Collaborative Deduction Method and Device for Network Intrusion Detection, and Storage Medium

Abstract

The embodiments of the present application provide a collaborative deduction method and device for network intrusion detection, and a storage medium. A target cellular automaton is constructed according to the communication relationship graph between different hosts. Compared with the traditional cellular automaton, each cell of the target cellular automaton is configured with a cell data attribute. Therefore, intrusion detection can be performed on all cells of the target cellular automaton according to the cell data attribute, and a pattern matching algorithm and a hidden Markov model are combined to perform collaborative inference prediction based on the temporal relationship of the cell's own state and the spatial relationship of the states of neighboring cells. Intrusion detection collaborative deduction can be realized based on the state calculation and state inference evolution performed on the target cellular automaton, which can not only detect intrusion attacks but also predict the development trend of intrusion attacks, which is beneficial to improving the attack detection efficiency of network intrusion, thereby providing help for the defense work of the defense side.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and particularly relates to a collaborative deduction method and device for network intrusion detection, and a computer-readable storage medium. Background Art

[0002] Currently, most of the network intrusion detection technologies proposed by existing researchers use a single method for intrusion detection. For example, the method of performing intrusion detection based on raw data severs the correlation between data, resulting in the problem of low attack detection efficiency. For some other existing methods, such as a graph intrusion detection analysis model combined with the chi-square method, fully consider the correlation between each piece of data, construct a relationship connectivity graph based on host correlation, and achieve dynamic analysis of attack behavior through relationship reasoning. However, this method only considers the correlation between data while ignoring the characteristics of the data itself, and also has the problem of low attack detection efficiency. Therefore, how to improve the attack detection efficiency of network intrusion has become an urgent technical problem to be solved. Summary of the Invention

[0003] The main purpose of the embodiments of the present application is to propose a collaborative deduction method and device for network intrusion detection, and a computer-readable storage medium, aiming to improve the attack detection efficiency of network intrusion.

[0004] To achieve the above purpose, the first aspect of the embodiments of the present application proposes a collaborative deduction method for network intrusion detection, including:

[0005] Construct a target cellular automaton according to the communication relationship graph between different hosts, where each host corresponds to a cell of the target cellular automaton;

[0006] Add cell data attributes to each cell of the target cellular automaton respectively;

[0007] Perform intrusion detection on all cells of the target cellular automaton according to all the cell data attributes to obtain the historical state information of all the cells;

[0008] For each cell of the target cellular automaton, obtain the first state information of the cell at the next moment through a pre-configured hidden Markov model according to the historical state information of the cell, and determine the second state information of the cell at the next moment based on a pre-configured pattern matching algorithm according to the historical state information of the target cell, where the target cell is all the neighbor cells of the cell in the target cellular automaton;

[0009] Perform state prediction according to all the first state information and all the second state information to obtain the predicted state information of each cell at the next moment;

[0010] Generate a collaborative deduction result for the target cellular automaton based on the predicted state information of each cell at the next moment.

[0011] In some embodiments, the cell data attribute of each cell is the traffic data and log data of the corresponding host at each moment.

[0012] In some embodiments, performing intrusion detection on all cells of the target cellular automaton according to all the cell data attributes to obtain the historical state information of all the cells, including:

[0013] For each cell of the target cellular automaton, perform knowledge extraction on all the traffic data to obtain first knowledge, and perform knowledge extraction on all the log data to obtain second knowledge;

[0014] Fuse the first knowledge and the second knowledge to obtain fusion data;

[0015] Perform intrusion detection on the cell according to the fusion data to obtain the historical state information of the cell.

[0016] In some embodiments, the performing intrusion detection on the cell according to the fusion data includes:

[0017] Perform intrusion detection on the cell based on the BP neural network algorithm according to the fusion data.

[0018] In some embodiments, the neighbor cells are at least one of the other cells in the target cellular automaton that have a communication relationship with the cell.

[0019] In some embodiments, the performing state prediction according to all the first state information and all the second state information to obtain the predicted state information of each cell at the next moment includes:

[0020] Determine a predicted attack event according to all the first state information and all the second state information;

[0021] Obtain the predicted state information of each cell at the next moment according to the matching degree between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event.

[0022] In some embodiments, the obtaining the predicted state information of each cell at the next moment according to the matching degree between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event includes:

[0023] For each cell of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm matches the predicted attack event, use the second state information of the cell at the next moment as the predicted state information of the cell at the next moment;

[0024] Or,

[0025] For each cell of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm does not match the predicted attack event, use the first state information of the cell at the next moment as the predicted state information of the cell at the next moment.

