtain the second distance from the second cluster center to each sample, and classify the third sample whose second distance is less than the preset threshold and also less than the first distance into this class; and remove the first sample that is consistent with the third sample from the original class, and finally summarize to obtain the first clustering result.

[0026] Preferably, the network abnormal behavior feature set includes: the number of data packet bytes, data packet traffic, number of destination ports, number of source subnets, number of source ports, number of source IPs, and the proportion of each of the total traffic for each network abnormal behavior.

[0027] Preferably, a prediction model is obtained by training a neural network model based on the target user's current network behavior and historical network behavior, and then used to predict subsequent network behavior, including:

[0028] Analyze the target user's current and historical network behavior, classify the behavior based on its similarity, and obtain the target user's behavioral habit sequence;

[0029] By analyzing and processing the multiple occurrence sequences in the behavioral habit sequence and the corresponding triggering conditions, behavioral habit patterns are obtained.

[0030] Based on the aforementioned behavioral patterns, a neural network model is trained to generate a prediction model, and subsequent network behaviors are predicted based on the triggering conditions of the current network behavior.

[0031] Preferably, predicting subsequent network behavior includes:

[0032] Step 11: Based on the prediction model, predict the current network behavior and the corresponding triggering conditions to obtain several subsequent behavior patterns;

[0033] Step 12: Based on several subsequent behavior patterns, and combined with behavior habit patterns and the triggering conditions of each behavior habit pattern, generate a directed graph of behavior weights, and select the subsequent behavior with the largest weight as the first candidate behavior for output.

[0034] Step 13: Calculate the weight error of the successor behavior corresponding to several historical network behaviors, and update and adjust the directed graph of behavior weights based on the weight error; the formula for the weight error is as follows:

[0035]

[0036] Where M represents the weight error; x′ i Let x represent the true weight of the successor behavior of the i-th historical network behavior; where i∈(1,2,…,n); iLet represent the prediction weight of the corresponding subsequent behavior obtained by inputting the i-th historical network behavior data into the prediction model; n represents the number of historical network behaviors input into the prediction model; δ represents the bias influence factor brought about by the current network behavior, with a value range of (0, e^(i-1)). -3 );

[0037] Step 14: Based on the updated weighted directed graph, obtain the second candidate behavior with the largest weight. If the first candidate behavior and the second candidate behavior are inconsistent, select the second candidate behavior as the predicted successor network behavior output.

[0038] Preferably, based on the principle of network behavior correlation, the risk value of the predicted subsequent network behavior is determined, including:

[0039] The risk value of the predicted subsequent network behavior being attacked is calculated using the following formula:

[0040]

[0041] Where F represents the risk value of the predicted subsequent network behavior being attacked; b represents the risk impact factor of the current network behavior on the predicted subsequent network behavior, with a value range of (0, 1); a1 represents the behavioral value of the current network behavior; β represents the factor that all network behaviors consistent with the predicted subsequent network behavior in the historical network behavior are attacked and blocked but fail, with a value range of (0, 1); w1 represents the first weight; w2 represents the second weight, and w1 < w2.

[0042] Preferably, feature matching is performed between the second key feature and the network abnormal behavior feature set, including:

[0043] Principal component analysis is performed on the predicted subsequent network behavior to obtain the second key feature;

[0044] Mismatched feature values ​​in the second key feature are removed to achieve coarse removal, and the second key feature value is obtained.

[0045] The second key feature value is compared with the corresponding first feature matching value of each network abnormal behavior in the network abnormal behavior feature set;

[0046] The feature matching degree is determined based on the first matching feature value and the second key feature value of the j-th group;

[0047]

[0048] Where j∈(1,2,…z), z represents the number of network abnormal behaviors in the network abnormal behavior feature set; m k Sj represents the number of first matching feature values ​​in the j-th group; N represents the number of second key feature values; sim(S0, Sj)j ) represents the second key feature value S0 and the j-th group of network anomalous behavior S. j Similarity functions;

[0049] If p max If the value is less than a second preset threshold, it is determined that the predicted subsequent network behavior will not be attacked. In this case, security monitoring continues, where p max Represented as all p j The maximum value in;

[0050] If p max If the value is not less than the second preset threshold, then extract p. max Based on the attack event data corresponding to abnormal network behavior, targeted emergency measures can be taken to achieve security early warning.

