A network security situation assessment method based on MLP-GCN

Abstract

The application relates to the technical field of network security, in particular to a network security situation assessment method based on MLP-GCN, which comprises the following steps: performing data processing on a public data set to obtain an evaluation data set; inputting the evaluation data set into a network security situation assessment model based on MLP-GCN to perform feature learning, feature fusion and classification evaluation, and obtaining an evaluation result; and the application proposes a network security situation assessment method based on a graph convolutional network (GCN) and a multilayer perceptron (MLP). The GCN can consider the spatial structure information among situation assessment elements, and the MLP strengthens feature learning on a small amount of sample data, thereby solving the problem that a traditional network security situation assessment method ignores the spatial structure information modeling of network security situation data. The method can improve the accuracy and reliability of an evaluation model, and solves the problem that the accuracy of a network security situation assessment technology is limited.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security situation assessment method based on MLP-GCN. BACKGROUND

[0002] With the acceleration of industrial informatization, network security problems have become the biggest challenge in the Internet era. Network security not only concerns personal privacy and enterprise interests, but also is an important guarantee for national security and social stability. The widespread application of cloud computing, 5G, Internet of Things and other technologies, and the increasing number of hardware devices and network systems in various industries have also increased the exposure of network security to a certain extent. Network attacks and vulnerabilities are emerging in an endless stream, causing serious property losses and information asset losses for various countries. However, network attacks and data leakage incidents are emerging in an endless stream, and the factors threatening network security are increasingly complex and changeable, and the network security situation is severe. In addition, network attacks are evolving towards the trends of large-scale attacks, complex attack forms, encryption attacks normalization, and diversified attack targets, which reduces the effect of using conventional defense tools to resist complex network attacks.

[0003] The Kaspersky 2021 security report shows that in this year, 15.45% of Internet users worldwide have experienced at least one malware-level attack on their computers, and a total of 687,861,449 attacks have been made on global online resources, of which 114,525,734 attacks are malicious URLs and 366,256 attacks are malicious ransom attacks. As can be seen, the current network is facing very serious security problems, and poses a huge threat to the privacy and property of network users and enterprises. Therefore, protecting network systems from attacks has become a crucial task. However, the high complexity of modern network systems makes the design of security solutions a challenging task. In addition, there are many difficulties in designing security solutions in a highly dynamic and uncertain environment.

[0004] Most existing security solutions focus on protecting individual components of a system. The close coupling characteristics of modern network systems make it impossible for such solutions to conduct joint analysis of security components and timely deployment of security strategies. In modern society, how to effectively detect and mitigate network attacks is a highly challenging and difficult task. To solve the limitations of single security detection methods, network security situation assessment technology has emerged.

[0005] Network security situation assessment refers to determining the current network security state and future trend in a complex network operating environment, with various influencing factors such as the operating status of network devices, network behavior, and user behavior, which reflects the overall operating status of the network. It is an active defense technology that effectively safeguards the security of modern complex network systems.

[0006] The current network security data increasingly presents the characteristics of large scale, multi-feature, multi-source heterogeneity, etc., which brings great challenges to the existing network security situation assessment technology. The current network security situation awareness technology is difficult to efficiently extract key information from massive raw data in the element extraction stage, and does not consider the spatial structure information of the situation assessment data node, which limits the accuracy of the evaluation model.

[0007] In summary, how to fully capture the relevance between the situation assessment elements and the spatial structure information of the situation assessment data node is an important challenge currently faced by research. SUMMARY

[0008] The purpose of the application is to provide a network security situation assessment method based on MLP-GCN, aiming to solve the problem of limited accuracy of network security situation awareness technology.

[0009] To achieve the above purpose, the application provides a network security situation assessment method based on MLP-GCN, comprising the following steps:

[0010] Data processing is performed on the public data set to obtain an evaluation data set;

[0011] The evaluation data set is input into the network security situation assessment model based on MLP-GCN for feature learning, feature fusion and classification evaluation to obtain an evaluation result.

