Network attack prediction method, system, electronic device and storage medium

Abstract

The embodiment of the application provides a network attack prediction method, system, electronic equipment and storage medium, and belongs to the technical field of data processing. The method comprises the following steps: acquiring a network data graph and a corresponding historical feature mapping vector at each time point; performing vectorization processing on the network data graph to obtain a graph embedding vector, and obtaining a network RGB graph corresponding to each time point; performing feature mapping processing on the network RGB graph at the current moment to obtain a first feature mapping vector; performing optical flow graph conversion on the network RGB graph at each moment and at least one network RGB graph adjacent to each moment to obtain a network optical flow graph; performing feature mapping processing on the network optical flow graph to obtain a second feature mapping vector; constructing a prediction feature mapping vector according to the first feature mapping vector and the second feature mapping vector; and screening prediction attack data from historical attack data according to the prediction feature mapping vector and the historical feature mapping vector to obtain a network attack prediction result.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a network attack prediction method, system, electronic device, and storage medium. Background Technology

[0002] With the development of artificial intelligence technology, the massive amounts of information on the internet have been better connected and utilized. Knowledge graphs, as a representative of knowledge representation methods and related embedding technologies, have made knowledge computation, reasoning, and application possible. However, in the field of cybersecurity, the veracity of many facts changes over time and space. If these characteristics are not considered, invalid knowledge in knowledge graphs will increase. To address this issue, network data graph models can be used to add representations of spatiotemporal characteristics to general knowledge graphs to understand specific changes. However, because attackers, attack targets, and attack methods are constantly changing, network data graphs cannot accurately predict attacks in the next moment. Summary of the Invention

[0003] The main objective of this application is to propose a network attack prediction method, system, electronic device, and storage medium that can improve the accuracy of network attack prediction by predicting attacks in the next moment of the network data graph.

[0004] To achieve the above objectives, a first aspect of this application proposes a network attack prediction method, the method comprising: acquiring a network data graph at each time point and a historical feature mapping vector for each network data graph; wherein the network data graph is constructed from historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data; vectorizing the network data graph to obtain a graph embedding vector; converting the graph embedding vectors corresponding to each time point into an RGB graph to obtain a network RGB graph; acquiring the network RGB graph corresponding to the current time point and performing feature mapping processing on the network RGB graph to obtain a first feature mapping vector; converting the network RGB graph at each time point and a network RGB graph corresponding to the adjacent previous time point into an optical flow graph to obtain a network optical flow graph; performing feature mapping processing on the network optical flow graph to obtain a second feature mapping vector; constructing a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector; and filtering predicted attack data from the historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain a network attack prediction result.

[0005] According to some embodiments of this application, the network data graph includes: original triplet data; the vectorization processing of the network data graph to obtain a graph embedding vector includes: inputting the network data graph into a preset convolutional neural network; wherein, the convolutional neural network includes: a dimensionality reduction layer, a convolutional layer, and an activation function layer; performing dimensionality reduction processing on the original triplet data through the dimensionality reduction layer and a preset dimension to obtain candidate triplet data; extracting features from the candidate triplet data through the convolutional layer to obtain triplet feature information; and performing a nonlinear transformation on the triplet feature information through the activation function layer to obtain the graph embedding vector.

[0006] According to some embodiments of this application, after inputting the network data graph into a preset convolutional neural network, the method further includes: training the convolutional neural network, specifically including: inputting the graph embedding vector into a linear transformation evaluation model to perform linear transformation evaluation, obtaining linear transformation evaluation data; and training the convolutional neural network based on the linear transformation evaluation data.

[0007] According to some embodiments of this application, the step of inputting the spectral embedding vector into a linear transformation evaluation model for linear transformation evaluation to obtain linear transformation evaluation data includes: multiplying the spectral embedding vector by the filtering parameters of the linear transformation evaluation model, adding the product to a first bias to obtain a first spectral embedding vector; activating the first spectral embedding vector using an activation function, and then adding it to a second bias to obtain a second spectral embedding vector; multiplying the second spectral embedding vector by the linear operation coefficients of the linear transformation evaluation model to obtain linear transformation evaluation data.

[0008] According to some embodiments of this application, the step of converting the spectral embedding vectors corresponding to each time point into an RGB image to obtain a network RGB image includes: normalizing the spectral embedding vectors corresponding to each time point to obtain candidate embedding vectors; performing a product operation on the candidate embedding vectors according to a preset color intensity value to obtain a target embedding vector; and constructing the network RGB image according to the target embedding vector and a preset pixel color value.

[0009] According to some embodiments of this application, the normalization process of the graph embedding vectors corresponding to each time point to obtain candidate embedding vectors includes: obtaining multiple graph embedding vectors corresponding to each time point; wherein, the graph embedding vectors include: head entity vectors, relation vectors, and tail entity vectors; sorting the graph embedding vectors to obtain the maximum and minimum values ​​of multiple head entity vectors, multiple relation vectors, and multiple tail entity vectors; wherein, the maximum and minimum values ​​include a maximum value and a minimum value; obtaining a target vector; wherein, the first graph vector is the graph embedding vector that needs to be normalized; and subtracting the minimum value corresponding to the head entity vector from the head entity vector of the target vector. The following steps are performed: First, obtain the head entity reference value. Second, subtract the minimum value corresponding to the relation vector from the relation vector to obtain the relation reference value. Third, subtract the minimum value corresponding to the tail entity vector from the tail entity vector to obtain the relation reference value. Fourth, divide the head entity reference value by the difference between the maximum and minimum values ​​corresponding to the head entity vector to obtain the normalized head entity vector. Fifth, divide the relation vector reference value by the difference between the maximum and minimum values ​​corresponding to the relation vector to obtain the normalized relation vector. Sixth, divide the tail entity vector reference value by the difference between the maximum and minimum values ​​corresponding to the tail entity vector to obtain the normalized tail entity vector. Finally, obtain the candidate embedding vector based on the normalized head entity vector, the normalized relation vector, and the normalized tail entity vector.

[0010] According to some embodiments of this application, the step of converting the network RGB image at each time point and a network RGB image corresponding to the adjacent previous time point into an optical flow map to obtain a network optical flow map includes: acquiring the network RGB image at each time point and the adjacent network RGB image corresponding to the previous time point; performing a weighted average of the pixel values ​​in the network RGB image to obtain a first grayscale image; performing a weighted average of the pixel values ​​in the adjacent network RGB images to obtain a second grayscale image; performing optical flow calculation on the first grayscale image and the second grayscale image using the Falnebach algorithm to obtain a first optical flow feature vector and a second optical flow feature vector; combining the first optical flow feature vector and the second optical flow feature vector to form an initial optical flow map; and color encoding the initial optical flow map to obtain a network optical flow map.

[0011] According to some embodiments of this application, constructing a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector includes: selecting a first allocation ratio corresponding to the first feature mapping vector and a second allocation ratio corresponding to the second feature mapping vector; wherein the sum of the first allocation ratio and the second allocation ratio is 1; and adding the product of the first feature mapping vector and the first allocation ratio to the product of the second feature mapping vector and the second allocation ratio to obtain the predicted feature mapping vector.

[0012] According to some embodiments of this application, after obtaining the predicted feature mapping vector, the method further includes: analyzing the predicted feature mapping vector to obtain a prediction analysis result; adjusting the first allocation ratio and the second allocation ratio according to the prediction analysis result, and reconstructing the predicted feature mapping vectors corresponding to the first feature mapping vector and the second feature mapping vector.

[0013] According to some embodiments of this application, the step of filtering predicted attack data from the historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain network attack prediction results includes: calculating similarity based on the predicted feature mapping vector and the historical feature mapping vector to obtain vector similarity; obtaining the maximum value of the vector similarity to obtain maximum similarity; and using the historical attack data corresponding to the maximum similarity as the predicted attack data.

[0014] According to some embodiments of this application, calculating the similarity between the predicted feature mapping vector and the historical feature mapping vector to obtain vector similarity includes: multiplying the predicted feature mapping vector and the historical feature mapping vector to obtain a first product; taking the magnitude of the predicted feature mapping vector as a first vector magnitude; taking the magnitude of the historical feature mapping vector as a second vector magnitude; multiplying the first vector magnitude and the second vector magnitude to obtain a second product; and dividing the first product by the second product to obtain the vector similarity.

[0015] According to some embodiments of this application, the method further includes: obtaining the graph size information of the network data graph; setting the structure of the convolutional neural network according to the graph size information; wherein the convolutional neural network includes a first convolutional neural network and a second convolutional neural network; the first convolutional neural network and the second convolutional neural network have equal lengths; the first convolutional neural network is used to obtain the network RGB graph corresponding to the current time, and perform feature mapping processing on the network RGB graph to obtain a first feature mapping vector; the second convolutional neural network is used to perform feature mapping processing on the network optical flow graph to obtain a second feature mapping vector.