[0026] In some embodiments, the method further includes:

[0027] Generate a network defense strategy corresponding to the collaborative deduction result according to the collaborative deduction result for the target cellular automaton.

[0028] To achieve the above object, a second aspect of the embodiments of the present application provides a collaborative deduction device for network intrusion detection, including at least one processor and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the collaborative deduction method for network intrusion detection as described in the first aspect above.

[0029] To achieve the above object, a third aspect of the embodiments of the present application provides a computer-readable storage medium, which stores computer-executable instructions for causing a computer to execute the collaborative deduction method for network intrusion detection as described in the first aspect above.

[0030] The collaborative deduction method, device, and storage medium for network intrusion detection proposed by the present application construct a target cellular automaton according to the communication relationship graph between different hosts. Compared with the traditional cellular automaton, each cell of the target cellular automaton is configured with a cell data attribute. Therefore, intrusion detection can be performed on all cells of the target cellular automaton according to the cell data attribute, and a pattern matching algorithm and a hidden Markov model are combined to perform collaborative inference and prediction based on the temporal relationship of the cell's own state and the spatial relationship of the states of neighboring cells. Intrusion detection collaborative deduction can be achieved based on the state calculation and state inference evolution performed on the target cellular automaton, which can not only detect intrusion attacks but also predict the development trend of intrusion attacks, helping to improve the attack detection efficiency of network intrusion and thus providing assistance for the defense work of the defense side. Description of the Drawings

[0031] Figure 1It is a flowchart of a collaborative deduction method for network intrusion detection provided by an embodiment of the present application;

[0032] Figure 2 It is a comparison schematic diagram between a traditional cellular automaton and a target cellular automaton provided by an embodiment of the present application;

[0033] Figure 3 It is Figure 1 a flowchart of step S103 in

[0034] Figure 4 It is Figure 3 a schematic diagram of the execution process of steps S201 to S203 in

[0035] Figure 5 It is Figure 3 a flowchart of step S203 in

[0036] Figure 6 It is Figure 1 a flowchart of step S105 in

[0037] Figure 7 It is a flowchart of a collaborative deduction method for network intrusion detection provided by another embodiment of the present application;

[0038] Figure 8 It is a schematic diagram of the hardware structure of a collaborative deduction device for network intrusion detection provided by an embodiment of the present application. Detailed implementation manners

[0039] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0040] It should be noted that although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different module division from that in the device or a different order from that in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects and do not necessarily need to describe a specific order or sequence.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used herein are only for describing the embodiments of the present application and are not intended to limit the present application.

[0042] First, several nouns involved in the present application are analyzed:

[0043] Cellular Automata (CA): It is a dynamic system with both discrete time and space. Each cell scattered in a regular lattice grid takes a finite number of discrete states, follows the same action rules, and is updated synchronously according to certain local rules. The evolution of a dynamic system is formed by the simple interaction of a large number of cells. Different from general dynamic models, cellular automata are not determined by strictly defined physical equations or functions, but are composed of a series of model construction rules. Any model that satisfies these rules can be regarded as a cellular automata model. Therefore, cellular automata are a general term for a class of models, or a method framework. Its characteristics are that time, space, and state are all discrete, each variable takes only a finite number of states, and the rules for changing its state are local in time and space; the components that make up cellular automata are called "cells", and each cell has a state, which can only take one of a certain finite state set.

[0044] Pattern matching: Pattern matching is a basic operation on strings in data structures. Given a substring, it is required to find all substrings in a certain string that are the same as this substring, which is pattern matching. Suppose P is the given substring and T is the string to be searched. To find all substrings in T that are the same as P, then this problem is called the pattern matching problem, P is called the pattern, and T is called the target. If there is one or more substrings in T with the pattern P, the positions of these substrings in T are given, which is called a successful match, otherwise the match fails.

[0045] Hidden Markov Model (HMM): It is a statistical model used to describe a Markov process containing hidden unknown parameters. The hidden Markov model is a type of Markov chain. Its states cannot be directly observed, but can be observed through an observation vector sequence. Each observation vector is manifested as various states through certain probability density distributions, and each observation vector is generated by a state sequence with a corresponding probability density distribution. Therefore, the hidden Markov model is a double stochastic process - a hidden Markov chain with a certain number of states and a set of explicit random functions.

