Automatic generation method, device and storage medium for security rules of intrusion detection system

Abstract

The present application discloses a method, device and storage medium for automatically generating security rules of an intrusion detection system. The method obtains network sample data flow, performs data preprocessing on the network sample data flow, obtains quintuple parsing information, obtains decision tree rules and decision tree interpretation reports based on the quintuple parsing information through the combination of a convolutional neural network model and a decision tree method, determines intrusion detection rules based on the decision tree interpretation report and the decision tree rules, and integrates the intrusion detection rules into the intrusion detection system security rule database. The present application uses a method combining a deep learning model and a decision tree to automatically generate interpretable security rules, thereby helping users judge the correctness and reliability of security rules, select reasonable and reliable security rules, reduce the false negative rate of the intrusion detection system, and improve the accuracy, efficiency and versatility of intrusion detection. The present application is widely used in the field of information security technology of industrial control systems.

Description

Technical Field

[0001] The present application relates to the field of information security technology for industrial control systems, and in particular to a method, device and storage medium for automatically generating security rules for an intrusion detection system. Background Art

[0002] At present, information security is receiving more and more attention, the market for intrusion detection systems is developing rapidly, and the detection requirements for intrusion detection systems are becoming higher and higher.

[0003] In the prior art, fuzzy rule generation methods and genetic algorithms are mainly used to generate security rules for intrusion detection systems. However, the fuzzy rule generation method has poor accuracy because fuzzy rules are a method of mapping input space to output space. However, sometimes such a mapping relationship cannot be found or the mapping is too complex, which leads to poor quality of generated rules and ultimately poor defense effect. In addition, the generation of rules lacks a basis because fuzzy rule generation has a black box nature, which makes the rule generation process unexplainable.

[0004] However, using genetic algorithms can only create simple rules to monitor network traffic. It is a simple single connection mode and cannot associate and filter connection sets. Summary of the invention

[0005] In order to solve at least one of the technical problems existing in the above-mentioned related technologies, the embodiments of the present application provide a method, device and storage medium for automatically generating security rules of an intrusion detection system, aiming to improve the accuracy, efficiency and versatility of intrusion detection.

[0006] A first aspect of an embodiment of the present application provides a method for automatically generating security rules for an intrusion detection system, the method comprising:

[0007] Get network sample data traffic;

[0008] Performing data preprocessing operations on the network sample data flow to obtain quintuple parsing information;

[0009] Using a convolutional neural network model to perform feature extraction on the quintuple parsing information to obtain quintuple category label information;

[0010] Using the five-tuple parsed information as training data and the five-tuple category label information as training targets, constructing a decision tree, and generating a prediction result of the five-tuple parsed information to be predicted through the decision tree;

[0011] Determining a decision tree rule according to a decision tree prediction path corresponding to the prediction result;

[0012] Generate a decision tree explanation report based on the five-tuple category label information and the prediction result;

[0013] According to the decision tree rules and the decision tree explanation report, intrusion detection rules are determined, and the intrusion detection rules are integrated into the intrusion detection system security rule database.

[0014] In some embodiments, the method further comprises:

[0015] According to the decision tree explanation report, the judgment condition of the decision tree is adjusted; the judgment condition is used to judge the rationality of feature selection in the decision tree prediction process.

[0016] In some embodiments, the step of performing data preprocessing on the network sample data flow to obtain quintuple parsing information specifically includes:

[0017] Performing a data packet capture operation on the network sample data traffic to obtain multiple data packets;

[0018] For the data packet, the data packet header information is parsed to obtain the five-tuple parsing information; the data packet header information includes the source IP address, the destination IP address, the source port number, the destination port number and the protocol type.

[0019] In some embodiments, the convolutional neural network model includes a convolutional layer, a pooling layer, and a fully connected layer. The step of using the convolutional neural network model to extract features from the quintuple parsing information to obtain quintuple category label information specifically includes:

[0020] Inputting the five-tuple parsed information into the convolution layer to perform a convolution operation to obtain first feature information of the five-tuple parsed information;

[0021] Inputting the first local feature information into the pooling layer for downsampling and dimensionality reduction operations to obtain second feature information;

[0022] The second feature information is input into the fully connected layer, and the output of the second feature information is mapped to the corresponding type label to obtain the five-tuple category label information.

