An information entropy-based network anomaly detection method, system and electronic device

Abstract

The application provides a network anomaly detection method and system based on information entropy and an electronic device. The information entropy is calculated based on the connection characteristics of the network. The anomaly detection method comprises the following steps: collecting and analyzing the session connection data of the network; counting the connection characteristics of the network and establishing a connection characteristic baseline; calculating the information entropy baseline of the network based on the connection characteristic baseline; collecting real-time data to calculate the real-time information entropy and the deviation between the real-time information entropy and the information entropy baseline; and determining whether the network is abnormal. The application also provides a network anomaly detection system using the aforementioned network anomaly detection method based on information entropy, which comprises a connection characteristic collection module, an information entropy baseline calculation module, a real-time data collection module, a real-time information entropy calculation module, a comparison module and a result output module. The application also provides an electronic device comprising the aforementioned network anomaly detection system. The application can solve the problem that it is difficult to determine and evaluate the entire network connection state in the prior art.

Description

Technical Field

[0001] This invention relates to a network anomaly detection technology, and more particularly to a network anomaly detection method, system, and electronic device based on information entropy. Background Technology

[0002] Numerous studies have been conducted on anomaly detection based on traffic baselines. This approach primarily utilizes specific characteristics of network traffic, such as bandwidth (bps), packet rate (pps), message length, or other characteristic fields, to statistically generate a baseline using feature vectors. A tolerance range is then set, and the current actual traffic characteristics are compared to the baseline value. The difference between the actual and baseline values ​​is calculated; if the difference falls within the tolerance range, it is considered normal error; otherwise, the traffic is considered abnormal. Baseline threshold-based methods typically set threshold ranges as percentages or absolute values.

[0003] This type of traffic baseline is suitable for identifying anomalies in individual devices, as its calculation method is simple and easy to implement. However, the traffic baseline is not applicable to the entire network and makes it difficult to determine whether the overall network connectivity is abnormal. Summary of the Invention

[0004] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a network anomaly detection method based on information entropy, which solves the problem of difficulty in judging and evaluating the overall network connectivity status in the prior art.

[0005] To achieve the above and other related objectives, this invention provides a network anomaly detection method based on information entropy, comprising:

[0006] Collect and analyze the session connection data of the network;

[0007] Statistically analyze the connectivity characteristics of the network and establish a connectivity characteristic baseline;

[0008] The information entropy baseline of the network based on the connection feature baseline is calculated;

[0009] Collect real-time data and calculate the real-time information entropy and the deviation between the real-time information entropy and the information entropy baseline;

[0010] Determine if the network is abnormal.

[0011] In one embodiment of the present invention, in the step of collecting and analyzing the session connection data of the network, the session connection data includes: source Internet Protocol (IP) address, destination IP address, destination port, and communication protocol.

[0012] In one embodiment of the present invention, in the step of collecting and analyzing the session connection data of the network, in the step of statistically analyzing the connection characteristics of the network and establishing a connection characteristic baseline, the connection characteristics include security weight and the proportion of a network connection in the entire network connection set.

[0013] In one embodiment of the present invention, in the step of calculating the information entropy baseline and the real-time information entropy, the information entropy is calculated from the connection characteristics of the network, and the formula for the information entropy is: Where P(X) i ) for network connection X i The proportion of the entire set of network connections.

[0014] In one embodiment of the present invention, each of the network connections X i It contains four elements: source IP address, destination IP address, destination port, and communication protocol.

[0015] In one embodiment of the present invention, each network connection is assigned a security weight, denoted as D(X). i ), and restrict 1≤D(X) i )≤10; The total weight of the logical topology of the entire network is labeled as: The P(X) i )=D(X i ) / D(X).

[0016] In one embodiment of the present invention, the calculation rule for the real-time information entropy includes:

[0017] The total weight and the information entropy baseline of the logical topology of the entire network remain unchanged;

[0018] If a first network connection disappears, the amount of information corresponding to the first network connection is subtracted.

[0019] If a new second network connection is added, the second network connection is added to the entire set of network connections, and the security weight is assigned a maximum value when calculating the information content corresponding to the second network connection.

[0020] In one embodiment of the present invention, in the step of collecting real-time data, calculating real-time information entropy and the deviation between the real-time information entropy and the information entropy baseline, a preset length period is selected, and all connection data of the period is cached to avoid fluctuations caused by short connections.

[0021] In one embodiment of the present invention, the preset length is greater than 1 minute.

[0022] In one embodiment of the present invention, the deviation is the absolute value of the difference between the real-time information entropy and the information entropy baseline.

