Detection method and system based on propagation network and content fusion

Abstract

The application provides a detection method and system based on propagation network and content fusion. A monitoring router is determined through the propagation network. Different encoding is performed on three features of user attribute characteristics, structural characteristics and source content characteristics by the monitoring router. Then, fusion detection and classification are performed. Finally, whether an attack is received is analyzed by a control center according to classification information and a forwarding state, so that the problem that the prior art cannot adapt to rich and varied content forms and continuously evolving features of network social media is solved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a detection method and system based on the fusion of propagation networks and content. Background Technology

[0002] The rapid development of online social media has brought people the benefits of convenient access to and exchange of information, but it has also given rise to many previously unseen forms of attack, such as flood attacks and the widespread dissemination of rumors. Existing classification methods are unable to adapt to the rich and varied content formats and constantly evolving characteristics of online social media.

[0003] Therefore, there is an urgent need for a targeted detection method and system based on the fusion of communication networks and content. Summary of the Invention

[0004] The purpose of this invention is to provide a detection method and system based on the fusion of propagation network and content. The method determines the monitoring router through the propagation network, and the monitoring router performs fusion detection and classification of three features, thereby solving the problem that the existing technology cannot adapt to the rich and ever-changing content forms and constantly evolving characteristics of online social media.

[0005] Firstly, this application provides a detection method based on the fusion of propagation networks and content, the method comprising:

[0006] Multiple routers are deployed between multiple users and a designated content server, and the deployment meets the latency requirements for a single user to request services from the content server.

[0007] Based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server, select several routers at essential points close to the user as monitoring routers.

[0008] The monitoring router collects access data sent by users, extracts user attribute features, structural features and source content features from it, encodes user information for the user attribute features, encodes structural information for the structural features, and encodes text information for the source content features.

[0009] Specifically, the user information is encoded by representing user attribute features through node features, then adding the user attribute features to the node features, and the result of this addition is input into a neural network layer to obtain the first information to be classified; the structural information is encoded by mapping structural features to a forwarding graph, representing them through a node objective function, and then directly inputting them into a neural network layer to obtain the second information to be classified; the text information is encoded by using text context information, generating word vectors through a bidirectional encoder, and then directly inputting them into a neural network layer to obtain the third information to be classified.

[0010] The first, second, and third information to be classified are respectively subjected to hyperbolic tangent operation to determine complex number form, accumulated to form a vector, and then input into the neural network layer to obtain classification monitoring information;

[0011] The classified monitoring information is input into the state chain model, and the possible forwarding states are determined according to the preset probability density function.

[0012] The monitoring router uploads the classified monitoring information and possible forwarding status to the control center. The control center analyzes the semantic meaning and forwarding parameters to determine whether it is under attack. If it is under attack, it generates forwarding information and path based on the forwarding status and sends them to the relevant monitoring router, and issues a policy to the monitoring router.

[0013] Secondly, this application provides a detection system based on the fusion of propagation networks and content, the system comprising:

[0014] The deployment unit is used to deploy multiple routers between multiple users and a designated content server, the deployment meeting the latency requirements for a single user to request services from the content server;

[0015] The determining unit is used to select several routers at essential points close to the user as monitoring routers based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server.

[0016] A monitoring router is used to collect access data sent by users, extracting user attribute features, structural features, and source content features from the data. The user attribute features are encoded as user information, the structural features as structural information, and the source content features as text information. Specifically, the user information encoding involves representing the user attribute features using node features, then adding the user attribute features to the node features, and inputting the result into a neural network layer to obtain the first classification information. The structural information encoding involves mapping the structural features to a forwarding graph, representing them using a node objective function, and then directly inputting the result into the neural network layer to obtain the second classification information. The text information encoding involves using text context information to generate word vectors through a bidirectional encoder, and then directly inputting these vectors into the neural network layer to obtain the third classification information.

[0017] The monitoring router performs hyperbolic tangent operations on the first, second, and third unclassified information to determine their complex forms, accumulates them to form a vector, and inputs it into a neural network layer to obtain classification monitoring information. The classification monitoring information is then input into a state chain model, and possible forwarding states are determined according to a preset probability density function. The monitoring router uploads the classification monitoring information and possible forwarding states to the control center.

[0018] The control center analyzes the semantic meaning and forwarding parameters to determine whether an attack has occurred. If an attack has occurred, it generates forwarding information and paths based on the forwarding status and sends them to the relevant monitoring routers, and also issues policies to those monitoring routers.

[0019] Thirdly, this application provides a detection system based on the fusion of propagation networks and content, the system comprising a processor and a memory:

[0020] The memory is used to store program code and transmit the program code to the processor;

[0021] The processor is configured to execute any one of the four possible methods of the first aspect according to the instructions in the program code.