[0023] In some embodiments, the step of using the quintuple parsing information as training data and the quintuple category label information as training targets, constructing a decision tree, and generating a prediction result of the quintuple parsing information to be predicted through the decision tree specifically includes:

[0024] Taking the element feature values ​​in the five-tuple parsing information as non-leaf nodes and the five-tuple category label information as leaf nodes, and constructing the decision tree by using the CART algorithm;

[0025] The parsed information of the five-tuple to be predicted is input into the decision tree, and a recursive downward operation is performed from the root node to obtain the prediction result.

[0026] In some embodiments, the step of determining the intrusion detection rule according to the decision tree rule and the decision tree explanation report, and integrating the intrusion detection rule into the intrusion detection system security rule database specifically includes:

[0027] Determining the decision tree rules to be integrated according to the decision tree explanation report and the decision tree rules;

[0028] According to the matching mode and operation of the intrusion detection system, the decision tree rules to be integrated are converted into the intrusion detection rules.

[0029] In some embodiments, the step of inputting the five-tuple parsing information to be predicted into the decision tree, performing a recursive downward operation from a root node, and obtaining the prediction result specifically includes:

[0030] According to the element feature values ​​of the five-tuple parsed information to be predicted and the judgment conditions of the decision tree, recursively select branches downward from the root node until reaching the prediction leaf node, and determine the prediction category label information; the prediction category label information is the five-tuple category label information corresponding to the prediction leaf node;

[0031] The prediction result is determined according to the prediction category label information.

[0032] In some embodiments, the decision tree explanation report is used to explain and analyze the feature extraction and selection process for obtaining the five-tuple category label information.

[0033] A second aspect of an embodiment of the present application provides a device for automatically generating security rules for an intrusion detection system, the device comprising:

[0034] The first module is used to obtain network sample data flow;

[0035] The second module is used to perform data preprocessing operations on the network sample data flow to obtain quintuple parsing information;

[0036] The third module is used to extract features from the five-tuple parsing information using a convolutional neural network model to obtain five-tuple category label information;

[0037] The fourth module is used to construct a decision tree using the five-tuple parsing information as training data and the five-tuple category label information as training targets, and generate a prediction result of the five-tuple parsing information to be predicted through the decision tree;

[0038] A fifth module is used to determine a decision tree rule according to a decision tree prediction path corresponding to the prediction result;

[0039] A sixth module is used to generate a decision tree explanation report according to the five-tuple category label information and the prediction result;

[0040] The seventh module is used to determine the intrusion detection rules according to the decision tree rules and the decision tree explanation report, and integrate the intrusion detection rules into the intrusion detection system security rule database.

[0041] A third aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the method for automatically generating security rules for an intrusion detection system as described in the first aspect above.

[0042] The present application provides a method, device and storage medium for automatically generating security rules for an intrusion detection system, which uses a convolutional neural network model to extract features from the five-tuple parsing information after preprocessing of network sample data flow, obtains five-tuple category label information, generates prediction results of the five-tuple parsing information to be predicted through a decision tree model, determines decision tree rules, determines intrusion detection rules based on decision tree rules, and integrates the intrusion detection rules into the intrusion detection system security rule database. The present application uses a method combining a deep learning model and a decision tree to automatically generate interpretable security rules, thereby helping users judge the correctness and reliability of security rules, select reasonable and reliable security rules, reduce the false negative rate of the intrusion detection system, and improve the accuracy, efficiency and versatility of intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a flow chart of a method for automatically generating security rules of an intrusion detection system provided in an embodiment of the present application;

[0044] Figure 2 It is a schematic diagram of the prediction process of generating decision tree rules through a decision tree in an embodiment of the present application;

[0045] Figure 3 It is a structural diagram of a device for automatically generating security rules for an intrusion detection system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0049] Reference Figure 1 , Figure 1 This is an optional flowchart of a method for automatically generating security rules of an intrusion detection system provided in an embodiment of the present application. The method includes but is not limited to steps S101 to S107:

[0050] Step S101, obtaining network sample data flow;

[0051] Step S102, performing data preprocessing operations on the network sample data flow to obtain quintuple parsing information;

[0052] Step S103, using a convolutional neural network model to perform feature extraction on the quintuple parsing information to obtain quintuple category label information;

[0053] Step S104, using the five-tuple parsed information as training data and the five-tuple category label information as training targets, constructing a decision tree, and generating a prediction result of the five-tuple parsed information to be predicted through the decision tree;

[0054] Step S105, determining a decision tree rule according to the decision tree prediction path corresponding to the prediction result;

[0055] Step S106, generating a decision tree explanation report according to the five-tuple category label information and the prediction results;

[0056] Step S107, determining intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrating the intrusion detection rules into the intrusion detection system security rule database.

