A network attack prediction method and device, computer equipment and storage medium

Abstract

The application discloses a network attack prediction method and device, computer equipment and a storage medium, and belongs to the technical field of network security. The method comprises the following steps: preprocessing a network traffic dataset, time series modeling and data feature analysis; dividing the network traffic dataset into a normal traffic dataset and an attack traffic dataset according to network traffic; initializing improved grey wolf algorithm parameters; constructing a prediction model and initializing prediction model parameters; obtaining an optimal grey wolf first candidate by using a GWO search strategy; obtaining an optimal grey wolf another candidate by using a DLH search strategy; selecting an optimal candidate; updating X i (t) by using the optimal candidate; judging whether iteration is performed to a maximum iteration number; obtaining an optimal parameter combination of the prediction model and training the prediction model to obtain an optimized converged prediction model, and then identifying an anomaly caused by a network attack. The method disclosed by the application can identify the anomaly caused by the network attack.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network attack prediction method, apparatus, computer device, and storage medium. Background Technology

[0002] Cybersecurity is crucial because it encompasses all forms of data and information security. With the continuous development of network information technology, incidents such as data breaches and phishing attacks are constantly occurring. While enjoying the convenience brought by the internet, people are increasingly aware of the importance of cybersecurity. Existing security protection solutions include technologies such as firewalls, data encryption, and intrusion detection systems. Among these, firewalls and data encryption are passive security protection technologies, only protecting network security after a cyberattack has occurred. Intrusion detection systems, on the other hand, are proactive security protection technologies. By monitoring the network in real time, they can effectively detect cyberattacks and provide security managers with response decisions.

[0003] DoS and DDoS attacks are time-series, non-periodic attacks that generate and send large amounts of useless data, consuming network bandwidth and system resources, causing the attacked host to be unable to communicate normally with the outside world. DoS and DDoS attacks include many types, such as UDP floods, ACK-type attacks, DNS amplification requests, NTP amplification-type attacks, TCP floods, HTTP floods, and SYN floods. The purpose of these attacks is to consume the server's bandwidth, memory, and CPU resources, thereby forcing the server to refuse or provide very poor-performance services due to resource exhaustion. Summary of the Invention

[0004] The purpose of this invention is to provide a method, apparatus, computer device, and storage medium for predicting network attacks, to identify anomalies caused by network attacks, and to reduce information leakage and resource waste caused by network attacks.

[0005] To achieve the above objectives, the present invention provides the following solution:

[0006] In a first aspect, the present invention provides a method for predicting network attacks, comprising:

[0007] S1: Obtain network traffic dataset;

[0008] S2: Preprocess the network traffic dataset;

[0009] S3: Perform time series modeling on the preprocessed network traffic dataset to obtain the time series;

[0010] S4: Perform data feature analysis on the time series to obtain the feature analysis results;

[0011] S5: Based on the feature analysis results, the network traffic dataset is divided into normal traffic dataset and attack traffic dataset according to network traffic.

[0012] S6: Initialize the parameters of the improved Grey Wolf algorithm;

[0013] S7: Build the prediction model and initialize the prediction model parameters;

[0014] S8: Using the Grey Wolf Optimization Algorithm (GWO) search strategy, the optimal first candidate for the Grey Wolf, X, is obtained. IGWO (t+1);

[0015] S9: Using the hunting DLH search strategy, another candidate X for the optimal gray wolf was obtained. IDLH (t+1);

[0016] S10: Comparing First Candidate X IGWO (t+1) and another candidate X IDLH The fitness value at (t+1) is used to select the optimal candidate.

[0017] S11: Determine whether the fitness value of the optimal candidate is less than X. i (t);

[0018] S12: If so, update X using the best candidate. i (t), otherwise X i (t) remains unchanged in matrix Pop; X i (t) represents the position of the i-th wolf in the t-th iteration;

[0019] S13: Determine if the maximum number of iterations has been reached. If not, proceed to the next step; otherwise, increment the iteration count by 1 and jump to S8.

[0020] S14: Obtain the optimal parameter combination for the prediction model;

[0021] S15: Train the prediction model based on the optimal parameter combination to obtain an optimized and converged prediction model;

[0022] S16: Based on the optimized and converged prediction model, identify anomalies caused by network attacks.

[0023] Optionally, the network traffic dataset includes: Internet traffic ec_data, network traffic DARPA99, and DDoS attack dataset DARPA00.