[0023] In one embodiment of the present invention, when the deviation is greater than a threshold, the network is determined to be abnormal.

[0024] The present invention also provides a network anomaly detection system, using the network anomaly detection method based on information entropy described in any of the above claims, including a connection feature collection module, an information entropy baseline calculation module, a real-time data acquisition module, a real-time information entropy calculation module, a comparison module, and a result output module.

[0025] The connection feature collection module is used to collect and analyze the network's session connection data, statistically analyze the network's connection features, and establish a connection feature baseline.

[0026] In one embodiment of the present invention,

[0027] The information entropy baseline calculation module is used to calculate the information entropy baseline from the connection feature baseline;

[0028] The real-time data acquisition module is used to acquire the real-time network session connection data;

[0029] The real-time information entropy calculation module is used to calculate the real-time information entropy from the real-time network session connection data.

[0030] The comparison module calculates the corresponding deviation value based on the information entropy baseline and the real-time information entropy, and determines whether the network is working properly based on the deviation value;

[0031] The result output module is used to output the working status of the network.

[0032] The present invention also provides an electronic device, including the network anomaly detection system as described above.

[0033] As described above, the network anomaly detection method based on information entropy of the present invention has the following beneficial effects: by establishing an information entropy baseline by combining the network connection data of the entire control network with the importance of the business, a quantitative indicator is used to measure the connection stability of the network, and anomalies in the connection of the entire network are detected. Moreover, the calculation method is simple, consumes very little CPU, and is easy to implement in engineering. Attached Figure Description

[0034] Figure 1 The diagram shows the steps of a network anomaly detection method based on information entropy according to the present invention.

[0035] Figure 2 The diagram shown is a schematic diagram of a network anomaly detection system according to the present invention. Detailed Implementation

[0036] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other. It should also be understood that the terminology used in the embodiments of the present invention is for describing specific implementation schemes and not for limiting the scope of protection of the present invention. Test methods in the following embodiments that do not specify specific conditions are generally performed under conventional conditions or according to the conditions recommended by the respective manufacturers.

[0037] Please see Figure 1 and Figure 2 It should be understood that the structures, proportions, sizes, etc., illustrated in the accompanying drawings are merely for illustrative purposes to aid those skilled in the art and to facilitate understanding. They are not intended to limit the scope of the invention and therefore have no substantial technical significance. Any modifications to the structure, changes in proportions, or adjustments to size, without affecting the effectiveness or purpose of the invention, should still fall within the scope of the technical content disclosed herein. Furthermore, the terms "upper," "lower," "left," "right," "middle," and "one" used in this specification are merely for clarity and not intended to limit the scope of the invention. Changes or adjustments to their relative relationships, without substantially altering the technical content, should also be considered within the scope of the invention.

[0038] Information entropy is a metric used to measure uncertainty, which is the probability of discrete random events occurring. Simply put, the more chaotic the situation, the greater the information entropy, and vice versa.

[0039] This invention provides a specific definition of the concept of information entropy, whereby the specific information entropy is calculated from the connection characteristics of a specific network.

[0040] Please see Figure 1 This invention provides a network anomaly detection method based on information entropy, comprising:

[0041] Collect and analyze the session connection data of the network;

[0042] Statistically analyze the connectivity characteristics of the network and establish a connectivity characteristic baseline;

[0043] The information entropy baseline of the network based on the connection feature baseline is calculated;

[0044] Collect real-time data and calculate the real-time information entropy and the deviation between the real-time information entropy and the information entropy baseline;

[0045] Determine if the network is abnormal.

[0046] This invention discloses a network anomaly detection method based on information entropy. The method checks for network connection anomalies based on an information entropy baseline. First, it is necessary to collect all network connection information in the network system, statistically analyze the feature data of each dimension, calculate the information entropy based on these features, and form the information entropy baseline of the entire network. Then, a tolerance judgment method is used, that is, compared with a threshold determined by practical experience, to determine whether the network connection status is abnormal.

[0047] A preferred embodiment of the present invention is described in detail below:

[0048] First, methods such as switch traffic mirroring are used to obtain all network traffic data of the system.

[0049] Network traffic is analyzed using network traffic monitoring and auditing equipment, retaining all network session connection information, mainly including: the source IP address (SrcIP), destination IP address (DstIP), destination port (DstPort), and communication protocol (Protocol) of the network session. A connection is marked as X, and in this embodiment, X = {SrcIP, DstIP, DstPort, Protocol}.

[0050] To address the information disturbances caused by TCP short connections and UDP communication, a time range can be agreed upon based on business characteristics, such as 10 minutes. Repeated TCP short connections or UDP communication within 10 minutes are considered as the same connection data and are not counted as changes.