[0057] In step S101 of some embodiments, by deploying detection points in the intrusion detection system, monitoring network data traffic, and performing traffic capture and storage operations, the network sample data traffic is obtained. Specifically, in combination with the needs and actual conditions, the detection points are deployed through the intrusion detection system, and the intrusion detection equipment based on network data traffic is deployed at the Internet exit of the data center. In addition, it can also be deployed in the third-party external access area, office network and data center exit and other attack paths that attackers may choose. In order to prevent the failure of the detection capability of a single device from causing the threat to be missed, a heterogeneous deployment method is used, and the deployed detection points are used to capture and save the network data traffic to obtain the network sample data traffic. In addition, the normal network sample data traffic can be appropriately mutated to construct a wider range of data, so that the generalization performance of the model trained with the network sample data traffic is better.

[0058] In step S102 of some embodiments, a data preprocessing operation is performed on the network sample data flow, specifically, a data packet capture operation is performed on the network sample data flow to obtain multiple data packets, and the data packet header information is parsed for the data packets to obtain five-tuple parsing information. The data packet header information includes the source IP address, the destination IP address, the source port number, the destination port number and the protocol type, which can usually be found in the IP header, TCP / UDP header or ICMP header of the data packet, and then the parsed source IP address, destination IP address, source port number, destination port number and protocol type are combined into a five-tuple (5-tuple) to form the above five-tuple parsing information.

[0059] In some embodiments, the five-tuple parsed information of the network sample data flow is obtained after data preprocessing, and a convolutional neural network is selected for feature extraction. In order to solve the long-term dependency problem of the recurrent neural network, a long short-term memory network can be used, which can effectively integrate and filter the information in chronological order.

[0060] In some embodiments, the convolutional neural network model includes a convolutional layer, a pooling layer, and a fully connected layer, and step S103 may include but is not limited to steps S201 to S203:

[0061] Step S201, inputting the quintuple parsing information into a convolution layer for convolution operation to obtain first feature information of the quintuple parsing information;

[0062] Step S202, inputting the first local feature information into a pooling layer for downsampling and dimensionality reduction operations to obtain second feature information;

[0063] Step S203: input the second feature information into the fully connected layer, output the second feature information and map it to the corresponding type label to obtain the five-tuple category label information.

[0064] In steps S201 to S203 of some embodiments, the five-tuple parsing information is used to train a deep learning model, and the deep learning model adopts a convolutional neural network model. Exemplarily, the five-tuple parsing information is input into the convolution layer, and 64 filters of size 3x3 are used to perform convolution operations on the five-tuple parsing information, extract local features in the five-tuple parsing information, and obtain the first feature information of the five-tuple parsing information. The number and size of the filters can be adjusted according to the data set and the task. The output of the convolution layer is downsampled and reduced in dimension using a 2x2 maximum pooling operation to reduce the amount of calculation and the risk of overfitting of the model. The convolution layer and the pooling layer operation can be repeated twice between the convolution layer and the pooling layer, and each convolution layer uses 128 filters of size 3x3 to further extract features in the five-tuple and obtain the second feature information. A fully connected layer with 256 neurons is used to connect the output of the pooling layer to the fully connected layer to map the abstract features in the five-tuple parsing information to the category label to obtain the five-tuple category label information. To prevent overfitting, a Dropout layer is added after the fully connected layer to randomly set the outputs of some neurons to 0. The softmax function is then used to map the output of the fully connected layer to the category label to obtain the probability distribution of each category.