[0024] Optionally, preprocessing the network traffic dataset specifically includes the following steps:

[0025] The ec_data is normalized.

[0026] Data sampling operations were performed on the DARPA99 and DARPA00 datasets at 1-minute intervals to obtain the number of packets per minute as the IP packet statistical feature IPDCF.

[0027]

[0028] Among them, T i+1 -T i =1min, P t This is a data packet.

[0029] Optionally, performing data feature analysis on the time series to obtain the feature analysis results specifically includes the following steps:

[0030] The IPDCF is sampled at time intervals Δt = 1 min, and the IPDCF value is calculated for each sample. After m samples, the period T is obtained.

[0031] T(M,Δt)={IPDCF,i=1,2,…,M}

[0032] Where M is the length of the dataset, and Δt = 1 min.

[0033] Optionally, the initialization of the improved gray wolf algorithm parameters specifically includes the following steps:

[0034] A wolf pack is randomly generated, with a total number of wolves N=50, a maximum number of iterations Maxiter=10, a problem dimension D, and the number of BiLSTM optimization parameters D=4. The number of hidden layer units of BiLSTM neurons1 and neurons2, the forgetting rate dropout, and the batch size correspond to the parameter coordinates of the individual wolf positions. The upper and lower limits are set as ub=[200,200,0.9,10] and lb=[32,32,0.1,1].

[0035] The position of the i-th wolf in the t-th iteration is represented as:

[0036] X i (t)={x i1 ,x i2 ,…,x iD}0≤i≤N

[0037] The entire wolf population is stored in a matrix Pop, which has N rows and D columns, where D is the dimension of the problem.

[0038] Optionally, the optimal first candidate gray wolf X is obtained using the Gray Wolf Optimization Algorithm (GWO) search strategy. IGWO (t+1) specifically includes the following steps:

[0039] Based on fitness values, the wolf pack is divided into four levels: α, β, δ, and ω. α is the optimal solution, β is the second-best solution, δ is the best solution, and ω is the candidate solution. The hunting process is guided by α, β, and δ, and ω follows α, β, and δ toward the prey. The position of the prey corresponds to the solution to the problem.

[0040] The three wolves α, β, and δ with the lowest fitness values ​​are selected for a GWO search, and the positions of the other gray wolves ω are updated to obtain the first candidate X. IGWO (t+1);

[0041] The hunting DLH search strategy was used to obtain another candidate for the optimal gray wolf, X. IDLH (t+1) is specifically calculated using the following formula:

[0042] X IDLH,d (t+1)=X i,d (t)+rand×(X n,d (t)-X r,d (t))

[0043] Among them, X n,d (t) is the neighborhood N constructed from the DLH search strategy. i The randomly selected neighbors in (t), X r,d (t) represents a random wolf selected from the matrix Pop; X i,d (t) represents the position of the i-th wolf in the d-th dimension during the t-th iteration;

[0044] N i (t)={X i,d (t)|D i (X i (t), X j (t))≤R i (t),X j (t)∈Pop}

[0045] R i (t)=||X i (t)-X IGWO (t+1)||

[0046] Among them, D i It is X i (t) and X j The Euclidean distance between (t) and R; i (t) is the radius of the neighborhood, X i (t) represents the position of the i-th wolf in the t-th iteration, X j (t) represents the position of the j-th wolf in the t-th iteration.

[0047] Optionally, based on the optimized and converged prediction model, identifying anomalies caused by network attacks specifically includes the following steps:

[0048] The attack traffic dataset was input into the optimized and converged prediction model to conduct attack experiments.

[0049] Statistical analysis was performed on the IPDCF value intervals of normal flow and predicted flow to obtain the IPDCF value intervals [a, b] and [c, d] for normal flow and predicted flow;

[0050] Obtain the maximum value Z of the IPDCF value interval [c, d] for the predicted flow;

[0051] Calculate the average error A between the IPDCF value of the predicted flow and the IPDCF value of the normal network, and set the threshold U = Z + A;

[0052] When the deviation X between the actual value and the predicted value is greater than or equal to the preset threshold U, it is considered abnormal traffic, and network attack behavior can be determined. When the deviation between the actual value and the predicted value is less than the preset threshold U, it is considered normal network congestion.

[0053] Secondly, the present invention provides a network attack prediction device, comprising:

[0054] The network traffic dataset acquisition module is used to acquire network traffic datasets.