[0016] According to some embodiments of this application, the method further includes: acquiring network monitoring update data at each time step; updating the corresponding network data graph based on the network monitoring update data to obtain an updated data graph; acquiring update size information of the updated data graph; and updating the structure of the convolutional neural network at the corresponding time step based on the update size information.

[0017] To achieve the above objectives, a second aspect of this application proposes a network attack prediction system, comprising: a data acquisition module for acquiring a network data graph at each time point and a historical feature mapping vector for each network data graph; wherein the network data graph is constructed from historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data; a graph embedding vector acquisition module for vectorizing the network data graph to obtain a graph embedding vector; a network RGB graph acquisition module for converting the graph embedding vectors corresponding to each time point into an RGB graph to obtain a network RGB graph; and a first feature mapping vector acquisition module for acquiring the network RGB graph corresponding to the current time point. The system performs feature mapping processing on the network RGB image to obtain a first feature mapping vector; a network optical flow graph acquisition module is used to convert the network RGB image at each time point and the network RGB image corresponding to the adjacent previous time point into an optical flow graph to obtain a network optical flow graph; a second feature mapping vector acquisition module is used to perform feature mapping processing on the network optical flow graph to obtain a second feature mapping vector; a prediction feature mapping vector construction module is used to construct a prediction feature mapping vector based on the first feature mapping vector and the second feature mapping vector; and a network attack prediction result acquisition module is used to filter predicted attack data from the historical attack data based on the prediction feature mapping vector and the historical feature mapping vector to obtain a network attack prediction result.

[0018] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the network attack prediction method described in any one of the first aspects of this application.

[0019] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network attack prediction method described in any one of the first aspects of this application.

[0020] The network attack prediction method, system, electronic device, and storage medium proposed in this application can acquire the network data graph at the current moment and vectorize it to obtain a graph embedding vector. Then, based on the corresponding time point, all graph embedding vectors are converted into RGB graphs to obtain a network RGB graph. The latest time-based network RGB graph is then processed with feature mapping to obtain a first feature mapping vector. Furthermore, by converting the network RGB graph at each time point with the adjacent previous time point's network RGB graph into an optical flow graph, a network optical flow graph representing the changes is obtained, leading to a second feature mapping vector. This second feature mapping vector can characterize the changing trend of the network data graph. This application can combine the first and second feature mapping vectors to construct a prediction feature mapping vector. By analyzing the prediction feature mapping vector based on historical feature mapping vectors, predicted attack data for the next time point is selected, resulting in a network attack prediction result. This application can predict the changing trend of the network data graph, improving the accuracy of attack prediction for the next time point. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the network attack prediction system provided in the embodiments of this application;

[0022] Figure 2 This is a flowchart of the network attack prediction method provided in the embodiments of this application;

[0023] Figure 3-a This is a schematic diagram of the knowledge graph provided in an embodiment of this application;

[0024] Figure 3-b This is a schematic diagram of the MDATA map provided in the embodiments of this application;

[0025] Figure 4 yes Figure 2 A flowchart of step S102;

[0026] Figure 5 This is a schematic diagram of the graph embedding vector provided in an embodiment of this application;

[0027] Figure 6 This is a flowchart of a network attack prediction method provided in another embodiment of this application;

[0028] Figure 7 This is a flowchart of step S301;

[0029] Figure 8 yes Figure 2 A flowchart of step S103;

[0030] Figure 9 This is a flowchart of step S501;

[0031] Figure 10 yes Figure 2 A flowchart of step S105;

[0032] Figure 11 yes Figure 2 A flowchart of step S107

[0033] Figure 12 This is a flowchart of the process after obtaining the predicted feature mapping vector, as provided in the embodiments of this application;

[0034] Figure 13 yes Figure 2 A flowchart of step S108;

[0035] Figure 14 yes Figure 13 A flowchart of step S1001;

[0036] Figure 15 This is yet another flowchart of a network attack prediction method provided in another embodiment of this application;

[0037] Figure 16 This is another flowchart of a network attack prediction method provided in another embodiment of this application;

[0038] Figure 17 This is a schematic diagram of the functional modules of the network attack prediction system provided in the embodiments of this application;

[0039] Figure 18 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0041] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0043] Knowledge graphs are an important method for representing and embedding knowledge, enabling computation, reasoning, and application. However, in the field of cybersecurity, the veracity of many facts changes over time and space. If these characteristics are not considered, invalid information in the knowledge graph will gradually increase. To address this issue, related technologies utilize network data graph models (such as MDATA graphs) to add expressions of spatiotemporal characteristics to general knowledge graphs, allowing for a better understanding of specific changes. However, because attackers are constantly changing, and attack targets and methods are constantly evolving, network data graph models can only make predictions based on static network data graphs. This incompleteness leads to problems with prediction accuracy, reliability, and the completeness of the predicted data. Therefore, they cannot accurately predict attacks in the next moment.

[0044] Based on this, embodiments of this application provide a network attack prediction method, system, electronic device, and storage medium, which can predict the changing trend of a changing network data graph and improve the accuracy of attack prediction for the next moment in the network data graph.

[0045] The network attack prediction method, system, electronic device, and storage medium provided in this application are specifically described through the following embodiments. First, the network attack prediction system in this application is described.

[0046] Please refer to Figure 1 In some embodiments, the network attack prediction system includes a control module 101, a time data acquisition module 102, an image conversion module 103, a feature mapping vector acquisition module 104, and a data filtering module 105.

[0047] In some embodiments, the control module 101 can be the nerve center and command center of the system. The control module 101 can generate operation control signals based on instruction opcodes and timing signals to control instruction fetching and execution. For example, the control module 101 can control the time data acquisition module 102, the image conversion module 103, the feature mapping vector acquisition module 104, and the data filtering module 105 according to instructions, ultimately completing the attack prediction.

[0048] In some embodiments, the time data acquisition module 102 can acquire corresponding network data based on time points and convert the network data into a network data graph. In some embodiments, the time data acquisition module 102 can establish a timeline, with time points on the timeline arranged sequentially, and then acquire network data based on each time point. In some embodiments, the network data can be data containing attacks, data containing attack addresses, etc., and this application embodiment does not impose specific limitations on this. Exemplarily, the time data acquisition module 102 can transmit the acquired network data graph to the image conversion module 103 for processing.

[0049] In some embodiments, the image conversion module 103 can perform vectorization processing on the network data graph corresponding to each time point to obtain a graph embedding vector; the image conversion module 103 can also perform RGB graph conversion on the graph embedding vector to obtain a network RGB graph. For example, the image conversion module 103 can also perform optical flow graph conversion based on the network RGB graph at each time point and a network RGB graph at the adjacent previous time point to obtain a network optical flow graph.

[0050] In some embodiments, the feature mapping vector acquisition module 104 can perform feature mapping processing on the network RGB image to obtain a first feature mapping vector; the feature mapping vector acquisition module 104 can also perform feature mapping processing on the network optical flow image obtained by the image conversion module 103 to obtain a second feature mapping vector. In some embodiments, the feature mapping vector acquisition module 104 can construct a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector.

[0051] In some embodiments, the data filtering module 105 can filter predicted attack data from historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain network attack prediction results. Specific filtering methods may include calculating similarity, comparing data, etc.

[0052] The network attack prediction method in this application can be illustrated by the following embodiments.

[0053] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. For example, when obtaining user-stored data and user cached data access requests, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application need to obtain sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data for the normal operation of embodiments of this application obtained.

[0054] Figure 2 This is an optional flowchart of the network attack prediction method provided in the embodiments of this application. Figure 2 The method may include, but is not limited to, steps S101 to S108.

[0055] Step S101: Obtain the network data graph at each time point and the historical feature mapping vector of each network data graph; wherein, the network data graph is constructed from the historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data;

[0056] Step S102: Vectorize the network data graph to obtain the graph embedding vector;

[0057] Step S103: Convert the RGB image of the spectral embedding vectors corresponding to each time point to obtain the network RGB image;

[0058] Step S104: Obtain the network RGB image corresponding to the current time point, and perform feature mapping processing on the network RGB image to obtain the first feature mapping vector;

[0059] Step S105: Perform optical flow graph conversion on the network RGB graph at each time point and the network RGB graph corresponding to the adjacent previous time point to obtain the network optical flow graph.

[0060] Step S106: Perform feature mapping processing on the network optical flow graph to obtain the second feature mapping vector;

[0061] Step S107: Construct a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector;

[0062] Step S108: Based on the predicted feature mapping vector and the historical feature mapping vector, the predicted attack data is filtered from the historical attack data to obtain the network attack prediction result.