[0065] In step S104 of some embodiments, the principle of this step is to use the CART algorithm to build a decision tree, each node corresponds to a feature, and the sample is divided into two subsets by comparing the value of the feature and the threshold. If the purity of the node reaches a certain threshold, that is, all subsets belong to the same category, or the maximum depth limit is reached, the node is turned into a leaf node, corresponding to a category label. In this embodiment, the element feature values ​​in the five-tuple parsing information are used as non-leaf nodes, and the five-tuple category label information is used as a leaf node. The decision tree is constructed by the CART algorithm. Optionally, the element feature values ​​in multiple five-tuple parsing information are used as non-leaf nodes, and each category label in multiple five-tuple category label information is used as a leaf node, and then a decision tree is constructed, and the five-tuple parsing information is predicted using the decision tree.

[0066] The decision tree is used to predict the quintuple parsing information. Specifically, the quintuple parsing information to be predicted is input into the decision tree. According to the element characteristic values ​​of the quintuple parsing information to be predicted and the judgment conditions of the decision tree, a recursive downward operation is performed from the root node, and branches are continuously selected downward until the leaf node in the decision tree is reached. The category label corresponding to the leaf node is the prediction result of the quintuple parsing information to be predicted.

[0067] In step S105 of some embodiments, according to the prediction paths corresponding to the multiple prediction results, the prediction path is any complete path from the root node to the leaf node, each prediction path is associated with a category label, and the prediction paths and their corresponding category labels are sorted. Each prediction path represents a decision tree rule, so that multiple prediction paths can be converted to obtain multiple decision tree rules, and the decision tree rules are merged into a set of rules.

[0068] In step S106 of some embodiments, the training of the decision tree and the convolutional neural network model is adjusted so that for the same data input, the prediction results obtained by the decision tree and the convolutional neural network model are consistent with the results obtained by deep learning (five-tuple category label information). Finally, a decision tree interpretation report is generated based on the five-tuple category label information and the prediction results. The decision tree interpretation report is used to explain and analyze the process of feature selection of the five-tuple parsing information through the convolutional neural network model. Based on the decision tree interpretation report, better features can be selected in different application scenarios to judge the rationality of the decision tree rules.

[0069] In step S107 of some embodiments, the rationality of the decision tree rules is judged according to the decision tree interpretation report, and the reasonable decision tree rules (decision tree rules to be integrated) are determined. According to the matching mode and operation of the intrusion detection system, the decision tree rules to be integrated are converted into intrusion detection rules (Snort rules) that meet the use of the intrusion detection system. Specifically, each leaf node in the decision tree represents a specific event or behavior, and the decision tree rules corresponding to the leaf nodes cover all possible network traffic data related to the leaf nodes. The decision tree rules are converted into Snort rules. Snort rules are stored in the form of a multi-dimensional linked list, and the search process adopts recursive query. Snort rules are composed of several fields, including protocols, source and destination IP addresses, source and destination ports, and rule options. Independent Snort rules are processed and added to the rule linked list. The events or behaviors represented by the leaf nodes corresponding to the rules are specified in the rule options of the Snort rules. Pattern matching is performed after parsing the rule options. Optionally, the matching mode can be one or more rule options. These rule options specify the characteristics of the data packets to be matched by the rules, and the operations specify the actions to be performed when the rules are matched, such as logging or discarding data packets.

[0070] Reference Figure 2 , Figure 2 This is a schematic diagram of the prediction process of generating decision tree rules through a decision tree in an embodiment of the present application, wherein each node represents a feature (e.g., source IP address, destination IP address, protocol type, source port, etc.), and each edge represents the value range of a feature. The purpose of this decision tree is to detect malicious traffic based on IP addresses and port numbers. Figure 2 The prediction path in the decision tree can be converted into the following three decision tree rules:

[0071] Rule 1: If the source IP address is 192.168.1.1, the destination IP address is 10.0.0.1, and the destination port is 80, then this is malicious traffic.

[0072] Rule 2: If the source IP address is 192.168.1.2, the destination IP address is 10.0.0.1, and the destination port is not 80, then this is malicious traffic.

[0073] Rule 3: If the source IP address is not 192.168.1.1 or 192.168.1.2, then this is normal traffic.

[0074] Each decision tree rule is then converted into the following SNORT rule:

[0075] Snort rule 1: alert tcp 192.168.1.1any->10.0.0.1 80(msg:"Malicious traffic";sid:10001;).