[0055] A processing module is used to preprocess the network traffic dataset;

[0056] The time series modeling module is used to perform time series modeling on the preprocessed network traffic dataset to obtain the time series.

[0057] The feature analysis module is used to perform data feature analysis on the time series and obtain feature analysis results;

[0058] The network traffic dataset partitioning module is used to divide the network traffic dataset into normal traffic dataset and attack traffic dataset according to the network traffic based on the feature analysis results.

[0059] The initialization module is used to initialize the parameters of the improved Grey Wolf algorithm;

[0060] The prediction model building module is used to build prediction models and initialize their parameters.

[0061] The first candidate determination module is used to obtain the optimal first gray wolf candidate X using the Gray Wolf Optimization Algorithm (GWO) search strategy. IGWO (t+1);

[0062] The second candidate determination module is used to obtain the other optimal gray wolf candidate X using the hunting DLH search strategy. IDLH (t+1);

[0063] The comparison module is used to compare the first candidate X. IGWO (t+1) and another candidate X IDLH The fitness value at (t+1) is used to select the optimal candidate.

[0064] The first judgment module is used to determine whether the fitness value of the optimal candidate is less than X. i (t);

[0065] The update module is used to update X with the best candidate when X is the optimal candidate. i (t), otherwise X i (t) remains unchanged in matrix Pop; X i (t) represents the position of the i-th wolf in the t-th iteration;

[0066] The second judgment module is used to determine whether the maximum number of iterations has been reached. If not, the next step is executed; otherwise, the iteration count is incremented by 1, and the process jumps to the first candidate determination module.

[0067] The optimal parameter combination determination module is used to obtain the optimal parameter combination of the prediction model;

[0068] The training module is used to train the prediction model based on the optimal parameter combination to obtain an optimized and converged prediction model.

[0069] The network attack identification module is used to identify anomalies caused by network attacks based on the optimized and converged prediction model.

[0070] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0071] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0072] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0073] This invention proposes the IGWO-BiLSTM network attack prediction model. The IGWO method can solve the problems of slow convergence, premature loss of diversity in the original GWO, and easy getting trapped in local optima. IGWO-BiLSTM can identify anomalies caused by network attacks by predicting normal network traffic and setting reasonable thresholds, thereby reducing information leakage and resource waste caused by network attacks. Attached Figure Description

[0074] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0075] Figure 1 This is a schematic diagram of the IGWO-BiLSTM model structure of the present invention;

[0076] Figure 2 This is a flowchart of the IGWO-BiLSTM process of the present invention;

[0077] Figure 3 This is a schematic diagram illustrating the normalization of the ec_data dataset in this invention;

[0078] Figure 4 This is a schematic diagram of the characteristics of the 5-day data from week 1 of DARPA99 in this invention;

[0079] Figure 5 This is a partial comparison chart of the actual and predicted values ​​of ec_data in this invention;

[0080] Figure 6 This is a comparison chart of the actual and predicted values ​​of DARPA99 in this invention;

[0081] Figure 7 This is a schematic diagram of the simulated attack experiment results of this invention. Detailed Implementation

[0082] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0083] The purpose of this invention is to provide a method, apparatus, computer device, and storage medium for predicting network attacks, to identify anomalies caused by network attacks, and to reduce information leakage and resource waste caused by network attacks.

[0084] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0085] This invention provides a method for predicting network attacks, comprising:

[0086] S1: Obtain network traffic dataset.

[0087] This invention uses three datasets: internet traffic from a dedicated Internet Service Provider (ISP) (represented by ec_data); three weeks of network traffic collected by MIT Lincoln Laboratory in 1999 (represented by DARPA99); and a DDoS attack dataset collected by MIT Lincoln Laboratory in 2000 (represented by DARPA00). The ec_data and DARPA99 datasets are used to demonstrate the universality of the prediction model, while the DARPA00 dataset is used for attack experiments.

[0088] S2: Preprocess the network traffic dataset.

[0089] Specifically, the ec_data dataset contains 14,772 sets of network traffic data from July 6, 2005 to July 28, 2005, sampled at 5-minute intervals. The dataset was then normalized.

[0090]

[0091] in, This is the normalized value, where x is the original value. min It is the minimum value, x max It is the maximum value;

[0092] The DARPA99 dataset provides three weeks of training data for DARPA intrusion detection in 1999. Weeks 1 and 3 contain no attacks as training data, while week 2 includes a subset of attacks from 1998 and several new attacks as test data. Data sampling was performed on both the DARPA99 and DARPA00 datasets at 1-minute intervals to obtain the number of packets per minute as the IP packet statistical feature (IPDCF).