[0022] Fourthly, this application provides a computer-readable storage medium for storing program code for performing any one of the four possible methods of the first aspect.

[0023] Beneficial effects

[0024] This invention provides a detection method and system based on the fusion of propagation network and content. The method identifies a monitoring router through the propagation network, and the monitoring router encodes three features—user attribute features, structural features, and source content features—in different ways before fusing detection and classification. Finally, the control center analyzes whether an attack has occurred based on the classification information and forwarding status. This invention addresses the problem that existing technologies cannot adapt to the rich and ever-changing content formats and characteristics of online social media. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of the detection method based on the fusion of propagation network and content according to the present invention;

[0027] Figure 2 This is an architecture diagram of the detection system based on the fusion of propagation network and content according to the present invention;

[0028] Figure 3 This is a deployment diagram of a computer-readable storage medium related to the present invention. Detailed Implementation

[0029] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby providing a clearer and more explicit definition of the scope of protection of the present invention.

[0030] For a monitoring router to successfully detect an attack, it needs to cover as much network traffic as possible. When placing a monitoring router, consider its distance from users; position it near them. Placing the monitoring router closer to the attack source increases the probability of detecting the attack.

[0031] Figure 1 A general flowchart of the detection method based on the fusion of propagation network and content provided in this application is shown, the method comprising:

[0032] Multiple routers are deployed between multiple users and a designated content server, and the deployment meets the latency requirements for a single user to request services from the content server.

[0033] Based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server, select several routers at essential points close to the user as monitoring routers.

[0034] The monitoring router collects access data sent by users, extracts user attribute features, structural features and source content features from it, encodes user information for the user attribute features, encodes structural information for the structural features, and encodes text information for the source content features.

[0035] Specifically, the user information is encoded by representing user attribute features through node features, then adding the user attribute features to the node features, and the result of this addition is input into a neural network layer to obtain the first information to be classified; the structural information is encoded by mapping structural features to a forwarding graph, representing them through a node objective function, and then directly inputting them into a neural network layer to obtain the second information to be classified; the text information is encoded by using text context information, generating word vectors through a bidirectional encoder, and then directly inputting them into a neural network layer to obtain the third information to be classified.

[0036] The first, second, and third information to be classified are respectively subjected to hyperbolic tangent operation to determine complex number form, accumulated to form a vector, and then input into the neural network layer to obtain classification monitoring information;

[0037] The classified monitoring information is input into the state chain model, and the possible forwarding states are determined according to the preset probability density function.

[0038] The monitoring router uploads the classified monitoring information and possible forwarding status to the control center. The control center analyzes the semantic meaning and forwarding parameters to determine whether it is under attack. If it is under attack, it generates forwarding information and path based on the forwarding status and sends them to the relevant monitoring router, and issues a policy to the monitoring router.

[0039] In some preferred embodiments, the monitoring router further includes continuously monitoring the utilization rate of the routing table and the number of arriving request entries, and inputting the utilization rate and request entries as part of the monitoring information into a preset template.

[0040] In some preferred embodiments, the process of selecting several routers as monitoring routers further includes obtaining all paths of multiple users accessing the content server, as well as the service level information of all paths, using the service level information as a weight value, and using the weight value together with the path length to determine the monitoring router.

[0041] In some preferred embodiments, the control center is a domain-specific control platform, and the domain consists of multiple routers and the control center.

[0042] Figure 2 The architecture diagram of the detection system based on propagation network and content fusion provided in this application is shown. The system includes:

[0043] The deployment unit is used to deploy multiple routers between multiple users and a designated content server, the deployment meeting the latency requirements for a single user to request services from the content server;

[0044] The determining unit is used to select several routers at essential points close to the user as monitoring routers based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server.

[0045] A monitoring router is used to collect access data sent by users, extracting user attribute features, structural features, and source content features from the data. The user attribute features are encoded as user information, the structural features as structural information, and the source content features as text information. Specifically, the user information encoding involves representing the user attribute features using node features, then adding the user attribute features to the node features, and inputting the result into a neural network layer to obtain the first classification information. The structural information encoding involves mapping the structural features to a forwarding graph, representing them using a node objective function, and then directly inputting the result into the neural network layer to obtain the second classification information. The text information encoding involves using text context information to generate word vectors through a bidirectional encoder, and then directly inputting these vectors into the neural network layer to obtain the third classification information.

[0046] The monitoring router performs hyperbolic tangent operations on the first, second, and third unclassified information to determine their complex forms, accumulates them to form a vector, and inputs it into a neural network layer to obtain classification monitoring information. The classification monitoring information is then input into a state chain model, and possible forwarding states are determined according to a preset probability density function. The monitoring router uploads the classification monitoring information and possible forwarding states to the control center.