[0012] Among them, the data processing on the public data set to obtain the evaluation data set comprises:

[0013] According to the correlation between the situation value and the 49 different features and the meaning of each feature as the judgment basis, 17 features closely related to each data sample in the public data set are selected to obtain a selected data set;

[0014] The non-numerical features in the selected data set are converted into numerical data to obtain a converted data set;

[0015] The value range of each feature in the converted data set is linearly mapped to the interval [0, 1] by using a normalization processing method to obtain a normalized data set;

[0016] The normalized data set is subjected to regularization processing to obtain a regularized data set;

[0017] The situation assessment index data is divided into four dimensions of attack, vulnerability, traffic and device as node data input into the graph neural network, and the node feature attribute is the data feature under each index, and the nodes with close connection are connected by edges, thereby obtaining a graph data set;

[0018] Index selection and situation quantification are performed on the graph data to obtain an evaluation dataset.

[0019] The public dataset is an UNSW-NB15 public dataset.

[0020] The evaluation dataset is input into an MLP-GCN-based network security situation assessment model to perform feature learning, feature fusion and classification evaluation, and obtain an evaluation result, including:

[0021] The evaluation dataset input into the MLP-GCN-based network security situation assessment model generates a feature matrix based on the evaluation dataset, and performs MLP-based feature learning training based on the feature matrix. In the training process, the MLP neural network uses a back propagation algorithm to optimize network parameters to minimize a loss function, and obtains node features.

[0022] The evaluation dataset input into the MLP-GCN-based network security situation assessment model uses a TopKPool layer to select preset nodes in the node features, and the preset nodes are discarded according to learnable projection scores. A global addition pooling layer GlobalAddPool is used based on the preset nodes to obtain global features of the graph.

[0023] The evaluation dataset input into the MLP-GCN-based network security situation assessment model uses a Linear layer and a Softmax layer to classify the global feature vector of the graph, and outputs a network security situation value in the range of [0, 1]. The network security situation level corresponding to the situation value is the evaluation result.

[0024] After the step of inputting the evaluation dataset into the MLP-GCN-based network security situation assessment model to perform feature learning, feature fusion and classification evaluation, and obtaining an evaluation result, the method further includes:

[0025] The MLP-GCN-based situation assessment method is compared with a DT-based situation assessment method, a SVM-based situation assessment method, an MLP-based situation assessment method, a GCN-based situation assessment method and a GAT-based situation assessment method in a performance comparison experiment. Accuracy, Precision, Recall and F1_score are selected as evaluation indexes to obtain an evaluation performance comparison result.

[0026] The application provides a network security situation assessment method based on an MLP-GCN. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0028] Figure 1 It is a framework diagram of the network security situation assessment method based on the MLP-GCN provided by the present application.

[0029] Figure 2 It is a network security situation assessment model structure diagram based on the MLP-GCN.

[0030] Figure 3 It is a comparison result diagram of the evaluation performance of different methods.

[0031] Figure 4 It is a flowchart of the network security situation assessment method based on the MLP-GCN provided by the present application. DETAILED DESCRIPTION

[0032] The embodiments of the present application will be described in detail below, and the examples of the embodiments are shown in the drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are intended to explain the present application, and cannot be understood as a limitation of the present application.

[0033] Please refer to Figures 1 to 4 The application provides a network security situation assessment method based on an MLP-GCN, which comprises the following steps:

[0034] S1 performs data processing on the public data set to obtain an evaluation data set;

[0035] Specifically,

[0036] S11 filters 17 features closely related to the situation value from each data sample in the public data set according to the correlation between the situation value and the 49 different features and the meaning of each feature as a judgment basis, to obtain a selected data set;

[0037] Specifically, the name and meaning of each of the 17 features closely related to the situation value are shown in Table 1

[0038] Table 1 Network security situation feature name and meaning

[0039]

[0040]

[0041] The public data set is the UNSW-NB15 public data set, and has detailed time stamps relative to other data sets UNSW-NB15, which is more suitable for the construction of network security situation awareness data set, so the UNSW-NB15 data set is selected as the experimental data set in this paper. The original network data packet of UNSW-NB15 data set is created by IXIA Perfect Storm tool of Australian Network Security Laboratory, which can be used to generate mixed data of modern normal activities and synthetic contemporary attack behaviors. The UNSW-NB15 data set saves 2,540,044 data in csv, which is contained in four files, each data contains 49 different features, covering 9 types of current common network attack types.