[0063] In some embodiments, the network data graph can be an MDATA graph (intelligent data graph), or it can be used for data graphs and social graphs, etc. This application primarily focuses on the MDATA graph, but the application scope of the network attack prediction method is not limited to MDATA graphs. It is understood that a timeline can be constructed, and corresponding network data can be obtained in chronological order. This network data can include alarm logs, detection data, and attack data, etc.

[0064] Reference Figure 3-a and Figure 3-b , Figure 3-a This is a diagram of a knowledge graph. Figure 3-b This is a schematic diagram of an MDATA graph. As can be seen from the diagram, a knowledge graph can only simply represent entities and the relationships between them, while an MDATA graph can not only represent the relationships between entities, but also the attributes of entities and the relationships between entities and attributes. Furthermore, MDATA graphs are dynamic and scalable; therefore, they can be used to predict and analyze attack changes in network data.

[0065] For example, a network data graph can be constructed based on network data. First, the network data is cleaned, including removing duplicate data, handling missing values, and correcting data formatting. Simultaneously, if the network data carries sensitive information, this sensitive information can be anonymized to ensure data security. Second, entity recognition and relationship extraction can be performed on the cleaned data to extract entities (attackers and victims, source and destination network addresses, attack methods, etc.) and the relationships between them. Furthermore, Natural Language Processing (NLP) techniques can be used to assist in the extraction of entities and relationships. Finally, by using entities as nodes and relationships as edges, a network data graph can be constructed and visualized.

[0066] In some embodiments, static knowledge composed of triples in the network data graph can be extracted at time points, namely, static knowledge composed of entities (including head entities and tail entities) and relations. This static knowledge is then embedded into a vector space through a convolutional neural network for vectorization processing to obtain a graph embedding vector. This graph embedding vector can then be used to improve the effectiveness of network attack prediction.

[0067] Under normal circumstances, each time point corresponds to one network data graph. In some specific cases, each time point may correspond to multiple network data graphs. This application takes one network data graph per time point as an example. In some embodiments, the graph embedding vectors corresponding to each time point can be converted to RGB to obtain a network RGB graph. In other words, all graph embedding vectors are converted to RGB to obtain a network RGB graph. It is understood that a network RGB graph is a vector graph with color features, which can be understood as an RGB graph or an RGB vector graph. Specifically, the graph embedding vectors can be normalized to map the values ​​of all head entity vectors, relation vectors, and tail entity vectors to the numerical range of [0,1]. Then, a scalar multiplication operation is performed on all vectors, i.e., multiplied by 255 (255 is the maximum color intensity of the network RGB graph). Thus, the head entity vectors, relation vectors, and tail entity vectors can all be converted to the numerical range specified by the network RGB graph. In some embodiments, the modulus of the triplet vectors contained in each graph embedding vector is used as the color of the pixel, and the pixels are arranged to obtain a network RGB graph of a fixed size.

[0068] In some embodiments, the convolutional neural network includes a first convolutional neural network (i.e., a static information flow convolutional neural network) and a second convolutional neural network (i.e., a spacetime flow convolutional neural network). It is understood that the first convolutional neural network can be used to vectorize the network data graph to obtain a graph embedding vector. After the graph embedding vector is converted into a network RGB graph, the network RGB graph corresponding to the current time step is selected and input into the first convolutional neural network for feature mapping processing to obtain a first feature mapping vector. In some embodiments, the network data graph can also be vectorized using a second convolutional neural network. In the embodiments of this application, the second convolutional neural network is mainly used to perform feature mapping processing on the network RGB graph at each time step and the network optical flow graph obtained by converting at least one adjacent network RGB graph at each time step to obtain a second feature mapping vector. It is understood that the latest time step, the latest time point, the current time step, and the current time point are all the same concept.

[0069] In some embodiments, the network RGB graph at the current time (i.e., the latest time) can be selected from the network RGB graphs at multiple time points for feature mapping processing to obtain a first feature mapping vector. It is understood that the obtained first feature mapping vector can be used for tasks such as network classification, clustering, and recognition, thereby enabling better analysis of the structure and behavior of the network data graph.

[0070] In some embodiments, a network optical flow graph can be obtained by converting the network RGB graph at each time point and the network RGB graph corresponding to the previous time point adjacent to each time point into an optical flow graph. For example, in some embodiments, during the process of converting the network RGB graph at each time point and the network RGB graph corresponding to the previous time point adjacent to each time point into a network optical flow graph, if the current time point is 12:15:01, according to a preset time interval of 1 second (which can be set according to actual conditions), an adjacent time point (i.e., the previous time point) is selected. If, according to the main time change, the adjacent time point is 12:15:00, then the network data graphs corresponding to 12:15:01 and 12:15:00 are selected for processing to obtain a network optical flow graph. For example, there are 5 time points arranged in chronological order, each time point corresponding to a network RGB graph, for a total of 5 network RGB graphs, numbered as network RGB graph 1, network RGB graph 2, network RGB graph 3, network RGB graph 4, and network RGB graph 5, respectively. The optical flow graph is transformed from the network RGB image at each time step to at least one adjacent network RGB image at that time step. Specifically, optical flow graphs of network RGB images 1 and 2, 2 and 3, 3 and 4, and 4 and 5 can be transformed to obtain four network optical flow graphs. It is understood that the network RGB image at the current time step can also be transformed to obtain a network optical flow graph from two or three adjacent network RGB images. For example, optical flow graphs of network RGB images 1, 2, and 3 can be transformed to obtain one network optical flow graph, and so on. This application does not impose specific limitations on this.

[0071] Understandably, network optical flow graphs, which are converted from two or more network RGB graphs, capture the motion patterns and directions between the network RGB graphs, thus enabling more accurate prediction of network attacks based on changes.

[0072] In some embodiments, the optical flow graph of the network can be input into a second convolutional neural network. Through the fully connected layers of the second convolutional neural network, each feature map in the optical flow graph is transformed into a specific output value, ultimately obtaining the second feature map information of the network data graph. That is, the second convolutional neural network extracts features from the optical flow graph to obtain the second feature map vector. It can be understood that the second feature information can transform the original optical flow graph into a more representative and discriminative feature vector, thereby extracting richer information.

[0073] In some embodiments, a predicted feature mapping vector can be constructed using a first feature vector and a second feature vector. Specifically, the predicted feature mapping vector can be constructed by weighting the first and second feature vectors according to a preset allocation ratio, or by directly adding the first and second feature vectors. It is understood that the predicted feature mapping vector can represent the predicted change vector for the next time step. It is understood that by constructing the predicted feature mapping vector, both the feature information and the change information of the latest time step can be obtained; therefore, the network attack prediction vector for the next time step can be obtained.

[0074] In some embodiments, similarity can be calculated between the predicted feature mapping vector and the historical feature mapping vector. The historical feature mapping vector with the highest similarity to the predicted feature mapping vector is selected, and the historical attack data corresponding to the historical feature mapping vector is selected as the predicted attack data. The predicted attack data is then used as the network attack prediction result. In some embodiments, a similarity threshold can be set, and historical feature mapping vectors with a similarity greater than the similarity threshold to the predicted feature mapping vector can be filtered. Then, a second filtering is performed on the selected historical feature mapping vectors to finally obtain the predicted attack data.

[0075] It is understood that the historical feature mapping vector is a vector formed by a large amount of historical attack data. By summarizing the historical attack data, historical attack data can be obtained. In some embodiments, historical attack data can be stored in a historical attack database or other databases, and this application embodiment does not impose specific limitations on this.

[0076] The network attack prediction method, system, electronic device, and storage medium proposed in this application can obtain a network data graph at the current moment and vectorize it to obtain a graph embedding vector. This process can be performed using a regular convolutional neural network, or using a first convolutional neural network or a second convolutional neural network. For example, all graph embedding vectors can be converted to RGB graphs based on the corresponding time points to obtain a network RGB graph, and feature mapping processing can be performed on the latest network RGB graph to obtain a first feature mapping vector. Furthermore, an optical flow graph representing the changes can be obtained by converting the network RGB graph at each time point and a network RGB graph at an adjacent time point. A second convolutional neural network can then perform feature mapping processing on the network optical flow graph to obtain a second feature mapping vector, which can represent the changing trend of the network data graph. This application can combine the first and second feature mapping vectors to construct prediction features, build a prediction feature mapping vector, and analyze the prediction feature mapping vector based on historical feature mapping vectors to filter out the predicted attack data for the next time point, thus obtaining the network attack prediction result. This application can predict the changing trends of network data graphs, thereby improving the accuracy of attack predictions for the next moment in network data graphs.