[0076] Snort rule 2: alert tcp 192.168.1.2any->10.0.0.1!80(msg:"Malicious traffic";sid:10002;).

[0077] Snort rule 3: alert tcp! $HOME_NET any->$HOME_NET any(msg:"normal traffic"; sid:10003;).

[0078] In some embodiments, the method for automatically generating security rules of the intrusion detection system further includes step S301:

[0079] Step S301, adjusting the judgment conditions of the decision tree according to the decision tree explanation report.

[0080] In step S301 of some embodiments, according to the decision tree interpretation report, analysis is performed in combination with data-related protocols, formats and other relevant knowledge, and the judgment conditions of the decision tree are set and continuously adjusted to help generate more reasonable decision tree rules. The judgment conditions of the decision tree can determine the rationality of feature selection in the decision tree prediction process and the reliability of feature selection in the deep learning process.

[0081] Reference Figure 3 , Figure 3 An automatic generation device for security rules of an intrusion detection system provided in an embodiment of the present application includes:

[0082] The first module is used to obtain network sample data flow;

[0083] The second module is used to perform data preprocessing operations on the network sample data flow to obtain five-tuple parsing information;

[0084] The third module is used to extract features from the five-tuple parsing information using a convolutional neural network model to obtain five-tuple category label information;

[0085] The fourth module is used to use the five-tuple parsing information as training data and the five-tuple category label information as training targets, construct a decision tree, and generate a prediction result of the five-tuple parsing information to be predicted through the decision tree;

[0086] The fifth module is used to determine the decision tree rules according to the decision tree prediction path corresponding to the prediction result;

[0087] The sixth module is used to generate a decision tree explanation report based on the five-tuple category label information and prediction results;

[0088] The seventh module is used to determine the intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrate the intrusion detection rules into the intrusion detection system security rule database.

[0089] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the method for automatically generating security rules of the intrusion detection system is implemented.

[0090] The embodiment of the present application provides a method, device and storage medium for automatically generating security rules for an intrusion detection system, which uses a convolutional neural network model to perform feature extraction on the five-tuple parsing information after preprocessing of network sample data flow, obtains five-tuple category label information, generates prediction results of the five-tuple parsing information to be predicted through a decision tree model, determines decision tree rules, determines intrusion detection rules based on decision tree rules, and integrates the intrusion detection rules into the intrusion detection system security rule database. The present application uses a method combining a deep learning model and a decision tree to automatically generate interpretable security rules, thereby helping users judge the correctness and reliability of security rules, select reasonable and reliable security rules, reduce the false negative rate of the intrusion detection system, and improve the accuracy, efficiency and versatility of intrusion detection.

[0091] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0092] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0093] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0094] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0095] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for automatically generating security rules for an intrusion detection system, characterized in that: include: Get network sample data traffic; Performing data preprocessing operations on the network sample data flow to obtain quintuple parsing information; Using a convolutional neural network model to perform feature extraction on the quintuple parsing information to obtain quintuple category label information; Using the five-tuple parsed information as training data and the five-tuple category label information as training targets, constructing a decision tree, and generating a prediction result of the five-tuple parsed information to be predicted through the decision tree; Determining a decision tree rule according to a decision tree prediction path corresponding to the prediction result; Generate a decision tree explanation report based on the five-tuple category label information and the prediction result; the decision tree explanation report is used to explain and analyze the feature extraction and selection process of obtaining the five-tuple category label information; Determine intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrate the intrusion detection rules into the intrusion detection system security rule database; The step of using the five-tuple parsed information as training data and the five-tuple category label information as training targets, constructing a decision tree, and generating a prediction result of the five-tuple parsed information to be predicted through the decision tree specifically includes: Taking the element feature values ​​in the five-tuple parsing information as non-leaf nodes and the five-tuple category label information as leaf nodes, and constructing the decision tree by using the CART algorithm; Inputting the parsed information of the five-tuple to be predicted into the decision tree, performing recursive downward operation from the root node to obtain the prediction result; The step of determining the intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrating the intrusion detection rules into the intrusion detection system security rule database specifically includes: Determining the decision tree rules to be integrated according to the decision tree explanation report and the decision tree rules; According to the matching mode and operation of the intrusion detection system, the decision tree rules to be integrated are converted into the intrusion detection rules; The method further comprises: According to the decision tree explanation report, adjusting the judgment condition of the decision tree; the judgment condition is used to judge the rationality of feature selection in the decision tree prediction process; The step of inputting the five-tuple parsing information to be predicted into the decision tree, performing recursive downward operation from the root node, and obtaining the prediction result specifically includes: According to the element feature values ​​of the five-tuple parsed information to be predicted and the judgment conditions of the decision tree, recursively select branches downward from the root node until reaching the prediction leaf node, and determine the prediction category label information; the prediction category label information is the five-tuple category label information corresponding to the prediction leaf node; The prediction result is determined according to the prediction category label information.