[0051] This invention provides a network behavior security early warning system, comprising:

[0052] Data acquisition module: used to capture historical network behavior data packets of target users and filter attack event data from historical network behavior data packets;

[0053] Clustering analysis module: used to preprocess and cluster the attack event data to obtain the first clustering result;

[0054] Feature acquisition module: used to acquire the first key features of network behavior corresponding to attack events in similar results, and to construct a feature set of abnormal network behavior;

[0055] Behavior prediction module: This module is used to train a neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors.

[0056] Security warning module: Based on the principle of network behavior correlation, it determines the risk value of predicted subsequent network behavior and determines whether a security warning is needed in the future by combining the matching with network anomaly characteristics.

[0057] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.

[0058] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0059] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0060] Figure 1 This is a flowchart of a network behavior security early warning method according to an embodiment of the present invention;

[0061] Figure 2 This is a structural diagram of a network behavior security early warning system according to an embodiment of the present invention. Detailed Implementation

[0062] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0063] This invention provides a network behavior security early warning method, such as... Figure 1 As shown, it includes:

[0064] Step 1: Capture the target user's historical network behavior data packets and filter them to obtain attack event data;

[0065] Step 2: Preprocess and cluster the attack event data to obtain the first clustering result;

[0066] Step 3: Obtain the first key features of network behavior corresponding to attack events in similar results, and construct a network abnormal behavior feature set;

[0067] Step 4: Train the neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors;

[0068] Step 5: Based on the principle of network behavior association, determine the risk value of the predicted subsequent network behavior. If the risk value is less than the first preset threshold, continue to monitor network behavior security.

[0069] Otherwise, feature collection is performed on the predicted subsequent network behavior to obtain a second key feature. The second key feature is then matched with the network abnormal behavior feature set. If the matching degree is greater than a second preset threshold, it is determined that the predicted subsequent behavior will face an attack event, and a security warning is issued.

[0070] In this embodiment, the historical network behavior data packet contains network node data, network traffic information, operation data, attack event data, communication data, and defense data; the attack event data mainly refers to attack source data, attack chain behavior data, and attack network behavior data.

[0071] In this embodiment, the preprocessing of attack event data is to transform the corresponding data format into a standardized format of feature values, thereby laying the foundation for subsequent clustering processing.

[0072] In this embodiment, the network abnormal behavior feature set is composed of the first key feature, which actually refers to the number of data packet bytes, data packet traffic, number of destination ports, number of data flow source subnets, number of source ports, number of source IPs, and the proportion of each of the total traffic for each network abnormal behavior; where network abnormal behavior refers to the network behavior corresponding to the attack event.

[0073] In this embodiment, a subsequent network behavior refers to the next network behavior after a certain network behavior ends; the network behavior association principle refers to the rationalization of the dependencies and influences that exist between preceding and subsequent network behaviors.

[0074] In this embodiment, the first preset threshold is a pre-set standard value, typically 0.55, which is used to determine whether the predicted probability of subsequent network behavior being attacked has reached a critical value.

[0075] In this embodiment, the second key feature refers to the main features of the predicted subsequent network behavior; the second preset threshold is set in advance, and is generally set to 0.6.

[0076] The beneficial effects of the above technical solution are: to obtain and analyze attack event data by acquiring historical network behavior data packets of target users; to predict subsequent network behaviors based on prediction models; to determine the risk value of the predicted subsequent network behaviors being attacked, and to effectively judge whether the subsequent behaviors will be attacked by combining the feature matching between the subsequent network behaviors and the network behaviors corresponding to the attack events, so as to achieve security early warning.

[0077] This invention provides a network behavior security early warning method, which captures historical network behavior data packets of a target user and filters attack event data from the historical network behavior data packets, including:

[0078] Monitor the network and obtain historical network behavior data packets of the target user;

[0079] Detect the target user's historical network behavior data packets and filter out abnormal data information that may pose security risks;

[0080] Abnormal data is analyzed and filtered to extract valuable data for output as attack event data.