[0051] Then comes the statistics and calculation phase, which involves collecting network traffic data of a certain business control network over a period of time to obtain the network's connection characteristics, establishing a connection characteristic baseline, and calculating the information entropy baseline based on this connection characteristic baseline.

[0052] Connection characteristics include security weights and the proportion of a network connection within the entire set of network connections.

[0053] The formula for information content is:

[0054] h(x) = -P(x)log₂P(x)

[0055] Information entropy is the mathematical expectation of the amount of information, and its calculation formula is:

[0056]

[0057] Where P(X) i) represents network session connection X i The proportion within the entire set of network connections. Here, "proportion" represents X. i The probability or severity of a negative impact on the entire business system when this network connection changes. Each network session connection is an X. i Then the entire set {X} i The complete logical topology of the business network is constituted. To calculate the information entropy of the entire network connection, the core lies in how to calculate each P(X)... i In this embodiment of the invention, 2 is uniformly used as the base, but 10 or other numbers can also be used as the base.

[0058] Each network connection X i It contains 4 elements: {SrcIP, DstIP, DstPort, Protocol}.

[0059] In a control network, each node has varying importance, and the importance of network communication also differs; each connection uses a different protocol, and the security and reliability of the session also vary. Therefore, it is necessary to assign a security weight, denoted as D(X), to each network connection, considering both the importance of the node and the security of the connection. i As an example, it is defined that 1 ≤ D(X). i )≤10.

[0060] This invention uses the connectivity features statistically analyzed over a period of time as a comparison benchmark, i.e., the connectivity feature baseline. The aforementioned weights D and proportions P represent the connectivity features of each network connection. The specific values ​​serve as the benchmark for subsequent real-time comparisons, i.e., the connectivity feature baseline.

[0061] For network connections that never appear in the baseline of connectivity features, their weights are all defaulted to the maximum value, i.e., D=10.

[0062] The total weight of the logical topology of the entire network is labeled as follows:

[0063]

[0064] Correspondingly, P(X) i )=D(X i ) / D(X)

[0065] Source IP Destination IP Destination Port protocol Weight D Specific gravity P h(x) 192.168.1.100 192.168.1.101 514 UDP 3 6％ 0.24 192.168.1.100 192.168.1.101 8080 TCP 5 10％ 0.33 192.168.1.101 192.168.1.102 22 TCP 8 16％ 0.416 192.168.1.101 192.168.1.102 21 TCP 8 16％ 0.416 192.168.1.126 192.168.1.200 3389 TCP 8 16％ 0.416 192.168.1.126 192.168.1.201 3389 TCP 8 16％ 0.416 192.168.1.200 192.168.1.101 514 UDP 3 6％ 0.24 192.168.1.126 192.168.1.101 514 UDP 3 6％ 0.24 192.168.1.222 192.168.1.101 514 UDP 3 6％ 0.24

[0066] Table 1

[0067] Table 1 shows an example of a network connection over a certain time period. The first connection has a weight D = 3, a proportion P = 6%, and an information content h(x) = 0.24. Using the aforementioned formula for calculating information entropy, we can calculate D(X) = 49 and the information entropy baseline H(X)_Base = 2.954. The calculation process is as follows:

[0068] D(X) = 3 + 5 + 8 + 8 + 8 + 8 + 3 + 3 + 3 = 49

[0069] H(X)_Base=-0.06*Log(0.06)*4-0.1*Log(0.1)*1-0.16*Log(0.16)*4

[0070] = 0.06*4*4 + 0.1*3.3 + 0.16*2.6*4

[0071] =0.24*4 + 0.33 + 0.416*4

[0072] =0.96 + 0.33 + 1.664

[0073] =2.954

[0074] After the baseline entropy calculation for this network connection is completed, the same monitoring method is used to analyze network session information, and the real-time entropy of this network connection is calculated periodically. To avoid fluctuations caused by short connections, a monitoring period is set (e.g., greater than 1 minute), and all connections in this period are cached. Then, the actual network connection entropy (i.e., real-time entropy) is calculated according to the following algorithm:

[0075] The total weight D(X) of the logical topology of the network and the information entropy baseline H(X)_Base remain unchanged.

[0076] If a network connection disappears, the amount of information associated with that network connection is subtracted.

[0077] If a new connection is added, that connection is added to the set. When calculating the information content corresponding to that connection, D(X) i ) = 10, that is, D(X) i Assign the maximum weight.

[0078] Examples are given below:

[0079] Please refer to the table data in Table 1 above.