[0047] The control center analyzes the semantic meaning and forwarding parameters to determine whether an attack has occurred. If an attack has occurred, it generates forwarding information and paths based on the forwarding status and sends them to the relevant monitoring routers, and also issues policies to those monitoring routers.

[0048] This application provides a detection system based on the fusion of propagation network and content, the system comprising: a processor and a memory.

[0049] The memory is used to store program code and transmit the program code to the processor;

[0050] The processor is configured to execute the method described in any one of the embodiments of the first aspect according to the instructions in the program code.

[0051] This application provides a computer-readable storage medium, such as... Figure 3 As shown, the computer-readable storage medium is used to store program code for performing the method described in any one of the embodiments of the first aspect.

[0052] In a specific implementation, the present invention also provides a computer storage medium, wherein the computer storage medium may store a program, and the program, when executed, may include some or all of the steps in the various embodiments of the present invention. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM), etc.

[0053] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of the present invention.

[0054] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0055] The embodiments of the present invention described above do not constitute a limitation on the scope of protection of the present invention.

Claims

1. A detection method based on the fusion of propagation network and content, characterized in that, The method includes: Multiple routers are deployed between multiple users and a designated content server, and the deployment meets the latency requirements for a single user to request services from the content server. Based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server, select several routers at essential points close to the user as monitoring routers. The monitoring router collects access data sent by users, extracts user attribute features, structural features and source content features from it, encodes user information for the user attribute features, encodes structural information for the structural features, and encodes text information for the source content features. Specifically, the user information is encoded by representing user attribute features through node features, then adding the user attribute features to the node features, and the result of this addition is input into a neural network layer to obtain the first information to be classified; the structural information is encoded by mapping structural features to a forwarding graph, representing them through a node objective function, and then directly inputting them into a neural network layer to obtain the second information to be classified; the text information is encoded by using text context information, generating word vectors through a bidirectional encoder, and then directly inputting them into a neural network layer to obtain the third information to be classified. The first, second, and third information to be classified are respectively subjected to hyperbolic tangent operation to determine complex number form, accumulated to form a vector, and then input into the neural network layer to obtain classification monitoring information; The classified monitoring information is input into the state chain model, and the possible forwarding states are determined according to the preset probability density function. The monitoring router uploads the classified monitoring information and possible forwarding status to the control center. The control center analyzes the semantic meaning and forwarding parameters to determine whether it is under attack. If it is under attack, it generates forwarding information and path based on the forwarding status and sends them to the relevant monitoring router, and issues a policy to the monitoring router.

2. The method according to claim 1, characterized in that: The method further includes: the monitoring router continuously monitors the utilization rate of the routing table and the arrived request entries, and inputs the utilization rate and request entries as part of the monitoring information into a preset template.

3. The method according to claim 1, characterized in that: The process of selecting several routers as monitoring routers also includes obtaining all paths through which multiple users access the content server, as well as the service level information of all paths. The service level information is used as a weight value, and this weight value is used together with the path length to determine the monitoring routers.

4. The method according to any one of claims 2 or 3, characterized in that: The control center is a dedicated control platform within a domain, which consists of multiple routers and the control center.

5. A detection system based on the fusion of propagation network and content, characterized in that, The system includes: The deployment unit is used to deploy multiple routers between multiple users and a designated content server, the deployment meeting the latency requirements for a single user to request services from the content server; The determining unit is used to select several routers at essential points close to the user as monitoring routers based on the distance between multiple routers and a single user, and all paths taken by multiple users to access the content server. A monitoring router is used to collect access data sent by users, extracting user attribute features, structural features, and source content features from the data. The user attribute features are encoded as user information, the structural features as structural information, and the source content features as text information. Specifically, the user information encoding involves representing the user attribute features using node features, then adding the user attribute features to the node features, and inputting the result into a neural network layer to obtain the first classification information. The structural information encoding involves mapping the structural features to a forwarding graph, representing them using a node objective function, and then directly inputting the result into the neural network layer to obtain the second classification information. The text information encoding involves using text context information to generate word vectors through a bidirectional encoder, and then directly inputting these vectors into the neural network layer to obtain the third classification information. The monitoring router performs hyperbolic tangent operations on the first, second, and third unclassified information to determine their complex forms, accumulates them to form a vector, and inputs it into a neural network layer to obtain classification monitoring information. The classification monitoring information is then input into a state chain model, and possible forwarding states are determined according to a preset probability density function. The monitoring router uploads the classification monitoring information and possible forwarding states to the control center. The control center analyzes the semantic meaning and forwarding parameters to determine whether an attack has occurred. If an attack has occurred, it generates forwarding information and paths based on the forwarding status and sends them to the relevant monitoring routers, and also issues policies to those monitoring routers.

6. A detection system based on the fusion of propagation network and content, characterized in that, The system includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute instructions in the program code to implement the method according to any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code for performing the method according to any one of claims 1-4.

Images