[0046] Most of the intrusion detection techniques proposed by current researchers use a single method for intrusion detection. For example, intrusion detection is performed by machine learning methods such as random forest and long short-term memory neural network based on terminal or traffic data. Some scholars also construct a communication graph based on terminal data and detect abnormal behaviors from the graph by combining methods such as K-means clustering analysis or local outlier factor (LOF). The above methods for directly performing intrusion detection based on raw data sever the correlation between data, while the graph method only considers the data correlation and ignores the characteristics of individual data. Therefore, the above methods all have the problem of low detection efficiency. For example, a deep learning attack classification model and a flow-based intrusion detection machine learning model in the prior art both directly use the model to train and detect intrusions on data. Their defect is that they only learn the correlation between data features and attack labels. For some organized and premeditated attack behaviors, there is often a great temporal correlation between intrusion events, and attackers often use disguise means to avoid traditional intrusion detection methods. In this case, using traffic or log features often cannot effectively detect complex attacks. In contrast, a graph intrusion detection analysis model in the prior art fully considers the correlation between each piece of data, constructs a relationship connectivity graph based on host correlation and realizes dynamic analysis of attack behaviors through relationship reasoning. However, this method only considers the correlation between data and ignores the characteristics of the data itself. Therefore, it also has the problem of low attack detection efficiency.

[0047] Based on this, the embodiments of the present application provide a collaborative deduction method, device, and storage medium for network intrusion detection, aiming to improve the attack detection efficiency of network intrusion.

[0048] The collaborative deduction method, device, and storage medium for network intrusion detection provided by the embodiments of the present application are specifically described through the following embodiments. First, the collaborative deduction method for network intrusion detection in the embodiments of the present application is described.

[0049] The collaborative deduction method for network intrusion detection provided by the embodiments of the present application relates to the field of artificial intelligence technology. The collaborative deduction method for network intrusion detection provided by the embodiments of the present application can be applied to communication nodes, can also be applied to the server side, or can be software running in communication nodes or the server side. In some embodiments, the communication node can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, can also be configured as a server cluster or a distributed system composed of multiple physical servers, or can also be configured as a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the collaborative deduction method for network intrusion detection, etc., but is not limited to the above forms.

[0050] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multi-processor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and so on. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0051] Figure 1 is an optional flowchart of the collaborative deduction method for network intrusion detection provided by the embodiments of the present application, Figure 1 The method in [it] can include but is not limited to steps S101 to S106.

[0052] Step S101: Construct a target cellular automaton according to the communication relationship graph between different hosts, where each host corresponds to a cell of the target cellular automaton;

[0053] Step S102: Add cell data attributes to each cell of the target cellular automaton respectively;

[0054] Step S103: Perform intrusion detection on all cells of the target cellular automaton according to all cell data attributes to obtain the historical state information of all cells;

[0055] Step S104: For each cell of the target cellular automaton, based on the historical state information of the cell, obtain the first state information of the cell at the next moment through a pre-configured hidden Markov model, and determine the second state information of the cell at the next moment based on a pre-configured pattern matching algorithm according to the historical state information of the target cell, where the target cell is all the neighbor cells of the cell in the target cellular automaton;

[0056] Step S105: Perform state prediction based on all the first state information and all the second state information to obtain the predicted state information of each cell at the next moment;

[0057] Step S106: Generate a collaborative deduction result for the target cellular automaton according to the predicted state information of each cell at the next moment.

[0058] In steps S101 to S105 shown in the embodiments of the present application, a target cellular automaton is constructed according to the communication relationship graph between different hosts. Compared with the traditional cellular automaton, each cell of the target cellular automaton is configured with a cell data attribute. Therefore, intrusion detection can be performed on all cells of the target cellular automaton according to the cell data attribute, and a pattern matching algorithm and a hidden Markov model are combined to perform collaborative inference and prediction based on the temporal relationship of the cell's own state and the spatial relationship of the neighbor cells' states. Intrusion detection collaborative deduction can be realized based on the state calculation and state inference evolution performed on the target cellular automaton, which can not only detect intrusion attacks but also predict the development trend of intrusion attacks, helping to improve the attack detection efficiency of network intrusion and thus providing assistance for the defense work of the defense side.