[0077] Please refer to Figure 4 In some embodiments, the network data graph includes raw triplet data, and step S102 includes, but is not limited to, steps S201 to S204:

[0078] Step S201: Input the network data graph into a preset convolutional neural network; wherein the convolutional neural network includes: a dimensionality reduction layer, a convolutional layer, and an activation function layer;

[0079] Step S202: Dimensionality reduction is performed on the original triplet data using a dimensionality reduction layer and a preset dimension to obtain candidate triplet data;

[0080] Step S203: Extract features from candidate triplet data using convolutional layers to obtain triplet feature information;

[0081] Step S204: The triplet feature information is nonlinearly transformed through the activation function layer to obtain the graph embedding vector.

[0082] In some embodiments, network data graphs can be used as input and passed to a pre-trained convolutional neural network for processing, wherein the convolutional neural network includes at least: a dimensionality reduction layer, a convolutional layer, and an activation function layer.

[0083] In some embodiments, the original triplet data can be dimensionality reduced by using a dimensionality reduction layer and a preset dimension to obtain candidate triplet data, thereby reducing the dimensionality of the features and improving computational efficiency.

[0084] It is understandable that feature extraction can be performed on candidate triplet data through convolutional layers to obtain triplet feature information, thereby identifying local features in the network data graph and extracting important information from the network data graph.

[0085] In some embodiments, the feature information of triples can be nonlinearly transformed by activation function layers to obtain the embedding vector of the network data graph, thereby improving the expressive power and robustness of the network data graph.

[0086] Reference Figure 5 For example, the network data graph can be input into a pre-trained convolutional neural network. Specifically, the triplet data of the network data graph can be used as the input to the convolutional neural network. Taking a 6-dimensional vector as an example, where the head entity vector, relation vector, and tail entity vector are all 6×1 initial vectors, if the preset dimension is 3×2, a dimensionality reduction layer can transform the 6×1 initial vector into a 3×2 reduced-dimensional vector, thereby obtaining candidate triplet data. It is understandable that by performing dimensionality reduction on the initial vector, the computational complexity can be greatly reduced, thus enabling efficient analysis of the network data graph and inference of relationships.

[0087] In some embodiments, feature extraction can be performed on the candidate triplet data using convolutional layers. For example, the extracted features can be 2×2 feature vectors. Further, the triplet feature information can be nonlinearly transformed using activation function layers (corresponding to the ReLU layer in the diagram), and then passed through fully connected layers to obtain a graph embedding vector, thereby extracting more feature information and better representing the relationship patterns between the triplet data. In some embodiments, normalization can also be performed using a Softmax layer to obtain candidate embedding vectors. Finally, the predicted attack data is selected using a triplet scoring function. In some embodiments, the triplet scoring function can be a cosine similarity function, Euclidean distance function, Manhattan distance function, and dimension-squared function, etc.

[0088] Please refer to Figure 6 In some embodiments, after inputting the network data graph into a preset convolutional neural network, the process further includes training the convolutional neural network. The training process includes, but is not limited to, steps S301 to S302:

[0089] Step S301: Input the map embedding vector into the linear transformation evaluation model to perform linear transformation evaluation and obtain linear transformation evaluation data;

[0090] Step S302: Train a convolutional neural network based on the linear transformation evaluation data.

[0091] In some embodiments, linear transformation evaluation data can be obtained by evaluating the graph embedding vector. Specifically, the graph embedding vector can be scored to obtain a scoring result. In some embodiments, the graph embedding vector can be multiplied by a weight matrix to obtain linear transformation evaluation data; this application does not impose specific limitations on this method.

[0092] In some embodiments, the model parameters of the convolutional neural network can be updated by backpropagation based on the scoring results to optimize the model parameters of the convolutional neural network and thereby improve the performance of the convolutional neural network.

[0093] Please refer to Figure 7 In some embodiments, step S301 includes, but is not limited to, steps S401 to S403:

[0094] Step S401: Multiply the spectral embedding vector by the filtering parameters of the linear transformation evaluation model, and add the product to the first bias to obtain the first spectral embedding vector;

[0095] Step S402: After activating the first graph embedding vector with an activation function, add it to the second bias to obtain the second graph embedding vector;

[0096] Step S403: Multiply the second graph embedding vector with the linear operation coefficients of the linear transformation evaluation model to obtain the linear transformation evaluation data.

[0097] In some embodiments, the graph embedding vectors can be scored using a linear transformation evaluation model to obtain the scoring results, i.e., the linear transformation evaluation data. For example, the scoring function of the linear transformation evaluation model is formulated as follows:

[0098] score1(h,r,t)=[concat(σ(ω[e h ;e r ;e t ]+b1))+b2]·f

[0099] Among them, e h Represents the head entity vector, e r Represents a relation vector, e t denoted as the tail entity vector, ω is a set of filters used for 3D convolution, σ is the activation function, b1 represents the first bias, b2 represents the second bias, concat represents the concatenation operator, and f is the linear operation coefficient in the fully connected layer.

[0100] Understandably, the first and second biases can be used to adjust the relationship between the filtering parameters of the graph embedding vector and the linear transformation evaluation model by introducing bias, thereby resulting in a better graph embedding vector after the graph embedding vector undergoes linear transformation and activation function.

[0101] Understandably, by multiplying the graph embedding vector with the filtering parameters of the linear transformation evaluation model, and by adjusting the first and second biases, a graph embedding vector after linear transformation and activation function processing is obtained. This vector is then multiplied with the linear operation coefficients of the linear transformation evaluation model to obtain linear transformation evaluation data. In other words, a graph embedding vector and evaluation data that better meet the requirements are obtained, which are then used to evaluate the convolutional neural network, obtain the evaluation value, and update the parameters of the convolutional neural network based on the evaluation value.

[0102] Please refer to Figure 8 In some embodiments, step S103 includes, but is not limited to, steps S501 to S503:

[0103] Step S501: Normalize the map embedding vectors corresponding to each time point to obtain candidate embedding vectors;

[0104] Step S502: Perform a product operation on the preset color intensity value and the candidate embedding vector to obtain the target embedding vector;

[0105] Step S503: Construct a network RGB graph based on the target embedding vector and preset pixel color values.

[0106] In some embodiments, the spectral embedding vectors corresponding to each time point can be converted into RGB images to obtain a network RGB image. Specifically, the spectral embedding vectors can be normalized to map the values ​​of all head entity vectors, relation vectors, and tail entity vectors to the numerical range of [0,1]. Then, a scalar multiplication operation is performed on all vectors, i.e., multiplied by 255 (255 is the maximum color intensity of the network RGB image). Thus, the head entity vectors, relation vectors, and tail entity vectors can all be converted to the numerical range specified by the network RGB image to obtain the target embedding vector.

[0107] In some embodiments, the magnitude of the triplet vectors contained in each target embedding vector is used as the pixel color, and the pixels are arranged to obtain a fixed-size network RGB image. That is, the magnitudes of the head entity vector, relation vector, and tail entity vector in the triplet vector are used as the pixel color. In some embodiments, the pixels can be arranged in a left-to-right and top-to-bottom order to obtain a network RGB image.

[0108] Understandably, by normalizing and multiplying the graph embedding vectors, they can be mapped to the numerical range specified by the network RGB graph, thus obtaining the target embedding vector. Furthermore, by using the magnitude of the triple vectors as the pixel color and arranging them in a specific way to generate the network RGB graph, the relationships and connections between entities in the graph can be visually displayed. It is understandable that the network RGB graph facilitates a better understanding and analysis of the information in the graph, contributing to further data processing and applications.

[0109] Please refer to Figure 9 In some embodiments, step S501 includes, but is not limited to, steps S601 to S606:

[0110] Step S601: Obtain multiple graph embedding vectors corresponding to each time point; wherein, the graph embedding vectors include: head entity vector, relation vector and tail entity vector;

[0111] Step S602: Sort the graph embedding vectors to obtain the maximum and minimum values ​​of multiple head entity vectors, multiple relation vectors, and multiple tail entity vectors; where the maximum and minimum values ​​include the maximum value and the minimum value.

[0112] Step S603: Obtain the target vector; wherein, the first spectral vector is the spectral embedding vector that needs to be normalized.

[0113] Step S604: Subtract the minimum value corresponding to the head entity vector from the head entity vector of the target vector to obtain the head entity reference value; subtract the minimum value corresponding to the relation vector from the relation vector to obtain the relation reference value; subtract the minimum value corresponding to the tail entity vector from the tail entity vector to obtain the relation reference value.

[0114] Step S605: Obtain the normalized head entity vector by dividing the head entity reference value by the difference between the maximum and minimum values ​​corresponding to the head entity vector; obtain the normalized relation vector by dividing the relation vector reference value by the difference between the maximum and minimum values ​​corresponding to the relation vector; obtain the normalized tail entity vector by dividing the tail entity vector reference value by the difference between the maximum and minimum values ​​corresponding to the tail entity vector.