2. The method for automatically generating security rules for an intrusion detection system according to claim 1, characterized in that: The step of performing data preprocessing on the network sample data flow to obtain quintuple parsing information specifically includes: Performing a data packet capture operation on the network sample data traffic to obtain multiple data packets; For the data packet, the data packet header information is parsed to obtain the five-tuple parsing information; the data packet header information includes the source IP address, the destination IP address, the source port number, the destination port number and the protocol type.

3. The method for automatically generating security rules for an intrusion detection system according to claim 1, characterized in that: The convolutional neural network model includes a convolutional layer, a pooling layer, and a fully connected layer. The step of using the convolutional neural network model to extract features from the quintuple parsing information to obtain quintuple category label information specifically includes: Inputting the five-tuple parsed information into the convolution layer to perform a convolution operation to obtain first feature information of the five-tuple parsed information; Inputting the first feature information into the pooling layer for downsampling and dimensionality reduction operations to obtain second feature information; The second feature information is input into the fully connected layer, and the output of the second feature information is mapped to the corresponding type label to obtain the five-tuple category label information.

4. An automatic generation device for security rules of an intrusion detection system, characterized in that: include: The first module is used to obtain network sample data flow; The second module is used to perform data preprocessing operations on the network sample data flow to obtain quintuple parsing information; The third module is used to extract features from the five-tuple parsing information using a convolutional neural network model to obtain five-tuple category label information; The fourth module is used to use the five-tuple parsing information as training data and the five-tuple category label information as training targets, construct a decision tree, and generate a prediction result of the five-tuple parsing information to be predicted through the decision tree; the step of using the five-tuple parsing information as training data and the five-tuple category label information as training targets, constructing a decision tree, and generating a prediction result of the five-tuple parsing information to be predicted through the decision tree specifically includes: Taking the element feature values ​​in the five-tuple parsing information as non-leaf nodes and the five-tuple category label information as leaf nodes, and constructing the decision tree by using the CART algorithm; Inputting the parsed information of the five-tuple to be predicted into the decision tree, performing recursive downward operation from the root node to obtain the prediction result; The step of inputting the five-tuple parsing information to be predicted into the decision tree, performing recursive downward operation from the root node, and obtaining the prediction result specifically includes: According to the element feature values ​​of the five-tuple parsed information to be predicted and the judgment conditions of the decision tree, recursively select branches downward from the root node until reaching the prediction leaf node, and determine the prediction category label information; the prediction category label information is the five-tuple category label information corresponding to the prediction leaf node; Determining the prediction result according to the prediction category label information; A fifth module is used to determine a decision tree rule according to a decision tree prediction path corresponding to the prediction result; The sixth module is used to generate a decision tree explanation report according to the five-tuple category label information and the prediction result; the decision tree explanation report is used to explain and analyze the feature extraction and selection process of obtaining the five-tuple category label information; The seventh module is used to determine the intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrate the intrusion detection rules into the intrusion detection system security rule database; the step of determining the intrusion detection rules according to the decision tree rules and the decision tree interpretation report, and integrating the intrusion detection rules into the intrusion detection system security rule database specifically includes: Determining the decision tree rules to be integrated according to the decision tree explanation report and the decision tree rules; According to the matching mode and operation of the intrusion detection system, the decision tree rules to be integrated are converted into the intrusion detection rules; The system further comprises: According to the decision tree explanation report, the judgment condition of the decision tree is adjusted; the judgment condition is used to judge the rationality of feature selection in the decision tree prediction process.

5. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for automatically generating security rules of an intrusion detection system according to any one of claims 1 to 3 is implemented.

Images