[0059] In step S101 of some embodiments, the distribution and quantity of the hosts can be set accordingly according to the specific application scenario. For example, multiple communication hosts are set in a community, and communication connections are maintained between the communication hosts. There is no limitation here; as Figure 2 shown, the traditional cellular automaton model is a two-dimensional plane. Two cells are adjacent if and only if there is an adjacent relationship in the front, back, left, or right. Therefore, a cell can have at most 4 neighbor cells, that is, the state of this cell is affected by the states of these four neighbor cells. However, the target cellular automaton in this embodiment is arranged and expanded in space in the form of a knowledge graph, which belongs to a high dimension. That is, neighbor relationships are imposed on the cellular automaton according to the communication relationships between the hosts. A cell represents a host, and as long as the remaining hosts can communicate with this host, they are considered neighbor cells of this host. Therefore, a cell is allowed to have enough neighbors, and the state of this cell is affected by the states of all neighbor cells. Different from the ordinary knowledge graph method, in the process of updating and calculating the state of each cell, that is, the host, in this embodiment, the states of all neighbor cells at the previous moment can be used as the basis for affecting the current state of a cell.

[0060] In step S102 of some embodiments, the cell data attributes of each cell may, but are not limited to, be the traffic data and log data of the host corresponding to the cell at each moment. That is to say, cell attributes can be assigned to each cell in the target cellular automaton, that is, the terminal log data and traffic data at each moment are added as attributes to each cell corresponding to the target cellular automaton.

[0061] In step S103 of some embodiments, the types of historical state information can be multiple. For example, they may, but are not limited to, be the state information at the previous moment, or they may, but are not limited to, be the state information at multiple previous moments, that is, the state information at the previous two moments, the previous three moments... etc. There is no limitation here.

[0062] In steps S104 and S105 of some embodiments, the neighbor cells may, but are not limited to, be at least one of the remaining cells in the target cellular automaton that have a communication relationship with the cell; pattern matching is mainly used to determine whether an attack within a period of time meets the rules of some specific attack chains. Among them, steps S104 and S105 may, but are not limited to, be executed multiple times, continuously repeating the above process, that is, intrusion detection is performed on the cells on the target cellular automaton at each moment and the attack development trend is predicted to achieve collaborative training, which can play a guiding role in the defense work of the defense side.

[0063] Please refer to Figure 3 , in some embodiments, step S103 may include, but is not limited to, steps S201 to S203.

[0064] Step S201: For each cell of the target cellular automaton, perform knowledge extraction on all traffic data to obtain first knowledge, and perform knowledge extraction on all log data to obtain second knowledge;

[0065] Step S202: Perform knowledge fusion on the first knowledge and the second knowledge to obtain fusion data;

[0066] Step S203: Perform intrusion detection on the cell according to the fusion data to obtain the historical state information of the cell.

[0067] In this step, since there are two types of datasets with the same source but different structures, namely traffic data and log data, during the intrusion detection process, first knowledge can be obtained by performing knowledge extraction on all traffic data, and second knowledge can be obtained by performing knowledge extraction on all log data. On this basis, fusion data is obtained through fusion, and then intrusion detection can be performed on the cell according to the fusion data to obtain the historical state information of the cell.

[0068] In step S201 of some embodiments, knowledge extraction can be performed on traffic data and log data respectively based on, but not limited to, time, source host, and target host. There is no limitation here.

[0069] In step S203 of some embodiments, the process of calculating the real-time state during intrusion detection for each cell is independent and parallel, without interference with each other, which can ensure that the state calculation processes of each cell can proceed normally.

[0070] A specific example is given below to illustrate the working principle of the above steps S201 to S203.

[0071] Example 1:

[0072] As Figure 4 shown, traffic and logs are respectively carried in dataset A and dataset B. Corresponding knowledge extraction is performed from dataset A and dataset B respectively to obtain knowledge A and knowledge B, and then the two are fused to finally obtain the required fusion data.

[0073] Please refer to Figure 5 , in some embodiments, step S203 may include, but not be limited to, step S301.

[0074] Step S301: Based on the BP neural network algorithm, perform intrusion detection on the cells according to the fusion data.

[0075] In this step, intrusion detection is performed on the cells according to the fusion data through the BP neural network algorithm to ensure that the process of intrusion detection on the cells is relatively stable. It should be noted that those skilled in the art can also select corresponding algorithms for calculation according to specific application scenarios. There is no limitation here.

[0076] Please refer to Figure 6 , in some embodiments, step S105 may include, but not be limited to, steps S401 to S402.

[0077] Step S401: Determine the predicted attack event according to all the first state information and all the second state information;

[0078] Step S402: Obtain the predicted state information of each cell at the next moment according to the matching between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event.