[0042] This module uses the data of UNSW-NB15 data set as input and generates an evaluation data set suitable for graph neural network. First, feature selection is performed, and then data preprocessing is performed, including data normalization, normalization and regularization, etc., and then the index system for constructing the evaluation data set is selected, and different situation factors are quantitatively processed. Finally, the graph data is constructed, thereby constructing the situation evaluation data set.

[0043] S12 converts the non-numeric features in the selected data set into numeric data to obtain a converted data set;

[0044] Specifically, there are non-numeric features in the data set, so it is necessary to convert them into numeric data. The non-numeric attributes in the network security posture data are service, proto, attack_cat and state. Simple processing is performed on these attributes, for example, for the attribute attack type attack_cat, its values are nine, Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, Worms, if the attack_cat attribute of the data is Analysis, then Analysis = 1, Backdoor = 0, DoS = 0, Exploits = 0, Fuzzers = 0, Generic = 0, Reconnaissance = 0, Shellcode = 0, Worms = 0. Other attack types are converted in the same way.

[0045] S13 adopts a normalization processing method to linearly map the value range of each feature of the converted data set to the interval [0, 1] to obtain a normalized data set;

[0046] Specifically, a normalization processing method is adopted to uniformly linearly map the value range of each feature to the interval [0, 1]. The normalization calculation formula is:

[0047]

[0048] wherein, x max and x min respectively represent the maximum and minimum values in the original feature values.

[0049] S14 performs regularization processing on the normalized data set to obtain a regularized data set;

[0050] Specifically, regularization is used in machine learning to avoid the problem of model overfitting, and L1 regularization is adopted here, and its formula is as follows:

[0051]

[0052] wherein, n is the number of parameters, and |w j | represents the absolute value of the jth parameter. The L1 regularization term can make a part of the parameters close to 0, thereby realizing feature selection and sparsification.

[0053] S15 divides the posture evaluation index data into four dimensions of attack, vulnerability, traffic and device, as node data input of the graph neural network, and the node feature attributes are data features under each index, and there are connecting edges between nodes with close association, thereby obtaining a graph data set;

[0054] S16 is the index selection and situation quantification of the graph data, and the evaluation data set is obtained.

[0055] S2 inputs the evaluation data set into the network security situation assessment model based on MLP-GCN for feature learning, feature fusion and classification evaluation, and obtains the evaluation result.

[0056] Specifically, the network security situation assessment model based on MLP-GCN includes three stages: node feature learning, node feature fusion and classification evaluation. The structure of the method is as shown in Figure 2 In the node feature learning stage, the model combines GCN and MLP to learn the node representation of the graph data. First, GCN is used for message passing between element nodes to learn neighbor features and update node information. Then, in order to deal with the problem of unbalanced classification data, a multi-layer perceptron is also used to strengthen the learning of node features. In this way, the node features learned by GCN and MLP are added together, and finally the vector representation of all nodes of the graph can be obtained.

[0057] In the node feature fusion stage, multiple pooling layers are used to reduce the feature dimension. The pooling function can reduce the feature dimension and remove redundant information to obtain refined graph feature vectors. Finally, the Linear layer and Softmax layer are used to classify the global feature vector of the graph to obtain the final situation assessment result.

[0058] The specific manner is:

[0059] S21 inputs the evaluation data set into the network security situation assessment model based on MLP-GCN to generate a feature matrix based on the evaluation data set, and performs MLP-based feature learning training based on the feature matrix. In the training process, the MLP neural network uses a backpropagation algorithm to optimize the network parameters to minimize the loss function, and obtains node features.

[0060] Specifically, the node feature learning stage:

[0061] a. Input a graph G=(X,A), X represents the feature matrix of the input graph, and the feature matrix X is composed of N input vectors x i , i=1,2,…,N, the feature matrix X is an NxD matrix, where N is the number of nodes and D is the feature dimension, D=128. A represents the adjacency matrix, where A i,j is the i-th row and j-th column of the adjacency matrix, indicating the connectivity between two nodes v i and v j . The convolution operation of GCN can be represented as:

[0062] H (l+1)=σ(A′H (l) W (l) )

[0063] Among them, H (l+1) H represents the node features of the (l+1)th layer. (l) W represents the node features of the l-th layer. (l) This represents the weight matrix of the l-th layer. The feature matrix X is used to construct the weight matrix W of the nodes. (l) σ(·) is the activation function. In the GCN structure of this model, the activation function used is ReLU. A′ represents the normalized adjacency matrix of the graph, which remains unchanged during message propagation. Its calculation method is as follows:

[0064]

[0065] in, Let I represent the adjacency matrix after adding self-loops, where I N It is an N-dimensional identity matrix. Degree matrix, Depend on The transformation relationship is as follows: They serve to normalize rows and columns respectively.