[0115] Step S606: Based on the normalized head entity vector, the normalized relation vector, and the normalized tail entity vector, obtain the candidate embedding vector.

[0116] In some embodiments, the formula for calculating the normalized head entity vector is:

[0117] Among them, e h1 Represents a normalized head entity vector, e h The head entity vector representing the target vector, a hb represents the maximum value of the head entity among all graph embedding vectors. h This represents the minimum value of the head entity among all graph embedding vectors.

[0118] The formula for calculating the normalized relation vector is:

[0119] Among them, e r1 Represents the normalized relation vector, e r The relation vector representing the target vector, a r b represents the maximum value of the relation among all graph embedding vectors. r This represents the minimum value of the relation among all graph embedding vectors.

[0120] The formula for calculating the normalized tail entity vector is:

[0121] Among them, e t1 Represents a normalized tail entity vector, e t Let a represent the tail entity vector of the target vector. t b represents the maximum value of the tail entity among all graph embedding vectors. t This represents the minimum value of the tail entity among all graph embedding vectors.

[0122] In some embodiments, the final candidate embedding vector is represented as: (e h1 e r1 e t1 It is understandable that normalizing the graph embedding vectors to obtain candidate embedding vectors can improve the efficiency of data processing and facilitate further data applications.

[0123] Please refer to Figure 10 In some embodiments, step S105 includes, but is not limited to, steps S701 to S706:

[0124] Step S701: Obtain the network RGB graph at each time point and the adjacent network RGB graph corresponding to the previous time point.

[0125] Step S702: Perform a weighted average of the pixel values ​​in the network RGB image to obtain the first grayscale image;

[0126] Step S703: Perform a weighted average of the pixel values ​​in the adjacent RGB images of the network to obtain the second grayscale image;

[0127] Step S704: Optical flow calculation is performed on the first grayscale image and the second grayscale image using the Falnebach algorithm to obtain the first optical flow feature vector and the second optical flow feature vector;

[0128] Step S705: Combine the first optical flow feature vector and the second optical flow feature vector to form an initial optical flow map;

[0129] Step S706: Color-encode the initial optical flow map to obtain the network optical flow map.

[0130] For example, if three time points are arranged sequentially on the timeline, namely 12:15, 12:16, and 12:17, the corresponding RGB network diagram for each time point is as follows: Figure 1 , Figure 2 Figure 3 shows that we can obtain... Figure 1 The network RGB graph at the previous adjacent time step, due to Figure 1 There is no previous adjacent time step, therefore no specific calculation is performed. Figure 2 The network RGB graph of the adjacent time step, i.e. Figure 1 ; Obtain the network RGB image of Figure 3 and the previous adjacent time step, i.e. Figure 2 Finally, two more network optical flow graphs were obtained.

[0131] For example, if we call a certain moment "moment A" and the adjacent moment "moment B", then we can take a weighted average of the pixel values ​​in the corresponding RGB network image at moment A to obtain a first grayscale image, and take a weighted average of the pixel values ​​in the adjacent RGB network images at moment B to obtain a second grayscale image. Specifically, we can use image processing libraries or image processing functions in programming languages ​​to read the RGB network image and obtain the pixels in the RGB network image.

[0132] It is understandable that the Falnebach algorithm is an optical flow algorithm used to calculate image motion. Optical flow is a way of representing the direction and speed of motion of pixels in a network RGB image at various time points.

[0133] For example, suppose the first grayscale image is the grayscale image corresponding to time A, denoted by L1; and the second grayscale image is the grayscale image corresponding to time B, denoted by L2. The process of using the Falnebach algorithm to calculate the optical flow of the first and second grayscale images is as follows: First, select original feature points, such as corner points or edge points, in L1. Then, find the corresponding points of the original feature points in image L2 as adjacent feature points, that is, find the points in L2 that are at the same position as the original feature points in L1.

[0134] In some embodiments, by comparing the pixel value changes of the two feature points, the displacement vector of the original feature point is calculated using the Falnebach algorithm as the first optical flow feature vector, which can represent the direction and velocity of the original feature point from time A to time B.

[0135] Similarly, the displacement vectors of adjacent feature points can be calculated using the Falnebach algorithm as the second optical flow feature vector, which can represent the direction and velocity of the adjacent feature points from time B to time A.

[0136] Understandably, by performing optical flow calculations on two consecutive grayscale images using the Falnebach algorithm, a series of optical flow feature vectors can be obtained. These optical flow feature vectors can be used to analyze and understand the motion of the network's RGB image.

[0137] In some embodiments, two optical flow vector fields can be obtained using a first optical flow feature vector and a second optical flow feature vector. These optical flow vector fields represent the displacement of pixels between adjacent frames. Furthermore, these two optical flow vector fields are combined to obtain an initial optical flow map, which can be used to display the direction and velocity of an object's motion in the image.

[0138] In some embodiments, the initial optical flow graph can be color-coded to obtain a network optical flow graph. Specifically, each pixel in the optical flow graph can be colored according to the direction and velocity of motion to more intuitively observe the motion of the object. It is understood that network optical flow graphs can be used to better represent and understand the trajectory of an object.

[0139] Please refer to Figure 11 In some embodiments, step S107 includes, but is not limited to, steps S801 to S802:

[0140] Step S801: Select the first allocation ratio corresponding to the first feature mapping vector and the second allocation ratio corresponding to the second feature mapping vector; wherein the sum of the first allocation ratio and the second allocation ratio is 1;

[0141] Step S802: The product of the first feature mapping vector and the first allocation ratio is added to the product of the second feature mapping vector and the second allocation ratio to obtain the predicted feature mapping vector.

[0142] In some embodiments, since the structures of the first feature mapping vector and the second feature mapping vector are different, the vector features they represent are also different. Therefore, when constructing the predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector, the weights assigned to the first feature mapping vector and the second feature mapping vector are also different.

[0143] In some embodiments, a first allocation ratio, such as 60%, can be preset for the first feature mapping vector based on experience; and a second allocation ratio, such as 40%, can be preset for the second feature mapping vector. It is understood that the change of the first feature mapping vector at the next moment needs to be predicted based on the motion and change patterns represented by the second feature mapping vector; therefore, the first allocation ratio can be set to be greater than the second allocation ratio. It is understood that the first and second allocation ratios can also be set to 65%, 35%, etc., and can be specifically set according to requirements. It is understood that, to ensure the correctness of the weighted result, the sum of the first and second allocation ratios should equal 1.

[0144] In some embodiments, the predicted feature mapping vector can be obtained by adding the product of the first feature mapping vector and the first allocation ratio to the product of the second feature mapping vector and the second allocation ratio. Specifically, if the first feature mapping vector is represented by e1 and the first allocation ratio is 60%, and the second feature mapping vector is represented by e2 and the second allocation ratio is 40%, then the predicted feature mapping vector e1 is calculated as follows: 预 The calculation formula is:

[0145] e 预 =e1×60% + e2×40%

[0146] It is understandable that by using feature selection and weight allocation, more accurate and reasonable predictive feature vectors can be calculated, thereby improving the accuracy and effectiveness of predictions.

[0147] Please refer to Figure 12 In some embodiments, after obtaining the predicted feature mapping vector, the process further includes, but is not limited to, steps S901 to S902:

[0148] Step S901: Analyze the predicted feature mapping vector to obtain the prediction analysis results;

[0149] Step S902: Based on the prediction analysis results, adjust the first allocation ratio and the second allocation ratio, and reconstruct the predicted feature mapping vectors corresponding to the first feature mapping vector and the second feature mapping vector.

[0150] In some embodiments, to ensure the accuracy of the predicted feature mapping vector, the predicted feature vector can be analyzed to obtain the prediction analysis results. Specifically, the analysis can be performed using a semantic recognition model or other machine learning models, or by the user performing the analysis themselves, etc.

[0151] In some embodiments, based on the predictive analysis results, it can be determined whether the predicted feature mapping vector meets the preset requirements. If it meets the preset requirements, it indicates that the calculation of the predicted feature vector is reasonable and no further adjustment is needed; if it does not meet the preset requirements, the first allocation ratio and the second allocation ratio can be adjusted. Generally, the first allocation ratio can be appropriately increased and the second allocation ratio can be appropriately decreased; alternatively, the first allocation ratio can be appropriately decreased and the second allocation ratio can be appropriately increased. The specific adjustment method is determined based on the predictive analysis results.

[0152] Please refer to Figure 13 In some embodiments, step S108 includes, but is not limited to, steps S1001 to S1003:

[0153] Step S1001: Calculate the similarity between the predicted feature mapping vector and the historical feature mapping vector to obtain the vector similarity.