[0079] In this step, since the predicted attack event is related to the attack chain rule to a certain extent, the predicted state information of each cell at the next moment can be determined according to the matching between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event. That is to say, by determining whether there is a match between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event, the predicted state information of the cell at the next moment is determined.

[0080] In step S401 of some embodiments, the predicted attack event may be different in different application scenarios, which is not limited herein.

[0081] In step S402 of some embodiments, for each cell of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm matches the predicted attack event, the second state information of the cell at the next moment is used as the predicted state information of the cell at the next moment; or, for each cell of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm does not match the predicted attack event, the first state information of the cell at the next moment is used as the predicted state information of the cell at the next moment. That is to say, by setting the decision priority, when the predicted historical attack event can fully match a certain complex attack pattern, that is, the matching determination condition in step S402 takes effect, the result predicted by the attack chain matching rule is used as the standard, otherwise the result predicted by the hidden Markov model is used as the state information of the host at the next moment.

[0082] A specific example is given below to illustrate the working principle of the above steps S401 to S402.

[0083] Example 1:

[0084] Suppose cell E has three neighbor nodes F, G, and H. At time t1, E is scanned and detected. F and G are respectively attacked by PHT at time t0 and t1 and the host has been hijacked. At the same time, at time t2, E communicates with and accesses the host F and G. Then at time t3, E is likely to be attacked by the attacker.

[0085] It should be noted that more detailed pattern matching rules can be designed by those skilled in the art for specific attack types in the actual scenario, and all the rules are accumulated and assigned to the target cellular automaton, which is not limited herein.

[0086] Please refer to Figure 7 , in some embodiments, the collaborative deduction method for network intrusion detection may further include but is not limited to step S501.

[0087] Step S501: Generate a network defense strategy corresponding to the collaborative deduction result according to the collaborative deduction result of the target cellular automaton.

[0088] In this step, after obtaining the collaborative deduction result for the target cellular automaton, the specific scenario of the attack on the target cellular automaton can be determined. Based on this, a network defense strategy corresponding to the collaborative deduction result can be formulated accordingly, which helps improve the attack detection efficiency of network intrusion and thus provides assistance for the defense work of the defense party.

[0089] In step S501 of some embodiments, both the manner of generating the network defense strategy corresponding to the collaborative deduction result and the specific type of the network defense strategy can be various, and those skilled in the art can select and set according to the specific application scenario, which is not limited here.

[0090] Another embodiment of the present application further provides a collaborative deduction device for network intrusion detection, including at least one processor and a memory communicatively connected to the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the collaborative deduction method for network intrusion detection as shown in the above embodiments.

[0091] Please refer to Figure 8 , Figure 8 which schematically shows the hardware structure of the communication optimization device in another embodiment. The communication optimization device includes:

[0092] A processor 901, which can be implemented in ways such as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided by the embodiments of the present application;

[0093] A memory 902, which can be implemented in forms such as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 902 and are called by the processor 901 to execute the training optimization method of the embodiments of the present application;

[0094] An input / output interface 903, which is used to implement information input and output;

[0095] A communication interface 904 for implementing communication and interaction between this device and other devices, which can achieve communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.);

[0096] A bus 905 for transmitting information between various components of the device (such as a processor 901, a memory 902, an input / output interface 903, and a communication interface 904);

[0097] Among them, the processor 901, the memory 902, the input / output interface 903, and the communication interface 904 achieve communication connections with each other inside the device through the bus 905.

[0098] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs and non-transitory computer-executable programs. In addition, the memory can include high-speed random-access memory and can also include non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory components. In some embodiments, the memory optionally includes memories remotely set relative to the processor, and these remote memories can be connected to the processor through a network. Examples of the above networks include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The embodiment of the present application also provides a computer-readable storage medium, which stores computer-executable instructions for causing a computer to execute the collaborative deduction method for network intrusion detection as shown in the above embodiment.

[0100] In a typical configuration, a computer device includes one or more processors (CPUs), an input / output interface, a network interface, and a memory.

[0101] The memory may include non-permanent memory in the computer-readable medium, in the form of random-access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of a computer-readable medium.

[0102] A computer-readable medium includes both permanent and non-permanent, removable and non-removable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic tape disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to store information that can be accessed by a computer device.

[0103] The embodiments described in this application are for more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation to the technical solutions provided by the embodiments of this application. Those skilled in the art will know that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems.

[0104] Each embodiment in this application is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the apparatus, device, and computer-readable storage medium, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the description of the method embodiments.