[0081] In this embodiment, security risks include network node vulnerabilities, defense anomalies, operation log anomalies, and communication anomalies; attack event data refers to attack source data, attack chain behavior data, and attack network behavior data.

[0082] The beneficial effects of the above technical solution are: by acquiring and detecting the historical network behavior data packets of the target user, abnormal data information with potential security risks can be obtained; by filtering the abnormal information, attack event data can be effectively obtained, providing data support for subsequent cluster analysis.

[0083] This invention provides a network behavior security early warning method, which preprocesses and clusters the attack event data to obtain a first clustering result, including:

[0084] The attack event data is preprocessed to obtain standard feature values;

[0085] The standard feature values ​​are input into the cluster analysis model for clustering to obtain the first clustering result. The steps are as follows:

[0086] Step 01: Input the sample data set X constructed using the standard feature values ​​as samples into the clustering model for clustering;

[0087] Step 02: Obtain the initial cluster centers by performing density analysis on the sample distribution in each initial clustering result;

[0088] Step 03: Calculate the first distance between each sample in each initial clustering result and its corresponding initial cluster center;

[0089] Step 04: If all first distances are less than or equal to the preset threshold, the corresponding first sample is classified into this class;

[0090] If there is a second sample whose first distance is greater than a preset threshold, the second sample is excluded from its class, an isolated point set is constructed, and the corresponding second cluster center is determined based on density analysis;

[0091] Step 05: Obtain the second distance from the second cluster center to each sample, and classify the third sample whose second distance is less than the preset threshold and also less than the first distance into this class; and remove the first sample that is consistent with the third sample from the original class, and finally summarize to obtain the first clustering result.

[0092] In this embodiment, the first distance refers to the calculated distance between each sample and the initial cluster center, with a value range of (0,1); the preset threshold is set in advance, generally 0.6.

[0093] In this embodiment, for example, if the initial cluster center A has a first distance of 0.3, 0.6, and 0.7 corresponding to samples 1, 2, and 3, respectively, then samples 1 and 2 are determined as the first samples and assigned to the initial cluster corresponding to the initial cluster center, while sample 3 is assigned as the second sample and assigned to that cluster.

[0094] In this embodiment, for example, there is an initial cluster center B, a second cluster center C, and samples 4 and 5 contained in the class corresponding to the initial cluster center B; the first distances from samples 4 and 5 to the initial cluster center B are determined to be 0.1 and 0.5, respectively, and the second distances from samples 4 and 5 to the second cluster center C are determined to be 0.2 and 0.4, respectively.

[0095] At this point, because the second distance corresponding to sample 5 is less than the preset threshold and less than the first distance, sample 5 is assigned to the class corresponding to the second cluster center C and removed from the class corresponding to the initial cluster center B; while the second distance corresponding to sample 4 is greater than the first distance, so sample 4 should still belong to the class corresponding to the initial cluster center B.

[0096] The beneficial effects of the above technical solution are: by preprocessing the attack event data, standard feature values ​​that can be used for cluster analysis are obtained; by using the standard feature values ​​as samples for clustering, the key features of network behavior corresponding to attack events in the same category are obtained, thus providing a basis for constructing a network abnormal behavior feature set.

[0097] This invention provides a network behavior security early warning method, which trains a neural network model based on the current and historical network behavior of a target user to obtain a prediction model, and then predicts subsequent network behavior, including:

[0098] Analyze the target user's current and historical network behavior, classify the behavior based on its similarity, and obtain the target user's behavioral habit sequence;

[0099] By analyzing and processing the multiple occurrence sequences in the behavioral habit sequence and the corresponding triggering conditions, behavioral habit patterns are obtained.

[0100] Based on the aforementioned behavioral patterns, a neural network model is trained to generate a prediction model, and subsequent network behaviors are predicted based on the triggering conditions of the current network behavior.

[0101] In this embodiment, the behavioral habit sequence is obtained by fully utilizing network behavior data to analyze user behavior and classifying it based on similarity; the triggering condition actually refers to the target user's network behavior purpose and the influencing factors of the previous behavior on the current behavior; the behavioral habit pattern is a regular behavioral structure obtained by analyzing and summarizing all the obtained behavioral habit sequences.