[0066] b. The feature matrix X of the input image can be represented by the MLP-based feature learning method as follows:

[0067]

[0068]

[0069] in, This represents the i-th input of the (l-1)-th layer, n (l-1) This represents the number of neurons in the (l-1)th layer. Let be the weight matrix of the l-th layer. Let l be the bias vector of the l-th layer; For the weighted input of the l-th layer, σ is the output of the l-th layer; σ(·) is the activation function.

[0070] During training, the MLP neural network uses back-propagation to optimize network parameters to minimize the loss function. Back-propagation propagates the error from the output layer forward, updating the weights and biases of each neuron based on the error magnitude to continuously optimize network performance.

[0071] During backpropagation, the error calculation formula for each neuron i and each hidden layer l = L⁻¹, L⁻², …, 1 is as follows:

[0072]

[0073] where σ'(·) denotes the derivative of the activation function.

[0074] The update of weights and biases is shown in the formula:

[0075]

[0076]

[0077] where η is the learning rate, which controls the update speed of weights and biases.

[0078] The evaluation data set input based on the network security situation assessment model of MLP-GCN adopts TopKPool layer to select the preset nodes in the node features, and the preset nodes are discarded according to the learnable projection score; and the global feature of the graph is obtained based on the preset nodes using the global addition pooling layer GlobalAddPool;

[0079] Specifically, the node feature fusion stage:

[0080] In order to obtain the overall representation of the graph, it is necessary to use the pooling layer to fuse the node features in the graph to realize the classification task at the graph level.

[0081] a. The model first adopts TopKPool layer to select the top k nodes in the graph, and the nodes are discarded according to the learnable projection score.

[0082]

[0083] i = top k (y)

[0084] X' = (X ⊙ tanh(y)) i

[0085] A' = A i,i

[0086] where X is the given input vector, p is a trainable projection vector, ||p|| is the L2 norm of the vector p, y is the projected node feature; top k is the scoring function, which selects the top k nodes with the highest scores, i is the index of the top k nodes to be reserved; ⊙ is element multiplication, tanh(y) is equivalent to normalized vector weight value, subscript i is an index operation, which performs slicing at the index specified by i; X' is the feature vector that only retains the top k nodes, and A' is the feature matrix that only retains the top k nodes.

[0087] b. The global feature representation of the graph is obtained by using a global addition pooling layer GlobalAddPool. For a single graph of the i-th layer, the output is obtained by the following formula:

[0088]

[0089] where r i is the addition pooling result, x n is the feature vector of the n-th node, N i is the number of nodes.

[0090] In this way, the model can obtain a complete feature representation of the graph through the two stages of node feature learning and node feature fusion.

[0091] The evaluation dataset input based on the network security posture assessment model of the MLP-GCN adopts a Linear layer and a Softmax layer to classify the global feature vector of the graph, and outputs a network security posture value in the range of [0, 1], and the network security posture level corresponding to the posture value is the evaluation result.

[0092] Specifically, the classification evaluation stage is as follows:

[0093] The model adopts a Linear layer and a Softmax layer to classify the global feature vector of the graph, and outputs a network security posture value probability in the range of [0, 1]. The calculation formula of the Linear layer is as follows:

[0094] y = xA T +b

[0095] where x is the feature vector obtained through the two stages of node feature learning and node feature fusion, A T is the weight matrix, b is the bias vector, and y is the output result of the Linear layer.

