A network attack monitoring system based on open source tools

Abstract

The invention discloses a network attack monitoring system based on an open source tool; the system comprises network communication, the network communication is used to realize the transmission of flow data information to a computer, the computer comprises a firewall, the data information received by the computer enters a flow acquisition module after passing through the firewall, the flow acquisition module is electrically connected with a disassembler, the disassembler is provided with a convolution dimension reduction, the convolution dimension reduction is connected with an open source detection tool, and the open source detection tool is connected with a protection model; the flow acquisition module of the invention performs deduplication operation, normalization operation, compression and decoding processing, so as to facilitate the subsequent calculation processing of the data information, obtain the programming language of the data information through the disassembler, reduce the processing difficulty through the convolution dimension reduction, facilitate the open source detection tool to analyze and process the data information, and the protection model improves the safety protection efficiency of the computer.

Description

Technical Field

[0001] The present invention belongs to the technical field of network attack monitoring, and in particular relates to a network attack monitoring system based on open source tools. Background Art

[0002] In recent years, big data, artificial intelligence, cloud computing and 5G technologies have developed rapidly, and the application of the Internet has become more extensive and convenient. The application of information technology has gradually penetrated into all walks of life, bringing convenience and intelligent services to our work and life, but also bringing about gradually intensified network security issues. Traditional intrusion detection technology has problems such as high false alarm rate, poor adaptability and low detection rate. However, various network attack monitoring on the market still have various problems.

[0003] For example, the network attack monitoring system based on multi-source information analysis disclosed by the authorization announcement number CN112511387A has achieved comprehensive perception of network threats: based on traffic analysis, it accurately identifies network security risks, builds sensitive network threat perception capabilities, and displays a full range of network security situations. Timely stop loss and rapid response: through network attack security analysis, it provides network security threat assessment reports to assist network security managers in taking corresponding disposal measures in a timely manner to prevent the situation from continuing to develop, but it does not solve the problems of existing network attack monitoring that cannot effectively protect, cannot achieve fast calculation processing, and the analysis of tool data information is relatively slow. For this reason, we propose a network attack monitoring system based on open source tools. Summary of the invention

[0004] The purpose of the present invention is to provide a network attack monitoring system based on open source tools to solve the problems raised in the above background technology.

[0005] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a network attack monitoring system based on open source tools, including network communication, the network communication is used to realize the transmission of flow data information to the computer, effectively realize the transmission of data information, the computer includes a firewall, the firewall is used to realize the security protection of the data information transmitted by the network communication, effectively realize the construction of the first protection network, and facilitate the security protection of the computer;

[0006] The data information received by the computer enters the traffic collection module after passing through the firewall. The traffic collection module is used to intercept the transmitted data information, collect data on the traffic according to the sampling collection rules, and then perform deduplication, normalization and compression processing operations on the collected traffic data, as well as decode the data information to facilitate subsequent calculation and processing of the data information. The traffic collection module is electrically connected with a disassembler, which is used to decompile and restore the executable file into assembly language or other languages. The disassembler is provided with convolution dimensionality reduction, which is used to reduce the dimensionality of the assembly language restored by the disassembler, so as to facilitate detection and calculation processing. The convolution dimensionality reduction is used to reduce the number of parameters and reduce the difficulty of training. Through network sparse connection and weight sharing, the calculation formula of the convolution neural network is as follows:

[0007] For a graph G = (V, E), V is the set of nodes, E is the set of edges, and for each node i, there is a feature x i , we can use the matrix X N*D Indicates, where N represents the number of nodes, D represents the number of features of each node, which is also the dimension of the feature vector;

[0008] The nonlinear function of the convolutional neural network: H l+1 =f(H l ,A), and H 0 =X is the input of the first layer, X∈R N *D , N is the number of nodes in the graph, D is the dimension of each node feature vector, A is the adjacency matrix, l is the weight parameter matrix of the layer, and the difference between different models lies in the different implementations of the function f;

[0009] The convolutional dimensionality reduction is connected to an open source detection tool, which is used to detect data information and effectively distinguish whether the data information is aggressive. The open source detection tool has intrusion detection, vulnerability scanning, asset management, security monitoring, log analysis, and traffic analysis functions, which can effectively protect the system. The open source detection tool is connected to a protection model, which receives the data information of the open source detection tool for training, so as to facilitate direct comparison of data information and improve detection efficiency.