[0102] The beneficial effects of the above technical solution are as follows: by classifying the network behavior similarity of target users based on their network behavior data, a behavior habit sequence is obtained; by combining the triggering conditions and summarizing the behavior habit sequence, a behavior habit pattern is obtained; and by training a neural network model based on the behavior habit pattern, a prediction model can be effectively generated to predict subsequent network behavior, thus providing a foundation for network behavior security early warning.

[0103] This invention provides a network behavior security early warning method to predict subsequent network behavior, including:

[0104] Step 11: Based on the prediction model, predict the current network behavior and the corresponding triggering conditions to obtain several subsequent behavior patterns;

[0105] Step 12: Based on several subsequent behavior patterns, and combined with behavior habit patterns and the triggering conditions of each behavior habit pattern, generate a directed graph of behavior weights, and select the subsequent behavior with the largest weight as the first candidate behavior for output.

[0106] Step 13: Calculate the weight error of the successor behavior corresponding to several historical network behaviors, and update and adjust the directed graph of behavior weights based on the weight error; the formula for the weight error is as follows:

[0107]

[0108] Where M represents the weight error; x′ i Let x represent the true weight of the successor behavior of the i-th historical network behavior; where i∈(1,2,…,n); i It represents the prediction weight of the corresponding subsequent behavior obtained by inputting the i-th historical network behavior data into the prediction model; n δ represents the number of historical network behaviors in the input prediction model; δ represents the bias influence factor caused by the current network behavior, with a value range of (0, e^(-1 / 2)). -3 );

[0109] Step 14: Based on the updated weighted directed graph, obtain the second candidate behavior with the largest weight. If the first candidate behavior and the second candidate behavior are inconsistent, select the second candidate behavior as the predicted successor network behavior output.

[0110] In this embodiment, the subsequent behavior pattern refers to the behavioral structure, content, and regular series of subsequent behaviors; the behavior weighted directed graph is obtained based on the monitoring of behavior patterns and is mainly composed of behaviors with weights. It can obtain the correspondence between different behaviors, which is helpful to screen out the most likely subsequent behaviors.

[0111] In this embodiment, for example, there are successor behaviors 1, 2, and 3, with corresponding weights x1, x2, and x3 respectively; since x1 < x2 < x3, successor behavior 3 is determined to be the first candidate behavior; then, based on the updated behavior weighted directed graph, the successor behavior 4 with the largest weight is obtained. If successor behavior 3 and successor behavior 4 are inconsistent, successor behavior 4 is determined to be the predicted successor network behavior.

[0112] In this embodiment, updating and adjusting the directed graph of behavioral weights is to make the prediction results more accurate.

[0113] The beneficial effects of the above technical solution are: subsequent behavior patterns are obtained through prediction models; combining subsequent behavior patterns, behavior habit patterns and triggering conditions can help obtain a weighted directed graph of behavior; based on the analysis and optimization of the weighted directed graph of behavior, the most likely subsequent behavior can be effectively screened as the predicted subsequent behavior output, and the accuracy of prediction is improved.

[0114] This invention provides a network behavior security early warning method, which determines the risk value of predicted subsequent network behavior based on the network behavior correlation principle, including:

[0115] The risk value of the predicted subsequent network behavior being attacked is calculated using the following formula:

[0116]

[0117] Where F represents the risk value of the predicted subsequent network behavior being attacked; b represents the risk impact factor of the current network behavior on the predicted subsequent network behavior, with a value range of (0, 1); a1 represents the behavioral value of the current network behavior; β represents the factor that all network behaviors consistent with the predicted subsequent network behavior in the historical network behavior are attacked and blocked but fail, with a value range of (0, 1); w1 represents the first weight; w2 represents the second weight, and w1 < w2.

[0118] The beneficial effects of the above technical solution are: by performing weighted analysis and calculation on the behavioral value of the current network behavior and its risk impact on the predicted subsequent network behavior, as well as the attack and failed blocking of all network behaviors in the historical network behavior that are consistent with the predicted subsequent network behavior, the risk value of the predicted subsequent network behavior is obtained, so as to ensure the rationality of subsequent security warnings.