[0096] The calculation formula of the Softmax function is as follows:

[0097]

[0098] where z i is the value of the i-th row of the column vector y, e zi represents the exponential function of its natural logarithm, and C is the number of output nodes, i.e., the number of categories of classification. The column vector y' obtained by the calculation of the Softmax layer is y' = Softmax(y). Let z' i be the maximum value in the column vector y', which means that the category to which this posture data belongs is i. Category i is the posture value calculated by the MLP-GCN model, and the network security posture level corresponding to the posture value is shown in Table 2.

[0099] Table 2 Classification of Network Security Status Levels

[0100]

[0101] S3 conducts a performance comparison experiment between the MLP-GCN-based situation assessment method and the DT-based, SVM-based, MLP-based, GCN-based, and GAT-based situation assessment methods. Accuracy, Precision, Recall, and F1 score are selected as evaluation indicators to obtain the performance comparison results and verify the effectiveness of the MLP-GCN situation assessment method.

[0102] Depend on Figure 3 As can be seen, the situation assessment method based on MLP-GCN proposed in this chapter outperforms other methods in terms of accuracy, precision, recall, and F1 score. Compared with machine learning methods DT and SVM, the MLP-GCN method achieves higher scores in all aspects by 3 to 4 percentage points, while GAT and GCN methods are slightly lower than the proposed method. Experimental results demonstrate that the situation assessment method based on MLP-GCN proposed in this patent can utilize GCN to model the spatial information of the assessment data and use MLP to enhance the representation learning of the assessment data, thus significantly improving the performance of network security situation assessment.

[0103] The above-disclosed embodiments are merely preferred embodiments of the network security situation assessment method based on MLP-GCN of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A method for network security posture assessment based on MLP-GCN, characterized in that, The method comprises the following steps: data processing is performed on a public data set to obtain an evaluation data set; the evaluation data set is input into an MLP-GCN-based network security posture assessment model for feature learning, feature fusion and classification evaluation to obtain an evaluation result; the evaluation data set is input into an MLP-GCN-based network security posture assessment model for feature learning, feature fusion and classification evaluation to obtain an evaluation result, which comprises: the evaluation data set is input into an MLP-GCN-based network security posture assessment model, a feature matrix is generated based on the evaluation data set, and MLP-based feature learning training is performed based on the feature matrix; in the training process, the MLP neural network uses a back propagation algorithm to optimize network parameters to minimize a loss function, and node features are obtained; the evaluation data set is input into an MLP-GCN-based network security posture assessment model, a TopKPool layer is used to select preset nodes in the node features, the preset nodes are discarded according to learnable projection scores, and a GlobalAddPool layer is used to obtain global features of a graph based on the preset nodes; the evaluation data set is input into an MLP-GCN-based network security posture assessment model, a Linear layer and a Softmax layer are used to classify the global feature vector of the graph, and a network security posture value in the range of [0, 1] is output, and the network security posture level corresponding to the posture value is the evaluation result; after the step of inputting the evaluation data set into the MLP-GCN-based network security posture assessment model for feature learning, feature fusion and classification evaluation to obtain an evaluation result, the method further comprises: The performance comparison experiment is performed between the situation assessment method based on the MLP-GCN and the situation assessment method based on the DT, the situation assessment method based on the SVM, the situation assessment method based on the MLP, the situation assessment method based on the GCN and the situation assessment method based on the GAT, and the evaluation indexes of , , and are selected as evaluation indexes, and the evaluation performance comparison results are obtained.

2. The MLP-GCN-based network security posture assessment method of claim 1, wherein the data processing on the public data set to obtain an evaluation data set comprises: 17 features are selected from each data sample in the public data set according to the correlation between the posture value and the 49 different features and the meaning of each feature as a judgment basis to obtain a selected data set; non-numerical features in the selected data set are converted into numerical data to obtain a converted data set; a normalization processing method is used to linearly map the value range of each feature in the converted data set to the interval [0, 1] to obtain a normalized data set; the normalized data set is subjected to regularization processing to obtain a regularized data set; posture assessment index data is divided into four dimensions of attack, vulnerability, traffic and device as node data input into a graph neural network, the node feature attributes are data features under each index, and edges are connected between nodes that are closely related, thereby obtaining a graph data set; index selection and posture quantization are performed on the graph data set to obtain an evaluation data set.

3. The MLP-GCN-based network security posture assessment method of claim 2, wherein the public data set is an UNSW-NB15 public data set.

Images