[0010] Preferably, the open source detection tool is connected to a prediction result, and the prediction result is used to classify the data information after detection and processing by the open source detection tool, so as to facilitate classification and processing of offensive and non-offensive data information.

[0011] Preferably, the prediction result is connected with isolation protection, and the isolation protection is used to mark and isolate the aggressive data information in the prediction result to prevent the aggressive data from invading the computer. The firewall is connected with channel communication, and the channel communication is connected to the prediction result to allow non-aggressive data information to be input into the computer to realize data communication.

[0012] Preferably, the protection model is connected to the isolation protection, and the protection model is used to collect the characteristics of the aggressive data information analyzed by the open source detection tool, and then conduct a large amount of training on the protection model through AI intelligent algorithm, so as to facilitate the subsequent direct judgment and processing of the same type of aggressive data information.

[0013] Preferably, the neural network of the AI ​​intelligent algorithm is determined by inputting neuron information and the corresponding weight matrix W, where W T X t , X is a vector, W is a weight matrix, and W is used to transform X into another vector;

[0014] The information transmitted from the hidden layer neurons at the previous moment to the neurons at the current moment has a value of S t-1 And the corresponding weight matrix U is determined, U T S t-1 , S t-1 is a vector, U is a weight matrix, and S is transformed by U t-1 Convert to another vector;

[0015] Mainly the neuron h at the current moment t , integrate the inputs of the above two parts, activate and generate the output of the hidden layer neurons at the current moment, and the integration process is vector addition: W T X t +U T S t-1 ;

[0016] Assuming the activation function is f, the value of the neuron at the current moment is generated after activation: S t =f(W T X t +U T S t-1 );

[0017] Information transfer mainly transfers the value of the hidden layer neuron at the current moment to the output neuron at the current moment:

[0018] O t =g(V T S t );

[0019] The forward formula is as follows:

[0020] S t =f(W T X t +U T S t-1 ),O t =g(V T S t )=g(V T f(W T X t +U T S t-1 ));

[0021] In the entire neural network, there are three weight matrices in total. The first matrix is ​​W. The dimension of the matrix is ​​(N, K), where N represents the vector dimension of the hidden layer neuron values ​​and K represents the dimension of the vector of the input neural unit. The second weight matrix is ​​V, and the dimension of the matrix is ​​(L, N), where P represents the vector dimension of the neurons in the output layer. The third is the weight matrix U, and the dimension of the matrix is ​​(N, N).

[0022] Preferably, the open source detection tool mainly includes the following functions:

[0023] Snort: Intrusion detection system to provide computer security protection;

[0024] Rrdtool: system monitoring, realizing security monitoring of the computer's own system;

[0025] Nmap: Network scanning and sniffing cells, to achieve security scanning and detection of computer communication processes;

[0026] Nessus: System vulnerability scanning and analysis software, used to scan and process computer system vulnerabilities, analyze software systems, and repair system vulnerabilities;

[0027] Ntop: Network traffic monitoring, used to monitor the computer's communication traffic;

[0028] Nagios: monitors system and network applications, and is used to implement security detection of system and network program running processes;

[0029] Pads: A passive network discovery tool used to detect abnormal software that invades the network;

[0030] Tcptrack: TCP connection sniffer, used to implement security detection of TCP connections;

[0031] ArpWatch: monitors ARP communications to implement security detection of the communication process.

[0032] Preferably, the protection model detects network attacks through a hybrid analysis method-machine learning. The key to the malware detection method based on machine learning lies in the selection of features and algorithms. Both static features and dynamic features can be used for machine learning, but irrelevant features and noise features will affect the accuracy of the model.