[0080] If the first connection disappears, the information entropy decreases by 0.24. The real-time information entropy is calculated as follows:

[0081] H(X) = H(X)_Base - 0.24

[0082] =2.954 - 0.24

[0083] =2.714

[0084] If the third connection disappears, the information entropy decreases by 0.416. The real-time information entropy is calculated as follows:

[0085] H(X) = H(X)_Base - 0.416

[0086] =2.954-0.416

[0087] =2.538

[0088] As can be seen, the more important the connection, the greater the fluctuation in information entropy caused by the change.

[0089] If a new connection is added, the real-time information entropy is calculated (where D(X) = 49):

[0090] H(X)=H(X)_Base-(-10 / D(X)*log2(10 / D(X)))

[0091] =2.954 + 0.2 * 2.32

[0092] =3.418

[0093] This indicates that the increase in connections led to an increase in information entropy of 0.46.

[0094] Deviation is the absolute value of the difference between real-time information entropy and the information entropy baseline.

[0095] Finally, the information entropy baseline is used to determine if network traffic is abnormal. Based on empirical data, a threshold is set. If the absolute value of the deviation between the real-time information entropy and the information entropy baseline is greater than the threshold, it indicates that the network connection is abnormal and an alert is required. Referring to the calculation results in Table 1 above, if the network connection information entropy decreases significantly, it indicates that many network connections have disappeared, and the business system may have experienced a downtime event; if the information entropy increases significantly, it indicates that many new connections have been added, and scanning or attack events may have occurred in the network.

[0096] Thresholds are generally expressed as a percentage of deviation, i.e. the fluctuation range of the deviation. In the example above, if the threshold T = 10%, the first connection disappears, and the corresponding deviation is 0.24 / 2.954 = 8%, which does not require an alarm; the third connection disappears, and the corresponding deviation is 0.416 / 2.954 = 14%, which exceeds the threshold and requires an alarm.

[0097] The above thresholds can be adjusted according to the actual situation. After running for a period of time, the alarms generated by the system are manually confirmed. If there are many false alarms, it means that the parameter needs to be increased. If there are missed alarms, it means that the parameter needs to be decreased.

[0098] If the system center deploys business systems or the original system is modified or upgraded, it may cause changes in the actual connection and connection baseline. Based on the actual business situation, it can be determined whether to re-collect the connection characteristic baseline and recalculate and modify the information entropy baseline. That is, based on the current actual network connection characteristics, the information entropy is recalculated to form a new information entropy baseline.

[0099] This invention also provides a network anomaly detection system. See [link / reference] Figure 2 This system uses the aforementioned network anomaly detection method based on information entropy, including a connection feature collection module, an information entropy baseline calculation module, a real-time data acquisition module, a real-time information entropy calculation module, a comparison module, and a result output module. The connection feature collection module is responsible for collecting and analyzing network session connection data, statistically analyzing the network's connection characteristics, and establishing a connection feature baseline. The information entropy baseline calculation module is responsible for calculating the information entropy baseline from the connection feature baseline. The real-time data acquisition module is responsible for collecting real-time network session connection data. The real-time information entropy calculation module is responsible for calculating the real-time information entropy from the real-time network session connection data. The comparison module is responsible for calculating the corresponding deviation value based on the information entropy baseline and the real-time information entropy, and determining whether the network is operating normally based on this deviation value. The result output module is responsible for outputting the network's operating status, especially issuing alarm information when anomalies are encountered.

[0100] The present invention also provides an electronic device including the network anomaly detection system described above. This electronic device can be used to detect anomalies in specific networks, such as network anomalies in nuclear power systems.

[0101] As can be seen from the above, the information entropy used in the network anomaly detection method of the present invention is calculated from the network's connection characteristics. The steps of the anomaly detection method include: collecting and analyzing the network's session connection data, statistically analyzing the network's connection characteristics, and establishing a connection characteristic baseline; calculating the network's information entropy baseline based on the connection characteristics; detecting the information entropy of real-time data, calculating the deviation, and determining whether the network is abnormal. Please refer to [link to relevant documentation]. Figure 1 .

[0102] As an example, this invention is applied to anomaly detection in nuclear power networks. In the nuclear power field, network connection anomaly detection is a common technical problem faced by nuclear power control networks. In these networks, fixed services generally only allow fixed network connections and communications; otherwise, it may be considered an abnormal connection, including unauthorized external connections, unauthorized internal connections, and other anomalies. The most commonly used algorithm for network anomaly detection is to establish various traffic baselines, then set tolerance or threshold ranges, and determine whether the service is abnormal by checking whether the actual service data meets the baseline range requirements.