[0093]

[0094] Among them, T i+1 -T i =1min, P t This is a data packet.

[0095] S3: Perform time series modeling on the preprocessed network traffic dataset to obtain the time series.

[0096] S4: Perform data feature analysis on the time series to obtain feature analysis results.

[0097] The IPDCF in step S2 is sampled at time intervals Δt = 1 min, and the IPDCF value is calculated for each sample. After m samples, T is obtained.

[0098] T(M,Δt)={IPDCF,i=1,2,…,M} (3)

[0099] Where M is the length of the dataset, and Δt = 1 min;

[0100] The ec_data dataset exhibits periodicity in macroscopic network traffic data and frequent bursts in microscopic network traffic data.

[0101] The DARPA99 dataset uses 'd' as the period and 'min' as the time interval, and the data at fixed times each day shows a relatively fixed trend.

[0102] S5: Based on the feature analysis results, the network traffic dataset is divided into normal traffic dataset and attack traffic dataset according to network traffic.

[0103] Specifically, the following steps are included:

[0104] Step 5.1: Train the prediction model using normal network traffic data, and conduct attack experiments using attack traffic data.

[0105] Step 5.2: Divide the time series obtained from S2 and S3 into training and test sets in a 7:3 ratio;

[0106] Step 5.3: Use the sliding window technique to extract time-series network traffic data for both normal traffic data and attack traffic data. Select a window with a length of 60 and a width of 1, and set the step size to 10.

[0107] S6: Initialize the parameters of the improved Grey Wolf algorithm.

[0108] Specifically, this includes: randomly generating a wolf pack with a total number of wolves N=50, a maximum number of iterations Maxiter=10, a problem dimension D, and the number of BiLSTM optimization parameters D=4. The number of hidden layer units (neurons1, neurons2), the forgetting rate (dropout), and the batch size (batch_size) of the BiLSTM correspond to the parameter coordinates of the individual wolf pack positions, and setting upper and lower limits ub=[200,200,0.9,10] and lb=[32,32,0.1,1].

[0109] The position of the i-th wolf in the t-th iteration is represented as:

[0110] X i (t)={x i1 ,x i2 ,…,x iD}0≤i≤N

[0111] The entire wolf population is stored in a matrix Pop, which has N rows and D columns, where D is the dimension of the problem.

[0112] S7: Build the prediction model and initialize the prediction model parameters.

[0113] Specifically, it includes:

[0114] The selected BiLSTM model includes: two layers of BiLSTM, one layer of Dropout, and one layer of Dense;

[0115] The number of hidden layer units (neurons1, neurons2), the forgetting rate (dropout), and the batch size (batch_size) of the BiLSTM are initialized as follows: neurons1 = 128, neurons2 = 64, dropout = 0.4, batch_size = 5, and the maximum number of iterations is 500.

[0116] The fitness function is the mean squared error (MSE) between the predicted and actual values. Equation (4) is used to calculate the fitness value of each wolf in the pack, and the fitness value is returned to IGWO.

[0117]

[0118] Among them, Y i It is the actual value. This is a predicted value.

[0119] S8: Using the Grey Wolf Optimization Algorithm (GWO) search strategy, the optimal first candidate for the Grey Wolf, X, is obtained. IGWO (t+1).

[0120] S9: Using the hunting DLH search strategy, another candidate X for the optimal gray wolf was obtained. IDLH (t+1).

[0121] Specifically, it includes:

[0122] The Grey Wolf Optimizer (GWO) algorithm categorizes the wolf pack into four levels based on fitness values: α, β, δ, and ω. α represents the optimal solution, β the suboptimal solution, δ the best solution, and ω a candidate solution. The hunting process is guided by α, β, and δ, with ω following α, β, and δ towards the prey. The prey's position corresponds to the solution to the problem.

[0123] MSE is the expected value of the squared difference between the true value and the predicted value. The larger the value, the larger the error. The three wolves α, β, and δ with the smallest fitness values ​​are selected for GWO search, and the positions of the other gray wolves ω are updated to obtain the first candidate X. IGWO (t+1).

[0124] S10: Comparing First Candidate X IGWO (t+1) and another candidate X IDLH The fitness value of (t+1) is used to select the optimal candidate.