[0033] Preferably, the hybrid analysis method-machine learning uses an optimized K-means algorithm to quickly and effectively identify malware, a malicious code detection method based on PSO-K-means and an improved random forest algorithm;

[0034] The K-means algorithm iteratively searches for a partitioning scheme for K clusters so that the loss function corresponding to the clustering result is minimized, where the loss function is defined as the sum of squared errors of each sample from the center point of the cluster to which it belongs:

[0035]

[0036] Among them, x i represents the i-th sample, c i is x i The cluster to which it belongs, u ci represents the center point corresponding to the cluster, and M is the total number of samples.

[0037] Preferably, the protection model quickly estimates the similarity of two sets by local sensitive hashing. For set A and set B, the Jaccard index is the ratio between the cardinality of their intersection and the cardinality of their union; the similarity between A and B is as follows:

[0038]

[0039] Define h(x) as the hash function that maps x to an integer, and hmin(S) is the minimum hash value of all elements in the set S after being mapped to an integer by h(x). Select k hash functions:

[0040] h1(x),h1(x),…,h k-1 (x),h k (x),

[0041] Then use the hash function to perform hmin(S) operations on sets S1 and S2 respectively:

[0042]

[0043]

[0044] We get the sets MINS1 and MINS2, and the similarity between sets S1 and S2 is:

[0045]

[0046] Finally, the results are used to evaluate the similarity between samples and converted into feature images.

[0047] Preferably, the traffic collection module directly transmits the secondary attack data to the protection model, and the protection model quickly estimates the similarity of two sets through the local sensitive hash, and then compares the feature images to determine the type or attack intensity of the secondary attack data;

[0048] The feature image is composed of discrete pixels, green pixels are used to describe the same pixel information, and red pixels are used to describe different information. The more green pixels there are in the image, the higher the similarity.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] When the present invention is in use, the traffic collection module acquires the transmitted data information, and after acquiring the data information, performs deduplication, normalization and compression processing operations on the collected traffic data, and decodes the data information, so as to facilitate subsequent calculation and processing of the data information, and then acquires the programming language of the data information through disassembly, and then reduces the processing difficulty through convolution dimensionality reduction, so as to facilitate the open source detection tool to quickly analyze and process the data information, facilitate the protection processing of the data information, and the open source detection tool can realize the calculation and processing of a variety of data information, with diverse functionality, and in the processing process of the open source detection tool, the data information is input into the protection model for training the model, so as to facilitate direct detection and processing of the next attack, thereby improving the security protection efficiency of the computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] See also Figure 1The present invention provides a technical solution, a network attack monitoring system based on open source tools, including network communication, the network communication is used to realize the transmission of flow data information to the computer, effectively realize the transmission of data information, the computer includes a firewall, the firewall is used to realize the security protection of the data information transmitted by the network communication, effectively realize the construction of the first protection network, and facilitate the security protection of the computer;

[0054] The data information received by the computer enters the traffic collection module after passing through the firewall. The traffic collection module is used to intercept the transmitted data information, collect data on the traffic according to the sampling collection rules, and then perform deduplication, normalization and compression processing operations on the collected traffic data, as well as decode the data information to facilitate subsequent calculation and processing of the data information. The traffic collection module is electrically connected with a disassembler, which is used to decompile and restore the executable file into assembly language or other languages. The disassembler is provided with convolution dimensionality reduction, which is used to reduce the dimensionality of the assembly language restored by the disassembler, so as to facilitate detection and calculation processing. The convolution dimensionality reduction is used to reduce the number of parameters and reduce the difficulty of training. Through network sparse connection and weight sharing, the calculation formula of the convolution neural network is as follows:

[0055] For a graph G = (V, E), V is the set of nodes, E is the set of edges, and for each node i, there is a feature x i , we can use the matrix X N*D Indicates, where N represents the number of nodes, D represents the number of features of each node, which is also the dimension of the feature vector;

[0056] The nonlinear function of the convolutional neural network: H l+1 =f(H l ,A), and H 0 =X is the input of the first layer, X∈R N *D , N is the number of nodes in the graph, D is the dimension of each node feature vector, A is the adjacency matrix, l is the weight parameter matrix of the layer, and the difference between different models lies in the different implementations of the function f;

[0057] The convolutional dimensionality reduction is connected to an open source detection tool, which is used to detect data information and effectively distinguish whether the data information is aggressive. The open source detection tool has intrusion detection, vulnerability scanning, asset management, security monitoring, log analysis, and traffic analysis functions, which can effectively protect the system. The open source detection tool is connected to a protection model, which receives the data information of the open source detection tool for training, so as to facilitate direct comparison of data information and improve detection efficiency.