[0119] This invention provides a network behavior security early warning method, which performs feature matching between the second key feature and a network abnormal behavior feature set, including:

[0120] Principal component analysis is performed on the predicted subsequent network behavior to obtain the second key feature;

[0121] Mismatched feature values ​​in the second key feature are removed to achieve coarse removal, and the second key feature value is obtained.

[0122] The second key feature value is compared with the corresponding first feature matching value of each network abnormal behavior in the network abnormal behavior feature set;

[0123] The feature matching degree is determined based on the first matching feature value and the second key feature value of the j-th group;

[0124]

[0125] Where j∈(1,2,…z), z represents the number of network abnormal behaviors in the network abnormal behavior feature set; m j Sj represents the number of first matching feature values ​​in the j-th group; N represents the number of second key feature values; sim(S0, Sj) j ) represents the second key feature value S0 and the j-th group of network anomalous behavior S. j Similarity functions;

[0126] If p max If the value is less than a second preset threshold, it is determined that the predicted subsequent network behavior will not be attacked. In this case, security monitoring continues, where p max Represented as all p j The maximum value in;

[0127] If p max If the value is not less than the second preset threshold, then extract p. max Based on the attack event data corresponding to abnormal network behavior, targeted emergency measures can be taken to achieve security early warning.

[0128] In this embodiment, the second key features include the number of data packet bytes, data packet traffic, number of destination ports, number of data stream source subnets, number of source ports, number of source IPs, and the proportion of each of the total traffic.

[0129] In this embodiment, mismatched feature values ​​refer to feature values ​​that may cause errors in the matching results; coarse elimination is to ensure the accuracy of the matching results.

[0130] In this embodiment, the second preset threshold is set in advance, and is generally set to 0.6.

[0131] In this embodiment, for example, there exists a maximum feature matching degree p. max =0.7, which is greater than the second preset threshold of 0.6. At this point, a safety warning state is entered, and p is extracted. max The corresponding network anomaly attack event data, including attack source data and attack chain behavior data, is used to determine the attack intent, attack type, target scope, and potential consequences of the attack, so as to take targeted emergency measures, keep logs, and report in a timely manner.

[0132] The beneficial effects of the above technical solution are as follows: by comparing the second key feature value obtained after removing mismatched feature values ​​with the corresponding first feature matching value of each abnormal network behavior in the network abnormal behavior feature set, the feature matching degree is obtained; based on the relationship between the maximum value of the feature matching degree and the second preset threshold, it is possible to effectively determine whether the predicted subsequent network behavior will be attacked, and thus determine whether to issue a security warning and take targeted emergency measures.

[0133] This invention provides a network behavior security early warning system, such as... Figure 2 As shown, it includes:

[0134] Data acquisition module: used to capture historical network behavior data packets of target users and filter attack event data from historical network behavior data packets;

[0135] Clustering analysis module: used to preprocess and cluster the attack event data to obtain the first clustering result;

[0136] Feature acquisition module: used to acquire the first key features of network behavior corresponding to attack events in similar results, and to construct a feature set of abnormal network behavior;

[0137] Behavior prediction module: This module is used to train a neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors.

[0138] Security warning module: Based on the principle of network behavior correlation, it determines the risk value of predicted subsequent network behavior and determines whether a security warning is needed in the future by combining the matching with network anomaly characteristics.

[0139] The beneficial effects of the above technical solution are: to obtain and analyze attack event data by acquiring historical network behavior data packets of target users; to predict subsequent network behaviors based on prediction models; to determine the risk value of the predicted subsequent network behaviors being attacked, and to effectively judge whether the subsequent behaviors will be attacked by combining the feature matching between the subsequent network behaviors and the network behaviors corresponding to the attack events, so as to achieve security early warning.