[0154] Step S1002: Obtain the maximum value of vector similarity to get the maximum similarity.

[0155] Step S1003: Use the historical attack data corresponding to the maximum similarity as the predicted attack data.

[0156] In some embodiments, cosine similarity or Euclidean distance can be used to calculate the similarity between the predicted feature mapping vector and multiple historical feature mapping vectors, and multiple vector similarities can be obtained.

[0157] In some embodiments, the maximum value of vector similarity can be selected to obtain the maximum similarity, and the historical attack data corresponding to the historical feature mapping vector with the maximum similarity can be used as the predicted attack data.

[0158] In some embodiments, a similarity threshold can be set to filter the predicted attack data. For example, a similarity threshold of 85% can be set. If the calculated predicted feature mapping vector has a similarity of 40% with historical feature mapping vector 1, 98% with historical feature mapping vector 2, 68% with historical feature mapping vector 3, and 92% with historical feature mapping vector 4, then the historical attack data corresponding to historical feature mapping vectors 2 and 4 can be selected as the predicted attack data.

[0159] Please refer to Figure 14 In some embodiments, step S1001 includes, but is not limited to, steps S1101 to S1104:

[0160] Step S1101: Multiply the predicted feature mapping vector and the historical feature mapping vector to obtain the first product;

[0161] Step S1102: Take the magnitude of the predicted feature mapping vector as the first vector magnitude; take the magnitude of the historical feature mapping vector as the second vector magnitude.

[0162] Step S1103: Multiply the first vector magnitude and the second vector magnitude to obtain the second product;

[0163] Step S1104: Obtain the vector similarity by dividing the first product by the second product.

[0164] In some embodiments, the similarity is calculated using the following formula:

[0165] S(e,e0)=(e·e0) / (|e|×|e0|)

[0166] Where S(e,e0) represents the similarity between the predicted feature mapping vector and the historical feature mapping vector, e represents the predicted feature mapping vector, e0 represents the historical feature mapping vector, · represents the dot product of the predicted feature mapping vector and the historical feature mapping vector, |e| represents the magnitude of the predicted feature mapping vector, and |e0| represents the magnitude of the historical feature mapping vector.

[0167] Specifically, the predicted feature mapping vector and the historical feature mapping vector can be multiplied to obtain the first product. Then, the magnitude of the predicted feature mapping vector is taken as the first vector magnitude, and the magnitude of the historical feature mapping vector is taken as the second vector magnitude. The first vector magnitude and the second vector magnitude are then multiplied to obtain the second product. Finally, the vector similarity is obtained by dividing the first product by the second product. Thus, the predicted feature mapping vectors can be filtered based on the similarity.

[0168] Please refer to Figure 15 In some embodiments, the network attack prediction method further includes, but is not limited to, steps S1201 to S1202:

[0169] Step S1201: Obtain the map size information of the network data map;

[0170] Step S1202: Based on the image size information, the structure of the convolutional neural network is set; wherein, the convolutional neural network includes a first convolutional neural network and a second convolutional neural network; the first convolutional neural network and the second convolutional neural network have equal lengths; the first convolutional neural network is used to obtain the network RGB image corresponding to the current time and perform feature mapping processing on the RGB image to obtain a first feature mapping vector; the second convolutional neural network is used to perform feature mapping processing on the network optical flow image to obtain a second feature mapping vector.

[0171] In some embodiments, the size information of the network data graph can be obtained, and the structure of the convolutional neural network can be adjusted according to the size information of the network data graph. It is understood that since both the first and second convolutional neural networks extract data from the network data graph at the same time point, their lengths are the same. The first convolutional neural network can be a static information flow convolutional neural network, used to obtain the network RGB image corresponding to the current time point and perform feature mapping processing on the network RGB image to obtain a first feature mapping vector. The second convolutional neural network can be a spatiotemporal flow convolutional neural network, which, after converting the network RGB image at each time point and at least one adjacent network RGB image at each time point into an optical flow graph to obtain a network optical flow graph, can perform feature mapping processing on the network optical flow graph to obtain a second feature mapping vector. In some embodiments, both the first and second convolutional neural networks can vectorize the network data graph to obtain a graph embedding vector.

[0172] Please refer to Figure 16 In some embodiments, the network attack prediction method further includes, but is not limited to, steps S1301 to S1304:

[0173] Step S1301: Obtain network monitoring update data at each moment;

[0174] Step S1302: Update the corresponding network data map based on the network monitoring update data to obtain the updated data map;

[0175] Step S1303: Obtain the updated size information of the updated data map;

[0176] Step S1304: Update the structure of the convolutional neural network at the corresponding time according to the updated size information.

[0177] Understandably, network data can include network traffic, connection status, and abnormal attacks, etc. Network data is updated in real time, with new network data constantly emerging or network data missed at historical time points being detected. Therefore, the corresponding network data graph can be updated based on the time point when the network data appears, resulting in an updated data graph. Based on the size information of the updated data graph, the structure of the convolutional neural network can be updated at the corresponding time.

[0178] For example, if there are time points A, B, C, and D in chronological order, and network data has been detected in advance based on A, B, C, and D, and the detected network data graph has been embedded into a convolutional neural network, and new network monitoring update data is found corresponding to time point B during subsequent network data monitoring, then the corresponding updated network data graph can be obtained based on the network monitoring update data, and the size of the updated data graph can be calculated.

[0179] Understandably, if the size of the updated data graph is smaller than the size of the convolutional neural network, then there is no need to adjust the convolutional neural network; the updated data graph can simply be embedded at the arrangement position at time point B.

[0180] Furthermore, if the size of the updated data map is larger than the size of the convolutional neural network (CNN), the structure of the CNN is adjusted. For example, the spatial size of the CNN is adjusted, and the updated data map is embedded into the spatial representation corresponding to time point B within the CNN. It is understandable that embedding the updated data map into an existing CNN ensures the integrity of the network data and improves prediction accuracy.

[0181] Please see Figure 17 This application also provides a network attack prediction system that can implement the above-described network attack prediction method. The network attack prediction system includes:

[0182] The data acquisition module 1701 is used to acquire the network data graph at each time point and the historical feature mapping vector of each network data graph; wherein, the network data graph is constructed from the historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data.

[0183] The graph embedding vector acquisition module 1702 is used to perform vectorization processing on the network data graph to obtain the graph embedding vector.

[0184] The network RGB image acquisition module 1703 is used to convert the RGB image into an RGB image by the spectral embedding vectors corresponding to each time point, so as to obtain the network RGB image.

[0185] The first feature mapping vector acquisition module 1704 is used to acquire the network RGB image corresponding to the current time point, and perform feature mapping processing on the network RGB image to obtain the first feature mapping vector.

[0186] The network optical flow graph acquisition module 1705 is used to convert the network RGB graph at each time point and the network RGB graph corresponding to the adjacent previous time point into an optical flow graph to obtain the network optical flow graph.

[0187] The second feature mapping vector acquisition module 1706 is used to perform feature mapping processing on the network optical flow graph to obtain the second feature mapping vector.

[0188] The predictive feature mapping vector construction module 1707 is used to construct a predictive feature mapping vector based on the first feature mapping vector and the second feature mapping vector.

[0189] The network attack prediction result acquisition module 1708 is used to filter predicted attack data from historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain network attack prediction results.

[0190] In some embodiments, the network data graph can be an MDATA graph (intelligent data graph), or it can be used for data graphs and social graphs, etc. This application primarily focuses on the MDATA graph, but the application scope of the network attack prediction method is not limited to MDATA graphs. It is understood that a timeline can be constructed, and corresponding network data can be obtained in chronological order. This network data can include alarm logs, detection data, and attack data, etc.

[0191] Reference Figure 3-a and Figure 3-b , Figure 3-a This is a diagram of a knowledge graph. Figure 3-b This is a schematic diagram of an MDATA graph. As can be seen from the diagram, a knowledge graph can only simply represent entities and the relationships between them, while an MDATA graph can not only represent the relationships between entities, but also the attributes of entities and the relationships between entities and attributes. Furthermore, MDATA graphs are dynamic and scalable; therefore, they can be used to predict and analyze attack changes in network data.

[0192] For example, a network data graph can be constructed based on network data. First, the network data is cleaned, including removing duplicate data, handling missing values, and correcting data formatting. Simultaneously, if the network data carries sensitive information, this sensitive information can be anonymized to ensure data security. Second, entity recognition and relationship extraction can be performed on the cleaned data to extract entities (attackers and victims, source and destination network addresses, attack methods, etc.) and the relationships between them. Furthermore, Natural Language Processing (NLP) techniques can be used to assist in the extraction of entities and relationships. Finally, by using entities as nodes and relationships as edges, a network data graph can be constructed and visualized.