[0058] In order to classify the structures detected by the open source detection tool and facilitate security protection, in this embodiment, preferably, the open source detection tool is connected with a prediction result, and the prediction result is used to classify the data information after the open source detection tool has detected and processed, so as to facilitate the classification and processing of aggressive and non-aggressive data information.

[0059] In order to achieve effective communication connection, isolate attack data information and improve security, in this embodiment, preferably, the prediction result is connected with isolation protection, and the isolation protection is used to mark and isolate the aggressive data information in the prediction result to prevent the aggressive data from invading the computer. The firewall is connected with channel communication, and the channel communication is connected to the prediction result to allow non-aggressive data information to be input into the computer to achieve data communication.

[0060] In order to train the characteristics of attack data information and achieve the purpose of quickly detecting the next attack data information, in this embodiment, preferably, the protection model is connected to the isolation protection, and the protection model is used to collect the characteristics of the aggressive data information analyzed by the open source detection tool, and then the protection model is trained in large quantities through AI intelligent algorithms, so as to facilitate subsequent direct judgment and processing of the same type of offensive data information.

[0061] In order to effectively achieve the role of training the protection model and improve the security protection efficiency of the system, in this embodiment, preferably, the neural network input neuron information and the corresponding weight matrix W of the AI ​​intelligent algorithm are determined, W T X t , X is a vector, W is a weight matrix, and W is used to transform X into another vector;

[0062] The information transmitted from the hidden layer neurons at the previous moment to the neurons at the current moment has a value of S t-1 And the corresponding weight matrix U is determined, U T S t-1 , S t-1 is a vector, U is a weight matrix, and S is transformed by U t-1 Convert to another vector;

[0063] Mainly the neuron h at the current moment t , integrate the inputs of the above two parts, activate and generate the output of the hidden layer neurons at the current moment, and the integration process is vector addition: W T X t +U TS t-1 ;

[0064] Assuming the activation function is f, the value of the neuron at the current moment is generated after activation: S t =f(W T X t +U T S t-1 );

[0065] Information transfer mainly transfers the value of the hidden layer neuron at the current moment to the output neuron at the current moment:

[0066] O t =g(V T S t );

[0067] The forward formula is as follows:

[0068] S t =f(W T X t +U T S t-1 ),O t =g(V T S t )=g(V T f(W T X t +U T S t-1 ));

[0069] In the entire neural network, there are three weight matrices in total. The first matrix is ​​W. The dimension of the matrix is ​​(N, K), where N represents the vector dimension of the hidden layer neuron values ​​and K represents the dimension of the vector of the input neural unit. The second weight matrix is ​​V, and the dimension of the matrix is ​​(L, N), where P represents the vector dimension of the neurons in the output layer. The third is the weight matrix U, and the dimension of the matrix is ​​(N, N).

[0070] In order to detect different data of the computer or attack data in different usage processes, in this embodiment, preferably, the open source detection tool mainly includes the following functions:

[0071] Snort: Intrusion detection system to provide computer security protection;

[0072] Rrdtool: system monitoring, realizing security monitoring of the computer's own system;

[0073] Nmap: Network scanning and sniffing cells, to achieve security scanning and detection of computer communication processes;

[0074] Nessus: System vulnerability scanning and analysis software, used to scan and process computer system vulnerabilities, analyze software systems, and repair system vulnerabilities;

[0075] Ntop: Network traffic monitoring, used to monitor the computer's communication traffic;

[0076] Nagios: monitors system and network applications, and is used to implement security detection of system and network program running processes;

[0077] Pads: A passive network discovery tool used to detect abnormal software that invades the network;

[0078] Tcptrack: TCP connection sniffer, used to implement security detection of TCP connections;

[0079] ArpWatch: monitors ARP communications to implement security detection of the communication process.