[0140] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for early warning of network behavior security, characterized in that, include: Step 1: Capture the target user's historical network behavior data packets and filter them to obtain attack event data; Step 2: Preprocess and cluster the attack event data to obtain the first clustering result; Step 3: Obtain the first key features of network behavior corresponding to attack events in similar results, and construct a network abnormal behavior feature set; Step 4: Train the neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors; Step 5: Based on the principle of network behavior association, determine the risk value of the predicted subsequent network behavior. If the risk value is less than the first preset threshold, continue to monitor network behavior security. Otherwise, feature collection is performed on the predicted subsequent network behavior to obtain a second key feature. The second key feature is then matched with the network abnormal behavior feature set. If the matching degree is greater than a second preset threshold, it is determined that the predicted subsequent behavior will face an attack event, and a security warning is issued. A prediction model is obtained by training a neural network model based on the target user's current and historical network behavior, and then predicting subsequent network behavior, including: Analyze the target user's current and historical network behavior, classify the behavior based on its similarity, and obtain the target user's behavioral habit sequence; By analyzing and processing the multiple occurrence sequences in the behavioral habit sequence and the corresponding triggering conditions, behavioral habit patterns are obtained. Based on the aforementioned behavioral habit patterns, a neural network model is trained to generate a prediction model, and subsequent network behaviors are predicted based on the triggering conditions of the current network behavior. Predicting subsequent network behavior, including: Step 11: Based on the prediction model, predict the current network behavior and the corresponding triggering conditions to obtain several subsequent behavior patterns; Step 12: Based on several subsequent behavior patterns, and combined with behavior habit patterns and the triggering conditions of each behavior habit pattern, generate a directed graph of behavior weights, and select the subsequent behavior with the largest weight as the first candidate behavior for output. Step 13: Calculate the weight error of the successor behavior corresponding to several historical network behaviors, and update and adjust the directed graph of behavior weights based on the weight error; the formula for the weight error is as follows: Where M represents the weight error; Let represent the true weight of the successor behavior of the i-th historical network behavior; where ; denoted as the prediction weight of the corresponding subsequent behavior obtained by inputting the i-th historical network behavior data into the prediction model; n represents the number of historical network behaviors input into the prediction model; This represents the bias impact factor caused by the current network behavior, and its value range is... ; Step 14: Based on the updated weighted directed graph, obtain the second candidate behavior with the largest weight. If the first candidate behavior and the second candidate behavior are inconsistent, select the second candidate behavior as the predicted successor network behavior output.

2. The network behavior security early warning method as described in claim 1, characterized in that, Capture historical network behavior packets of the target user, and filter attack event data from the historical network behavior packets, including: Monitor the network and obtain historical network behavior data packets of the target user; Detect the target user's historical network behavior data packets and filter out abnormal data information that may pose security risks; Abnormal data is analyzed and filtered to extract valuable data for output as attack event data.

3. The network behavior security early warning method as described in claim 1, characterized in that, The attack event data is preprocessed and clustered to obtain the first clustering result, including: The attack event data is preprocessed to obtain standard feature values; The standard feature values ​​are input into the cluster analysis model for clustering to obtain the first clustering result. The steps are as follows: Step 01: Construct a sample data set using the standard feature values ​​as samples. The data is input into a clustering model for clustering. Step 02: Obtain the initial cluster centers by performing density analysis on the sample distribution in each initial clustering result; Step 03: Calculate the first distance between each sample in each initial clustering result and its corresponding initial cluster center; Step 04: If all first distances are less than or equal to the preset threshold, the corresponding first sample is classified into this class; If there is a second sample whose first distance is greater than a preset threshold, the second sample is excluded from its class, an isolated point set is constructed, and the corresponding second cluster center is determined based on density analysis; Step 05: Obtain the second distance from the second cluster center to each sample, and classify the third sample whose second distance is less than the preset threshold and also less than the first distance into this class; and remove the first sample that is consistent with the third sample from the original class, and finally summarize to obtain the first clustering result.

4. The network behavior security early warning method as described in claim 1, characterized in that, The network abnormal behavior feature set includes: the number of data packet bytes, data packet traffic, number of destination ports, number of source subnets, number of source ports, number of source IPs, and the proportion of each of the total traffic for each network abnormal behavior.