[0193] In some embodiments, static knowledge composed of triples in the network data graph can be extracted at time points, namely, static knowledge composed of entities (including head entities and tail entities) and relations. This static knowledge is then embedded into a vector space through a convolutional neural network for vectorization processing to obtain a graph embedding vector. This graph embedding vector can then be used to improve the effectiveness of network attack prediction.

[0194] Under normal circumstances, each time point corresponds to one network data graph. In some specific cases, each time point may correspond to multiple network data graphs. This application takes one network data graph per time point as an example. In some embodiments, the graph embedding vectors corresponding to each time point can be converted to RGB to obtain a network RGB graph. In other words, all graph embedding vectors are converted to RGB to obtain a network RGB graph. It is understood that a network RGB graph is a vector graph with color features, which can be understood as an RGB graph or an RGB vector graph. Specifically, the graph embedding vectors can be normalized to map the values ​​of all head entity vectors, relation vectors, and tail entity vectors to the numerical range of [0,1]. Then, a scalar multiplication operation is performed on all vectors, i.e., multiplied by 255 (255 is the maximum color intensity of the network RGB graph). Thus, the head entity vectors, relation vectors, and tail entity vectors can all be converted to the numerical range specified by the network RGB graph. In some embodiments, the modulus of the triplet vectors contained in each graph embedding vector is used as the color of the pixel, and the pixels are arranged to obtain a network RGB graph of a fixed size.

[0195] In some embodiments, the convolutional neural network includes a first convolutional neural network (i.e., a static information flow convolutional neural network) and a second convolutional neural network (i.e., a spacetime flow convolutional neural network). It is understood that the first convolutional neural network can be used to vectorize the network data graph to obtain a graph embedding vector. After the graph embedding vector is converted into a network RGB graph, the network RGB graph corresponding to the current time step is selected and input into the first convolutional neural network for feature mapping processing to obtain a first feature mapping vector. In some embodiments, the network data graph can also be vectorized using a second convolutional neural network. In the embodiments of this application, the second convolutional neural network is mainly used to perform feature mapping processing on the network RGB graph at each time step and the network optical flow graph obtained by converting at least one adjacent network RGB graph at each time step to obtain a second feature mapping vector. It is understood that the latest time step, the latest time point, the current time step, and the current time point are all the same concept.

[0196] In some embodiments, the network RGB graph at the current time (i.e., the latest time) can be selected from the network RGB graphs at multiple time points for feature mapping processing to obtain a first feature mapping vector. It is understood that the obtained first feature mapping vector can be used for tasks such as network classification, clustering, and recognition, thereby enabling better analysis of the structure and behavior of the network data graph.

[0197] In some embodiments, a network optical flow graph can be obtained by converting the network RGB graph at each time point and the network RGB graph corresponding to the previous time point adjacent to each time point into an optical flow graph. For example, in some embodiments, during the process of converting the network RGB graph at each time point and the network RGB graph corresponding to the previous time point adjacent to each time point into a network optical flow graph, if the current time point is 12:15:01, according to a preset time interval of 1 second (which can be set according to actual conditions), an adjacent time point (i.e., the previous time point) is selected. If, according to the main time change, the adjacent time point is 12:15:00, then the network data graphs corresponding to 12:15:01 and 12:15:00 are selected for processing to obtain a network optical flow graph. For example, there are 5 time points arranged in chronological order, each time point corresponding to a network RGB graph, for a total of 5 network RGB graphs, numbered as network RGB graph 1, network RGB graph 2, network RGB graph 3, network RGB graph 4, and network RGB graph 5, respectively. The optical flow graph is transformed from the network RGB image at each time step to at least one adjacent network RGB image at that time step. Specifically, optical flow graphs of network RGB images 1 and 2, 2 and 3, 3 and 4, and 4 and 5 can be transformed to obtain four network optical flow graphs. It is understood that the network RGB image at the current time step can also be transformed to obtain a network optical flow graph from two or three adjacent network RGB images. For example, optical flow graphs of network RGB images 1, 2, and 3 can be transformed to obtain one network optical flow graph, and so on. This application does not impose specific limitations on this.

[0198] Understandably, network optical flow graphs, which are converted from two or more network RGB graphs, capture the motion patterns and directions between the network RGB graphs, thus enabling more accurate prediction of network attacks based on changes.

[0199] In some embodiments, the optical flow graph of the network can be input into a second convolutional neural network. Through the fully connected layers of the second convolutional neural network, each feature map in the optical flow graph is transformed into a specific output value, ultimately obtaining the second feature map information of the network data graph. That is, the second convolutional neural network extracts features from the optical flow graph to obtain the second feature map vector. It can be understood that the second feature information can transform the original optical flow graph into a more representative and discriminative feature vector, thereby extracting richer information.

[0200] In some embodiments, a predicted feature mapping vector can be constructed using a first feature vector and a second feature vector. Specifically, the predicted feature mapping vector can be constructed by weighting the first and second feature vectors according to a preset allocation ratio, or by directly adding the first and second feature vectors. It is understood that the predicted feature mapping vector can represent the predicted change vector for the next time step. It is understood that by constructing the predicted feature mapping vector, both the feature information and the change information of the latest time step can be obtained; therefore, the network attack prediction vector for the next time step can be obtained.

[0201] In some embodiments, similarity can be calculated between the predicted feature mapping vector and the historical feature mapping vector. The historical feature mapping vector with the highest similarity to the predicted feature mapping vector is selected, and the historical attack data corresponding to the historical feature mapping vector is selected as the predicted attack data. The predicted attack data is then used as the network attack prediction result. In some embodiments, a similarity threshold can be set, and historical feature mapping vectors with a similarity greater than the similarity threshold to the predicted feature mapping vector can be filtered. Then, a second filtering is performed on the selected historical feature mapping vectors to finally obtain the predicted attack data.

[0202] It is understood that the historical feature mapping vector is a vector formed by a large amount of historical attack data. By summarizing the historical attack data, historical attack data can be obtained. In some embodiments, historical attack data can be stored in a historical attack database or other databases, and this application embodiment does not impose specific limitations on this.

[0203] The network attack prediction method, system, electronic device, and storage medium proposed in this application can obtain a network data graph at the current moment and vectorize it to obtain a graph embedding vector. This process can be performed using a regular convolutional neural network, or using a first convolutional neural network or a second convolutional neural network. For example, all graph embedding vectors can be converted to RGB graphs based on the corresponding time points to obtain a network RGB graph, and feature mapping processing can be performed on the latest network RGB graph to obtain a first feature mapping vector. Furthermore, an optical flow graph representing the changes can be obtained by converting the network RGB graph at each time point and a network RGB graph at an adjacent time point. A second convolutional neural network can then perform feature mapping processing on the network optical flow graph to obtain a second feature mapping vector, which can represent the changing trend of the network data graph. This application can combine the first and second feature mapping vectors to construct prediction features, build a prediction feature mapping vector, and analyze the prediction feature mapping vector based on historical feature mapping vectors to filter out the predicted attack data for the next time point, thus obtaining the network attack prediction result. This application can predict the changing trends of network data graphs, thereby improving the accuracy of attack predictions for the next moment in network data graphs.

[0204] The specific implementation of this network attack prediction system is basically the same as the specific embodiments of the network attack prediction method described above, and will not be repeated here. Subject to meeting the requirements of the embodiments of this application, the network attack prediction system may also be equipped with other functional modules to implement the network attack prediction method described above.

[0205] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned network attack prediction method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0206] Please see Figure 18 , Figure 18 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0207] The processor 1801 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0208] The memory 1802 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1802 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1802 and is called and executed by the processor 1801 using the network attack prediction method of the embodiments of this application.

[0209] The input / output interface 1803 is used to implement information input and output;

[0210] The communication interface 1804 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0211] Bus 1805 transmits information between various components of the device (e.g., processor 1801, memory 1802, input / output interface 1803, and communication interface 1804);

[0212] The processor 1801, memory 1802, input / output interface 1803 and communication interface 1804 are connected to each other within the device via bus 1805.

[0213] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described network attack prediction method.

[0214] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0215] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0216] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0217] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0218] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0219] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0220] It should be understood that in this application, "at least one" and "several" refer to one or more, and "multiple" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0221] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0222] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0223] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0224] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0225] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for predicting network attacks, characterized in that, The method includes: Obtain the network data graph at each time point and the historical feature mapping vector of each network data graph; wherein, the network data graph is constructed from historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data; The network data graph is vectorized to obtain the graph embedding vector; The RGB image conversion is performed on the graph embedding vectors corresponding to each time point to obtain the network RGB image; Obtain the network RGB image corresponding to the current time point, and perform feature mapping processing on the network RGB image to obtain the first feature mapping vector; The network RGB image at each time point and the network RGB image corresponding to the adjacent previous time point are converted into an optical flow image to obtain a network optical flow image. The network optical flow graph is subjected to feature mapping processing to obtain a second feature mapping vector; Construct a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector; Based on the predicted feature mapping vector and the historical feature mapping vector, predicted attack data is filtered from the historical attack data to obtain the network attack prediction result.