[0080] In order to effectively detect attack data information and improve the efficiency and accuracy of detection, in this embodiment, preferably, the protection model detects network attacks through a hybrid analysis method-machine learning. The key to the malware detection method based on machine learning lies in the selection of features and algorithms. Both static features and dynamic features can be used for machine learning, but irrelevant features and noise features will affect the accuracy of the model.

[0081] By quickly performing calculation processing, the protection model can be quickly learned, and the functionality of the protection model is improved. In this embodiment, preferably, the hybrid analysis method-machine learning uses an optimized K-means algorithm to quickly and effectively identify malware, a malicious code detection method based on PSO-K-means and an improved random forest algorithm;

[0082] The K-means algorithm iteratively searches for a partitioning scheme for K clusters so that the loss function corresponding to the clustering result is minimized, where the loss function is defined as the sum of squared errors of each sample from the center point of the cluster to which it belongs:

[0083]

[0084] Among them, x i represents the i-th sample, c i is x i The cluster to which it belongs, u ci represents the center point corresponding to the cluster, and M is the total number of samples.

[0085] In order to compare the collected attack data information with the stored label data information and determine the type of the collected tool data information, in this embodiment, preferably, the protection model quickly estimates the similarity of two sets through local sensitive hashing. For set A and set B, the Jaccard index is the ratio between the cardinality of their intersection and the cardinality of their union; the similarity between A and B is as follows:

[0086]

[0087] Define h(x) as the hash function that maps x to an integer, and hmin(S) is the minimum hash value of all elements in the set S after being mapped to an integer by h(x). Select k hash functions:

[0088] h1(x),h1(x),…,h k-1 (x),h k (x),

[0089] Then use the hash function to perform hmin(S) operations on sets S1 and S2 respectively:

[0090]

[0091]

[0092] We get the sets MINS1 and MINS2, and the similarity between sets S1 and S2 is:

[0093]

[0094] Finally, the results are used to evaluate the similarity between samples and converted into feature images.

[0095] In order to realize rapid detection and processing, in this embodiment, preferably, the traffic collection module directly transmits the secondary attack data to the protection model, and the protection model quickly estimates the similarity of the two sets through the local sensitive hash, and then compares the feature image to determine the type or attack intensity of the secondary attack data;

[0096] The feature image is composed of discrete pixels, green pixels are used to describe the same pixel information, and red pixels are used to describe different information. The more green pixels there are in the image, the higher the similarity.

[0097] The working principle and use process of the present invention are as follows: when the present invention is used, the flow data information is transmitted to the computer through network communication, and the data information is effectively transmitted. The firewall is used to realize the security protection of the data information transmitted by the network communication, and effectively realizes the construction of the first protection network, which is convenient for realizing the security protection of the computer; after passing through the firewall, the data information enters the flow collection module, and the flow collection module is used to intercept the transmitted data information, and is used to collect data on the flow according to the sampling collection rules, and then deduplicates, normalizes and compresses the collected flow data, and realizes decoding processing on the data information, which is convenient for realizing subsequent calculation processing on the data information, and the disassembly is used to realize the decompilation and restoration of the execution file into assembly language or other languages. The disassembly is provided with convolution dimension reduction, and the convolution dimension reduction is used to realize the dimensionality reduction processing of the assembly language after the disassembly and restoration, which is convenient for detection and calculation processing. The convolution dimension reduction is used to reduce the number of parameters and reduce the difficulty of training. Through the network sparse connection and weight sharing, the data information is then detected by the open source detection tool to effectively distinguish whether the data information is aggressive. The open source detection The detection tool has the functions of intrusion detection, vulnerability scanning, asset management, security monitoring, log analysis, and traffic analysis, which can effectively realize the security protection of the system. The protection model receives the data information of the open source detection tool for training, which is convenient for directly comparing the data information and improving the efficiency of detection. The protection model is trained in large quantities through the AI ​​intelligent algorithm, and then autonomously learns through the K-means algorithm, and then compares the data information through local sensitive hashing, identifies the attack data through the feature image, and detects it through the open source detection tool when the attack data invades for the first time, and then processes the data information through the prediction results, including isolation protection for marking and isolating the offensive data information in the prediction results to prevent the offensive data from invading the computer. The firewall is connected to channel communication, and the channel communication is connected to the prediction results to allow the non-aggressive data information to be input into the computer to realize data communication. For the second attack, it is directly transmitted to the protection model through the traffic collection module for detection and calculation, or the traffic collection module is transmitted to the protection model through disassembly for detection, which effectively improves the efficiency of detection.