[0105] The apparatus, device, and computer-readable storage medium provided by the embodiments of this application correspond to the method. Therefore, the apparatus, device, and non-volatile computer storage medium also have beneficial technical effects similar to the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the corresponding apparatus, device, and computer storage medium will not be elaborated here.

[0106] Those skilled in the art should understand that the embodiments of this application can be provided as a method, a system, or a computer program product. Therefore, the embodiments of this application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This specification is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in one or more flows Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in one or more blocks or multiple blocks.

[0108] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory generate a manufactured article including instruction means, and the instruction means implement the functions specified in one or more flows Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in one or more blocks or multiple blocks.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more flows Figure 1 one or more flows and / or blocks Figure 1 or means for implementing the functions specified in one or more blocks or multiple blocks.

[0110] It should also be noted that the term "comprising", "including", or any other variation thereof is intended to cover non-exclusive inclusion, so that a process, method, commodity, or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or elements inherent to such process, method, commodity, or device.

[0111] The above is only for the embodiments of the present application and is not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included within the scope of the claims of the present application.

Claims

1. A collaborative deduction method for network intrusion detection, characterized in that Including: Constructing a target cellular automaton according to the communication relationship diagram between different hosts, where each of the hosts corresponds to a cell of the target cellular automaton; Adding cell data attributes to each of the cells of the target cellular automaton respectively; Performing intrusion detection on all the cells of the target cellular automaton according to all the cell data attributes to obtain the historical state information of all the cells; For each of the cells of the target cellular automaton, obtaining the first state information of the cell at the next moment through a pre-configured hidden Markov model according to the historical state information of the cell, and determining the second state information of the cell at the next moment based on a pre-configured pattern matching algorithm according to the historical state information of the target cell, where the target cell is all the neighbor cells of the cell in the target cellular automaton; Performing state prediction according to all the first state information and all the second state information to obtain the predicted state information of each of the cells at the next moment; Generating a collaborative deduction result for the target cellular automaton according to the predicted state information of each of the cells at the next moment.

2. The collaborative deduction method for network intrusion detection according to claim 1, wherein The cell data attribute of each of the cells is the traffic data and log data of the host corresponding to the cell at each moment.

3. The collaborative deduction method for network intrusion detection according to claim 2, wherein The performing intrusion detection on all the cells of the target cellular automaton according to all the cell data attributes to obtain the historical state information of all the cells includes: For each of the cells of the target cellular automaton, performing knowledge extraction on all the traffic data to obtain first knowledge, and performing knowledge extraction on all the log data to obtain second knowledge; Fusing the first knowledge and the second knowledge to obtain fusion data; Performing intrusion detection on the cell according to the fusion data to obtain the historical state information of the cell.

4. The collaborative deduction method for network intrusion detection according to claim 3, characterized in that, The performing intrusion detection on the cell according to the fusion data includes: Performing intrusion detection on the cell based on the BP neural network algorithm according to the fusion data.

5. The collaborative deduction method for network intrusion detection according to claim 1, characterized in that The neighbor cell is at least one of the other cells in the target cellular automaton that has a communication relationship with the cell.

6. The collaborative deduction method for network intrusion detection according to claim 1, wherein The performing state prediction according to all the first state information and all the second state information to obtain the predicted state information of each of the cells at the next moment includes: Determining a predicted attack event according to all the first state information and all the second state information; Obtaining the predicted state information of each of the cells at the next moment according to the matching degree between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event.

7. The collaborative deduction method for network intrusion detection according to claim 6, characterized in that The obtaining the predicted state information of each of the cells at the next moment according to the matching degree between the attack chain rule corresponding to the pattern matching algorithm and the predicted attack event includes: For each of the cells of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm matches the predicted attack event, using the second state information of the cell at the next moment as the predicted state information of the cell at the next moment; Or, For each cell of the target cellular automaton, when the attack chain rule corresponding to the pattern matching algorithm does not match the predicted attack event, the first state information of the cell at the next moment is used as the predicted state information of the cell at the next moment.

8. The collaborative deduction method for network intrusion detection according to claim 1, wherein The method further includes: Generating a network defense strategy corresponding to the collaborative deduction result according to the collaborative deduction result for the target cellular automaton.

9. A collaborative deduction device for network intrusion detection, characterized in that Including at least one processor and a memory for communicating with the at least one processor; the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the collaborative deduction method for network intrusion detection according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing a computer to execute the collaborative deduction method for network intrusion detection according to any one of claims 1 to 8.

Images