2. The network attack prediction method according to claim 1, characterized in that, The network data graph includes: original triplet data; the vectorization process of the network data graph to obtain the graph embedding vector includes: The network data graph is input into a preset convolutional neural network; wherein the convolutional neural network includes: a dimensionality reduction layer, a convolutional layer, and an activation function layer; The original triplet data is dimensionality reduced using the dimensionality reduction layer and a preset dimension to obtain candidate triplet data. The convolutional layer is used to extract features from the candidate triplet data to obtain triplet feature information; The activation function layer performs a nonlinear transformation on the triplet feature information to obtain the graph embedding vector.

3. The network attack prediction method according to claim 2, characterized in that, After inputting the network data graph into a preset convolutional neural network, the method further includes: Training the convolutional neural network specifically includes: The graph embedding vector is input into the linear transformation evaluation model to perform linear transformation evaluation, and linear transformation evaluation data is obtained. The convolutional neural network is trained based on the linear transformation evaluation data.

4. The network attack prediction method according to claim 3, characterized in that, The step of inputting the graph embedding vector into a linear transformation evaluation model to perform linear transformation evaluation and obtain linear transformation evaluation data includes: The first graph embedding vector is obtained by multiplying the graph embedding vector with the filtering parameters of the linear transformation evaluation model and adding the product to the first bias. After activating the first graph embedding vector using an activation function, it is added to the second bias to obtain the second graph embedding vector. The second map embedding vector is multiplied by the linear operation coefficients of the linear transformation evaluation model to obtain the linear transformation evaluation data.

5. The network attack prediction method according to claim 1, characterized in that, The step of converting the spectral embedding vectors corresponding to each time point into an RGB image to obtain a network RGB image includes: The graph embedding vectors corresponding to each time point are normalized to obtain candidate embedding vectors; The target embedding vector is obtained by multiplying the preset color intensity value and the candidate embedding vector. The network RGB graph is constructed based on the target embedding vector and the preset pixel color values.

6. The network attack prediction method according to claim 5, characterized in that, The normalization process for the map embedding vectors corresponding to each time point to obtain candidate embedding vectors includes: Obtain multiple graph embedding vectors corresponding to each time point; wherein, the graph embedding vectors include: head entity vector, relation vector, and tail entity vector; The graph embedding vectors are sorted to obtain the maximum and minimum values ​​of multiple head entity vectors, multiple relation vectors, and multiple tail entity vectors; wherein the maximum and minimum values ​​include the maximum value and the minimum value. Obtain the target vector; wherein, the target vector is the graph embedding vector that needs to be normalized; Subtract the minimum value corresponding to the head entity vector from the head entity vector of the target vector to obtain the head entity vector reference value; subtract the minimum value corresponding to the relation vector from the relation vector to obtain the relation vector reference value; subtract the minimum value corresponding to the tail entity vector from the tail entity vector to obtain the tail entity vector reference value. The normalized head entity vector is obtained by dividing the head entity vector reference value by the difference between the maximum and minimum values ​​corresponding to the head entity vector; the normalized relation vector is obtained by dividing the relation vector reference value by the difference between the maximum and minimum values ​​corresponding to the relation vector; and the normalized tail entity vector is obtained by dividing the tail entity vector reference value by the difference between the maximum and minimum values ​​corresponding to the tail entity vector. Based on the normalized head entity vector, the normalized relation vector, and the normalized tail entity vector, a candidate embedding vector is obtained.

7. The network attack prediction method according to claim 1, characterized in that, The step of converting the network RGB image at each time point and the network RGB image corresponding to the adjacent previous time point into an optical flow graph to obtain a network optical flow graph includes: Obtain the network RGB image at each time point and the adjacent network RGB image corresponding to the previous time point adjacent to each time point; The pixel values ​​in the RGB image of the network are weighted and averaged to obtain the first grayscale image; The second grayscale image is obtained by weighted averaging the pixel values ​​in the adjacent network RGB images; Optical flow calculations are performed on the first grayscale image and the second grayscale image using the Falnebach algorithm to obtain the first optical flow feature vector and the second optical flow feature vector; An initial optical flow map is formed by combining the first optical flow feature vector and the second optical flow feature vector. The initial optical flow map is color-coded to obtain the network optical flow map.

8. The network attack prediction method according to claim 1, characterized in that, The step of constructing a predicted feature mapping vector based on the first feature mapping vector and the second feature mapping vector includes: Select a first allocation ratio corresponding to the first feature mapping vector and a second allocation ratio corresponding to the second feature mapping vector; wherein the sum of the first allocation ratio and the second allocation ratio is 1; The predicted feature mapping vector is obtained by adding the product of the first feature mapping vector and the first allocation ratio to the product of the second feature mapping vector and the second allocation ratio.

9. The network attack prediction method according to claim 8, characterized in that, After obtaining the predicted feature mapping vector, the process further includes: The predicted feature mapping vector is analyzed to obtain the prediction analysis results; Based on the prediction analysis results, the first allocation ratio and the second allocation ratio are adjusted, and the predicted feature mapping vectors corresponding to the first feature mapping vector and the second feature mapping vector are reconstructed.

10. The network attack prediction method according to claim 1, characterized in that, The step of filtering predicted attack data from the historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain network attack prediction results includes: The similarity is calculated based on the predicted feature mapping vector and the historical feature mapping vector to obtain the vector similarity. Obtain the maximum value of the vector similarity to get the maximum similarity; The historical attack data corresponding to the maximum similarity is used as the predicted attack data.

11. The network attack prediction method according to claim 10, characterized in that, The similarity is calculated based on the predicted feature mapping vector and the historical feature mapping vector to obtain the vector similarity, including: Multiply the predicted feature mapping vector and the historical feature mapping vector to obtain the first product; The magnitude of the predicted feature mapping vector is taken as the first vector magnitude; the magnitude of the historical feature mapping vector is taken as the second vector magnitude. Multiply the magnitude of the first vector and the magnitude of the second vector to obtain the second product; The vector similarity is obtained by dividing the first product by the second product.

12. The network attack prediction method according to claim 2, characterized in that, The method further includes: Obtain the map size information of the network data map; Based on the image size information, the structure of the convolutional neural network is configured; wherein, the convolutional neural network includes a first convolutional neural network and a second convolutional neural network; the first convolutional neural network and the second convolutional neural network have equal lengths; the first convolutional neural network is used to obtain the network RGB image corresponding to the current time, and to perform feature mapping processing on the network RGB image to obtain a first feature mapping vector; the second convolutional neural network is used to perform feature mapping processing on the network optical flow image to obtain a second feature mapping vector.

13. The network attack prediction method according to claim 2 or 12, characterized in that, The method further includes: Obtain network monitoring update data at any given moment; The network data map is updated based on the network monitoring update data to obtain the updated data map; Obtain the updated size information of the updated data map; The structure of the convolutional neural network is updated at the corresponding time based on the updated size information.

14. A network attack prediction system, characterized in that, The system includes: The data acquisition module is used to acquire network data graphs at each time point and historical feature mapping vectors for each network data graph; wherein, the network data graphs are constructed from historical network monitoring data generated at each historical moment, and the historical network monitoring data includes historical attack data; The graph embedding vector acquisition module is used to perform vectorization processing on the network data graph to obtain the graph embedding vector. The network RGB image acquisition module is used to convert the spectral embedding vectors corresponding to each time point into RGB images to obtain a network RGB image. The first feature mapping vector acquisition module is used to acquire the network RGB image corresponding to the current time point, and perform feature mapping processing on the network RGB image to obtain the first feature mapping vector; The network optical flow graph acquisition module is used to perform optical flow graph conversion on the network RGB graph at each time point and the network RGB graph corresponding to the adjacent previous time point to obtain the network optical flow graph. The second feature mapping vector acquisition module is used to perform feature mapping processing on the network optical flow graph to obtain the second feature mapping vector. A predictive feature mapping vector construction module is used to construct a predictive feature mapping vector based on the first feature mapping vector and the second feature mapping vector; The network attack prediction result acquisition module is used to filter predicted attack data from the historical attack data based on the predicted feature mapping vector and the historical feature mapping vector to obtain the network attack prediction result.

15. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the network attack prediction method according to any one of claims 1 to 13.

16. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the network attack prediction method according to any one of claims 1 to 13.

Images