[0098] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network attack monitoring system based on open source tools, including network communications, characterized in that: The network communication is used to realize the transmission of flow data information to the computer, effectively realizing the transmission of data information. The computer includes a firewall, and the firewall is used to realize the security protection of the data information transmitted by the network communication, effectively realizing the construction of the first protection network, and facilitating the security protection of the computer; The data information received by the computer enters the traffic collection module after passing through the firewall. The traffic collection module is used to intercept the transmitted data information, collect data on the traffic according to the sampling collection rules, and then perform deduplication, normalization and compression processing operations on the collected traffic data, as well as decode the data information to facilitate subsequent calculation and processing of the data information. The traffic collection module is electrically connected with a disassembler, which is used to decompile and restore the executable file into assembly language or other languages. The disassembler is provided with convolution dimensionality reduction, which is used to reduce the dimensionality of the assembly language restored by the disassembler, so as to facilitate detection and calculation processing. The convolution dimensionality reduction is used to reduce the number of parameters and reduce the difficulty of training. Through network sparse connection and weight sharing, the calculation formula of the convolution neural network is as follows: For a graph G = (V, E), V is the set of nodes, E is the set of edges, and for each node i, there is a feature x i , we can use the matrix X N*D Indicates, where N represents the number of nodes, D represents the number of features of each node, which is also the dimension of the feature vector; The nonlinear function of the convolutional neural network: H l+1 =f(H l ,A), and H 0 =X is the input of the first layer, X∈R N*D , N is the number of nodes in the graph, D is the dimension of each node feature vector, A is the adjacency matrix, l is the weight parameter matrix of the layer, and the difference between different models lies in the different implementations of the function f; The convolutional dimensionality reduction is connected to an open source detection tool, which is used to detect data information and effectively distinguish whether the data information is aggressive. The open source detection tool has intrusion detection, vulnerability scanning, asset management, security monitoring, log analysis, and traffic analysis functions, which can effectively protect the system. The open source detection tool is connected to a protection model, which receives the data information of the open source detection tool for training, so as to facilitate direct comparison of data information and improve detection efficiency.

2. The network attack monitoring system based on open source tools according to claim 1, characterized in that: The open source detection tool is connected to a prediction result, and the prediction result is used to classify the data information after detection and processing by the open source detection tool, so as to facilitate classification and processing of offensive and non-offensive data information.

3. The network attack monitoring system based on open source tools according to claim 2, characterized in that: The prediction result is connected to isolation protection, and the isolation protection is used to mark and isolate the offensive data information in the prediction result to prevent the offensive data from invading the computer. The firewall is connected to channel communication, and the channel communication is connected to the prediction result to allow non-aggressive data information to be input into the computer to achieve data communication.

4. The network attack monitoring system based on open source tools according to claim 3 is characterized by: The protection model is connected to the isolation protection. The protection model is used to collect the characteristics of the offensive data information analyzed by the open source detection tool, and then conduct a large amount of training on the protection model through the AI ​​intelligent algorithm, so as to facilitate the subsequent direct judgment and processing of the same type of offensive data information.