[0125] In the DLH search strategy, Wolf X i Each dimension of the new position of (t) is calculated by equation (5), X IDLH,d (t+1)=X i,d (t)+rand×(X n,d (t)-X r,d (t)) (5)

[0126] Among them, X n,d (t) is the neighborhood N constructed from the DLH search strategy. i The randomly selected neighbors in (t), X r,d (t) is a random wolf selected from Pop;

[0127] DLH Neighborhood N i (t) Constructed by equation (6)

[0128] N i (t)={X i,d (t)|D i (X i (t), X j (t))≤R i (t),X j (t)∈Pop} (6)

[0129] R i (t)=||X i (t)-X IGWO (t+1)|| (7)

[0130] Among them, D i It is X i (t) and X jThe Euclidean distance between (t) and R; i (t) is the radius of the neighborhood, DLH uses X i The current position and candidate position X of (t) IGWO The Euclidean distance between (t+1) is calculated using equation (7) to determine the radius of the neighborhood.

[0131] S11: Determine whether the fitness value of the optimal candidate is less than X. i (t).

[0132] S12: If so, update X using the best candidate. i (t), otherwise X i (t) remains unchanged in matrix Pop; X i (t) represents the position of the i-th wolf in the t-th iteration.

[0133] The specific formula is as follows:

[0134]

[0135] S13: Determine if the maximum number of iterations has been reached. If not, proceed to the next step; otherwise, increment the iteration count by 1 and jump to S8.

[0136] S14: Obtain the optimal parameter combination for the prediction model.

[0137] S15: Train the prediction model based on the optimal parameter combination to obtain an optimized and converged prediction model.

[0138] The optimal parameter combination includes neurons1, neurons2, dropout, and batch_size. These parameters are input into IGWO-BiLSTM and trained to obtain an optimized and converged IGWO-BiLSTM network prediction model. By inputting network attack data into the prediction model, the normal network traffic and the attack network traffic can be compared, enabling timely and accurate prediction of attacks.

[0139] S16: Based on the optimized and converged prediction model, identify anomalies caused by network attacks.

[0140] The optimal parameter combination is substituted into the BiLSTM training prediction model, and the mean squared error (MSE), root mean squared error (RMSE), mean absolute error (MAE), and coefficient of determination (R²) are calculated. 2The improved gray wolf optimized RNN (IGWO-RNN), improved gray wolf optimized LSTM (IGWO-LSTM), improved gray wolf optimized GRU (IGWO-GRU), and the improved gray wolf optimized BiLSTM (IGWO-BiLSTM) proposed in this paper are used as evaluation metrics to compare the prediction performance.

[0141] The attack data is input into the prediction model to conduct attack experiments;

[0142] Statistical analysis is performed on the IPDCF value ranges of normal flow and predicted flow to obtain the IPDCF value ranges [a, b] and [c, d] of normal flow and predicted flow. The maximum value Z of the IPDCF value range [c, d] of predicted flow is obtained. The average error A between the IPDCF value of predicted flow and the IPDCF value of normal network is calculated. The threshold U = Z + A is set. According to equation (9), when the deviation X between the actual value and the predicted value exceeds the preset threshold U, it is considered to be abnormal traffic, and it can be determined that there is network attack behavior. When the deviation between the actual value and the predicted value is large but does not exceed the preset threshold U, it is considered to be normal network congestion other than abnormality.

[0143]

[0144] Example

[0145] To address the ongoing issues of information leaks, phishing attacks, and the low accuracy and long response times of existing network attack prediction models, this paper proposes a network attack prediction method based on an improved Grey Wolf algorithm and optimized BiLSTM. This embodiment uses PyCharm as the development platform, Python as the development language, and PyTorch as the deep learning framework. The method described above is employed to predict network traffic attacks. The specific process is as follows:

[0146] Step 1: Use dedicated Internet Service Provider (ISP) internet traffic (ec_data), such as Figure 3 As shown; network traffic collected by MIT Lincoln Laboratory over three weeks in 1999 (DARPA99), such as... Figure 4 As shown; DOS and DDOS attack datasets collected by MIT Lincoln Laboratory in 2000 (DARPA00).

[0147] Step 2: Use the network traffic obtained in Step 1 as input, such as... Figure 1 As shown, the prediction model in this method is loaded, and the IGWO-BiLSTM prediction process is as follows: Figure 2 As shown in the figure, the prediction of network traffic attacks is obtained, and a partial comparison of the actual and predicted values ​​of ec_data is shown in the figure. Figure 5 As shown in the figure, the comparison between the actual and predicted values ​​of DARPA99 is as follows: Figure 6 As shown.