[0103] In nuclear power plant control system networks, network traffic flow is relatively stable. Under normal conditions, the source and destination of communication, and even the protocol ports, are fixed. To more effectively detect anomalies, this invention, based on raw statistical data, performs probability analysis and information entropy calculation at a finer granularity to obtain the information entropy baseline of network connections. This allows for more accurate identification of network connection change characteristics and effective detection of various abnormal connection situations.

[0104] In summary, this invention provides a network anomaly detection method based on information entropy. Based on network connection data and considering the importance of the services carried by each network connection, a weight is assigned to each connection. Through data collection over a period of time, an information entropy baseline for the normal state is calculated. Then, based on this baseline, network connection anomalies are detected and judged. This invention establishes an information entropy baseline by combining network connection data of the entire control network with service importance, providing a quantitative indicator to measure network connection stability and detect anomalies. Furthermore, the calculation method is simple, consumes minimal CPU resources, and is easy to implement in engineering. Therefore, this invention effectively overcomes the various shortcomings of existing technologies and has high industrial application value.

[0105] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A network anomaly detection method based on information entropy applied to nuclear power networks, characterized in that, include: Collect and analyze the session connection data of the network; Statistically analyze the connectivity characteristics of the network and establish a connectivity characteristic baseline; The information entropy baseline of the network based on the connection feature baseline is calculated; Collect real-time data and calculate the real-time information entropy and the deviation between the real-time information entropy and the information entropy baseline; Determine if the network is abnormal; The information entropy is calculated from the connection characteristics of the network, and the formula for the information entropy is: , where P(X i ) for network connection X i The proportion in the entire set of network connections; Assign a security weight to each of the network connections, denoted as D(X). i ), and restrict 1≤D(X) i )≤10; The total weight of the logical topology of the entire network is labeled as: The P(X) i ) = D(X i ) / D(X); The calculation rules for the real-time information entropy include: The total weight and the information entropy baseline of the logical topology of the entire network remain unchanged; If the first network connection disappears, the amount of information corresponding to the first network connection is subtracted; If a new second network connection is added, then the second network connection is added to the entire set of network connections. When calculating the amount of information corresponding to the second network connection, the security weight is assigned a maximum value.

2. The network anomaly detection method based on information entropy according to claim 1, characterized in that, In the step of collecting and analyzing the session connection data of the network, the session connection data includes: source Internet Protocol (IP) address, destination IP address, destination port, and communication protocol.

3. The network anomaly detection method based on information entropy according to claim 1, characterized in that, In the step of statistically analyzing the network's connection characteristics and establishing a connection characteristic baseline, the connection characteristics include security weights and the proportion of a network connection in the entire network connection set.

4. The network anomaly detection method based on information entropy according to claim 1, characterized in that, Each of the network connections X i It contains four elements: source IP address, destination IP address, destination port, and communication protocol.

5. The network anomaly detection method based on information entropy according to claim 1, characterized in that, In the step of collecting real-time data, calculating real-time information entropy, and the deviation between the real-time information entropy and the information entropy baseline, a preset length period is selected, and all connection data of the period is cached to avoid fluctuations caused by short connections.

6. The network anomaly detection method based on information entropy according to claim 5, characterized in that, The preset length is greater than 1 minute.

7. The network anomaly detection method based on information entropy according to claim 1, characterized in that, The deviation is the absolute value of the difference between the real-time information entropy and the information entropy baseline.

8. The network anomaly detection method based on information entropy according to claim 7, characterized in that, When the deviation exceeds the threshold, the network is determined to be abnormal.

9. A network anomaly detection system applied to nuclear power plant networks, characterized in that, The network anomaly detection method based on information entropy according to any one of claims 1 to 8 includes a connection feature collection module, an information entropy baseline calculation module, a real-time data acquisition module, a real-time information entropy calculation module, a comparison module, and a result output module. The connection feature collection module is used to collect and analyze the network's session connection data, statistically analyze the network's connection features, and establish a connection feature baseline. The information entropy baseline calculation module is used to calculate the information entropy baseline from the connection feature baseline; The real-time data acquisition module is used to acquire the real-time network session connection data; The real-time information entropy calculation module is used to calculate the real-time information entropy from the real-time network session connection data. The comparison module calculates the corresponding deviation value based on the information entropy baseline and the real-time information entropy, and determines whether the network is working properly based on the deviation value; The result output module is used to output the working status of the network.

10. An electronic device, characterized in that, Including the network anomaly detection system as described in claim 9.

Images