5. The network attack monitoring system based on open source tools according to claim 4 is characterized by: The neural network of the AI ​​intelligent algorithm is determined by the input neuron information and the corresponding weight matrix W, W T X t , X is a vector, W is a weight matrix, and W is used to transform X into another vector; The information transmitted from the hidden layer neurons at the previous moment to the neurons at the current moment has a value of S t-1 And the corresponding weight matrix U is determined, U T S t-1 , S t-1 is a vector, U is a weight matrix, and S is transformed by U t-1 Convert to another vector; Mainly the neuron h at the current moment t , integrate the inputs of the above two parts, activate and generate the output of the hidden layer neurons at the current moment, and the integration process is vector addition: W T X t +U T S t-1 ; Assuming the activation function is f, the value of the neuron at the current moment is generated after activation: S t =f(W T X t +U T S t-1 ); Information transfer mainly transfers the value of the hidden layer neuron at the current moment to the output neuron at the current moment: O t =g(V T S t ); The forward formula is as follows: S t =f(W T X t +U T S t-1 ),O t =g(V T S t )=g(V T f(W T X t +U T S t-1 )); In the entire neural network, there are three weight matrices. The first matrix is ​​W. The dimension of the matrix is ​​(N, K), where N represents the vector dimension of the hidden layer neuron values ​​and K represents the dimension of the vector of the input neural unit. The second weight matrix is ​​V. The dimension of the matrix is ​​(L, N), where P represents the vector dimension of the neurons in the output layer. The third is the weight matrix U, which has a dimension of (N, N).

6. The network attack monitoring system based on open source tools according to claim 1, characterized in that: The open source detection tool mainly includes the following functions: Snort: Intrusion detection system to provide computer security protection; Rrdtool: system monitoring, realizing security monitoring of the computer's own system; Nmap: Network scanning and sniffing cells, to achieve security scanning and detection of computer communication processes; Nessus: System vulnerability scanning and analysis software, used to scan and process computer system vulnerabilities, analyze software systems, and repair system vulnerabilities; Ntop: Network traffic monitoring, used to monitor the computer's communication traffic; Nagios: monitors system and network applications, and is used to implement security detection of system and network program running processes; Pads: A passive network discovery tool used to detect abnormal software that invades the network; Tcptrack: TCP connection sniffer, used to implement security detection of TCP connections; ArpWatch: monitors ARP communications to implement security detection of the communication process.

7. The network attack monitoring system based on open source tools according to claim 1, characterized in that: The protection model detects network attacks through a hybrid analysis method-machine learning. The key to the malware detection method based on machine learning lies in the selection of features and algorithms. Both static features and dynamic features can be used for machine learning, but irrelevant features and noise features will affect the accuracy of the model.

8. The network attack monitoring system based on open source tools according to claim 7 is characterized by: The hybrid analysis method-machine learning uses an optimized K-means algorithm to quickly and effectively identify malware, a malicious code detection method based on PSO-K-means and an improved random forest algorithm; The K-means algorithm iteratively searches for a partitioning scheme for K clusters so that the loss function corresponding to the clustering result is minimized, where the loss function is defined as the sum of squared errors of each sample from the center point of the cluster to which it belongs: Among them, x i represents the i-th sample, c i is x i The cluster to which it belongs, u ci represents the center point corresponding to the cluster, and M is the total number of samples.

9. The network attack monitoring system based on open source tools according to claim 1, characterized in that: The protection model quickly estimates the similarity of two sets through local sensitive hashing. For set A and set B, the Jaccard index is the ratio between the cardinality of their intersection and the cardinality of their union. The similarity between A and B is as follows: Define h(x) as the hash function that maps x to an integer, and hmin(S) is the minimum hash value of all elements in the set S after being mapped to an integer by h(x). Select k hash functions: h1(x),h1(x),…,h k-1 (x),h k (x), Then use the hash function to perform hmin(S) operations on sets S1 and S2 respectively: We get the sets MINS1 and MINS2, and the similarity between sets S1 and S2 is: Finally, the results are used to evaluate the similarity between samples and converted into feature images.

10. The network attack monitoring system based on open source tools according to claim 9, characterized in that: The traffic collection module directly transmits the secondary attack data to the protection model, and the protection model quickly estimates the similarity of two sets through the local sensitive hash, and then compares the feature images to determine the type or attack intensity of the secondary attack data; The feature image is composed of discrete pixels, green pixels are used to describe the same pixel information, and red pixels are used to describe different information. The more green pixels there are in the image, the higher the similarity.

Images