[0148] Step 3: The evaluation metrics used in this invention include Mean Squared Error (MSE), Root Mean Squared Error (RMSE), Mean Absolute Error (MAE), and Coefficient of Determination (R²). 2 );

[0149] The specific formula is as follows:

[0150]

[0151]

[0152]

[0153]

[0154] Among them, Y i Represents the true value. Indicates the predicted value. This represents the mean of the true values.

[0155] Step 4: Conduct attack experiments on the prediction model to obtain the attack prediction results, such as... Figure 7 As shown, at the 36th minute, the deviation between the actual value and the predicted value exceeded the threshold, indicating that a network attack had occurred. At the 80th-90th minute, although the deviation between the actual value and the predicted value was large, it did not exceed the threshold, so it was not identified as a network attack, but rather as an increase in the user's actual network demand, thus avoiding false alarms.

[0156] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0157] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for predicting network attacks, characterized in that, include: S1: Obtain network traffic dataset: S2: Preprocess the network traffic dataset; S3: Perform time series modeling on the preprocessed network traffic dataset to obtain the time series; S4: Perform data feature analysis on the time series to obtain the feature analysis results; S5: Based on the feature analysis results, the network traffic dataset is divided into normal traffic dataset and attack traffic dataset according to network traffic. S6: Initialize the parameters of the improved Grey Wolf algorithm; S7: Build the prediction model and initialize the prediction model parameters; S8: Using the Grey Wolf Optimization Algorithm (GWO) search strategy, the optimal first candidate for the Grey Wolf, X, is obtained. IGWO (t+1); S9: Using the hunting DLH search strategy, another candidate X for the optimal gray wolf was obtained. IDLH (t+1); S10: Comparing First Candidate X IGWO (t+1) and another candidate X IDLH The fitness value at (t+1) is used to select the optimal candidate. S11: Determine whether the fitness value of the optimal candidate is less than X. i (t); S12: If so, update X using the best candidate. i (t), otherwise X i (t) remains unchanged in matrix Pop; X i (t) represents the position of the i-th wolf in the t-th iteration; the matrix Pop includes the entire wolf population; S13: Determine if the maximum number of iterations has been reached. If not, proceed to the next step; otherwise, increment the iteration count by 1 and jump to S8. S14: Obtain the optimal parameter combination for the prediction model; S15: Train the prediction model based on the optimal parameter combination to obtain an optimized and converged prediction model; S16: Based on the optimized and converged prediction model, identify anomalies caused by network attacks.

2. The network attack prediction method according to claim 1, characterized in that, The network traffic dataset includes: Internet traffic ec_data, network traffic DARPA99, and DDoS attack dataset DARPA00.

3. The network attack prediction method according to claim 2, characterized in that, Preprocessing the network traffic dataset specifically includes the following steps: The ec_data is normalized. Data sampling operations were performed on the DARPA99 and DARPA00 datasets at 1-minute intervals to obtain the number of packets per minute as the IP packet statistical feature IPDCF. Among them, T i+1 -T i =1min, P t This is a data packet.

4. The network attack prediction method according to claim 3, characterized in that, The specific steps for performing data feature analysis on the time series to obtain the feature analysis results include: The IPDCF is sampled at time intervals Δt = 1 min, and the IPDCF value is calculated for each sample. After m samples, the period T is obtained. T(M,Δt)={IPDCF,i=1,2,...,M} Where M is the length of the dataset, and Δt = 1 min.

5. The network attack prediction method according to claim 1, characterized in that, The initialization of the improved Grey Wolf algorithm parameters specifically includes the following steps: A wolf pack is randomly generated, with a total number of wolves N = 50, a maximum number of iterations Maxiter = 10, a problem dimension D, and the number of BiLSTM optimization parameters D = 4. The number of hidden layer units of BiLSTM neurons1 and neurons2, the forgetting rate dropout, and the batch size correspond to the parameter coordinates of the individual wolf positions. The upper and lower limits are set as ub = [200, 200, 0.9, 10] and lb = [32, 32, 0.1, 1]. The position of the i-th wolf in the t-th iteration is represented as: X i (t)={x i1 ,x i2 ,…,x iD }0≤i≤N The entire wolf population is stored in a matrix Pop, which has N rows and D columns, where D is the dimension of the problem.