5. The network behavior security early warning method as described in claim 1, characterized in that, Based on the principle of network behavior correlation, the risk value of the predicted subsequent network behavior is determined, including: The risk value of the predicted subsequent network behavior being attacked is calculated using the following formula: Where F represents the risk value of the predicted subsequent network behavior being attacked; b represents the risk impact factor of the current network behavior on the predicted subsequent network behavior, and its value range is [value missing]. a1 represents the behavioral value of the current network behavior; It represents the attack and blocking failure factor for all network behaviors in the historical network behavior that are consistent with the predicted subsequent network behavior, and the value range is (0, 1). This is represented as the first weight; Represented as the second weight, and < .

6. The network behavior security early warning method as described in claim 1, characterized in that, The second key feature is matched with the network abnormal behavior feature set, including: Principal component analysis is performed on the predicted subsequent network behavior to obtain the second key feature; Mismatched feature values ​​in the second key feature are removed to achieve coarse removal, and the second key feature value is obtained. The second key feature value is compared with the corresponding first feature matching value of each network abnormal behavior in the network abnormal behavior feature set; The feature matching degree is determined based on the first matching feature value and the second key feature value of the j-th group; in, z represents the number of abnormal network behaviors in the set of abnormal network behavior features; Let N represent the number of first matching feature values ​​in the j-th group; N represents the number of second key feature values. Indicates the second key eigenvalue Network anomalies in group j Similarity functions; like If the value is less than a second preset threshold, it is determined that the predicted subsequent network behavior will not be attacked. In this case, security monitoring continues. Indicates all The maximum value in; like If the value is not less than the second preset threshold, then extract. Based on the attack event data corresponding to abnormal network behavior, targeted emergency measures can be taken to achieve security early warning.

7. A network behavior security early warning system, characterized in that, include: Data acquisition module: used to capture historical network behavior data packets of target users and filter attack event data from historical network behavior data packets; Clustering analysis module: used to preprocess and cluster the attack event data to obtain the first clustering result; Feature acquisition module: used to acquire the first key features of network behavior corresponding to attack events in similar results, and to construct a feature set of abnormal network behavior; Behavior prediction module: This module is used to train a neural network model based on the target user's current and historical network behaviors to obtain a prediction model, which is then used to predict subsequent network behaviors. Security warning module: Based on the principle of network behavior correlation, it determines the risk value of the predicted subsequent network behavior, and determines whether a security warning is needed in the future by combining the matching with the network anomaly characteristics; A prediction model is obtained by training a neural network model based on the target user's current and historical network behavior, and then predicting subsequent network behavior, including: Analyze the target user's current and historical network behavior, classify the behavior based on its similarity, and obtain the target user's behavioral habit sequence; By analyzing and processing the multiple occurrence sequences in the behavioral habit sequence and the corresponding triggering conditions, behavioral habit patterns are obtained. Based on the aforementioned behavioral habit patterns, a neural network model is trained to generate a prediction model, and subsequent network behaviors are predicted based on the triggering conditions of the current network behavior. Predicting subsequent network behavior, including: Step 11: Based on the prediction model, predict the current network behavior and the corresponding triggering conditions to obtain several subsequent behavior patterns; Step 12: Based on several subsequent behavior patterns, and combined with behavior habit patterns and the triggering conditions of each behavior habit pattern, generate a directed graph of behavior weights, and select the subsequent behavior with the largest weight as the first candidate behavior for output. Step 13: Calculate the weight error of the successor behavior corresponding to several historical network behaviors, and update and adjust the directed graph of behavior weights based on the weight error; the formula for the weight error is as follows: Where M represents the weight error; Let represent the true weight of the successor behavior of the i-th historical network behavior; where ; denoted as the prediction weight of the corresponding subsequent behavior obtained by inputting the i-th historical network behavior data into the prediction model; n represents the number of historical network behaviors input into the prediction model; This represents the bias impact factor caused by the current network behavior, and its value range is... ; Step 14: Based on the updated weighted directed graph, obtain the second candidate behavior with the largest weight. If the first candidate behavior and the second candidate behavior are inconsistent, select the second candidate behavior as the predicted successor network behavior output.

Images