6. The network attack prediction method according to claim 1, characterized in that, The optimal first candidate gray wolf X was obtained by using the Gray Wolf Optimization Algorithm (GWO) search strategy. IGWO (t+1) specifically includes the following steps: Based on fitness values, the wolf pack is divided into four levels: α, β, δ, and ω. α is the optimal solution, β is the second-best solution, δ is the best solution, and ω is the candidate solution. The hunting process is guided by α, β, and δ, and ω follows α, β, and δ toward the prey. The position of the prey corresponds to the solution to the problem. The three wolves α, β, and δ with the lowest fitness values ​​are selected for a GWO search, and the positions of the other gray wolves ω are updated to obtain the first candidate X. IGWO (t+1); The hunting DLH search strategy was used to obtain another candidate for the optimal gray wolf, X. IDLH (t+1) is specifically calculated using the following formula: X IDLH,d (t+1)=X i,d (t)+rand×(X n，d (t)-X r，d (t)) Among them, X n，d (t) is the neighborhood N constructed from the DLH search strategy. i The randomly selected neighbors in (t), X r,d (t) represents a random wolf selected from the matrix Pop; X i,d (t) represents the position of the i-th wolf in the d-th dimension during the t-th iteration; N i (t)={X i,d (t)|D i (X i (t),X j (t))≤R i (t),X j (t)∈Pop} R i (t)=||X i (t)-X IGWO (t+1)|| Among them, D i It is X i (t) and X j The Euclidean distance between (t) and R; i (t) is the radius of the neighborhood, X i (t) represents the position of the i-th wolf in the t-th iteration, X j (t) represents the position of the j-th wolf in the t-th iteration.

7. The network attack prediction method according to claim 4, characterized in that, Based on the optimized and converged prediction model, identifying anomalies caused by network attacks specifically includes the following steps: The attack traffic dataset was input into the optimized and converged prediction model to conduct attack experiments. Statistical analysis was performed on the IPDCF value intervals of normal flow and predicted flow to obtain the IPDCF value intervals [a, b] and [c, d] for normal flow and predicted flow; Obtain the maximum value Z of the IPDCF value interval [c, d] for the predicted flow; Calculate the average error A between the IPDCF value of the predicted flow and the IPDCF value of the normal network, and set the threshold U = Z + A; When the deviation X between the actual value and the predicted value is greater than or equal to the preset threshold U, it is considered abnormal traffic, and network attack behavior can be determined. When the deviation between the actual value and the predicted value is less than the preset threshold U, it is considered normal network congestion.

8. A network attack prediction device, characterized in that, include: The network traffic dataset acquisition module is used to acquire network traffic datasets. A processing module is used to preprocess the network traffic dataset; The time series modeling module is used to perform time series modeling on the preprocessed network traffic dataset to obtain the time series. The feature analysis module is used to perform data feature analysis on the time series and obtain feature analysis results; The network traffic dataset partitioning module is used to divide the network traffic dataset into normal traffic dataset and attack traffic dataset according to the network traffic based on the feature analysis results. The initialization module is used to initialize the parameters of the improved Grey Wolf algorithm; The prediction model building module is used to build prediction models and initialize their parameters. The first candidate determination module is used to obtain the optimal first gray wolf candidate X using the Gray Wolf Optimization Algorithm (GWO) search strategy. IGWO (t+1); The second candidate determination module is used to obtain the other optimal gray wolf candidate X using the hunting DLH search strategy. IDLH (t+1); The comparison module is used to compare the first candidate X. IGWO (t+1) and another candidate X IDLH The fitness value at (t+1) is used to select the optimal candidate. The first judgment module is used to determine whether the fitness value of the optimal candidate is less than X. i (t); The update module is used to update X with the best candidate when X is the optimal candidate. i (t), otherwise X i (t) remains unchanged in matrix Pop; X i (t) represents the position of the i-th wolf in the t-th iteration; The second judgment module is used to determine whether the maximum number of iterations has been reached. If not, the next step is executed; otherwise, the iteration count is incremented by 1, and the process jumps to the first candidate determination module. The optimal parameter combination determination module is used to obtain the optimal parameter combination of the prediction model; The training module is used to train the prediction model based on the optimal parameter combination to obtain an optimized and converged prediction model. The network attack identification module is used to identify anomalies caused by network attacks based on the optimized and converged prediction model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images