Active intrusion prevention method and apparatus

Abstract

The application discloses an active intrusion prevention method, relates to the technical field of system network security, and aims to solve the problems of low detection precision and detection lag of existing network abnormal intrusion, and comprises the following steps: obtaining preprocessed network data; performing multi-dimensional traffic data analysis on the network data to obtain the network data labeled with network state credibility measurement results and various sub-dimension measurement labels; calculating the labeled network data through a machine learning classification algorithm to obtain characteristic behavior classification of the network data; and performing suspicious node detection through fine-grained real-time measurement according to the classification results and updating a security strategy. The application further discloses an active intrusion prevention device. The application can quickly analyze network intrusion through multi-dimensional analysis of network data and machine learning.

Description

Technical Field

[0001] This invention relates to the field of system network security technology, and in particular to a proactive intrusion prevention method and apparatus based on trust metrics. Background Technology

[0002] Currently, abnormal intrusion detection mainly employs statistical and machine learning methods. By auditing and processing network data or system operation logs, the system automatically classifies and processes abnormal or malicious attacks based on the data, terminates processes, or issues warnings to administrators, thereby ensuring the security of the network space.

[0003] Existing intrusion detection methods are passive and have a certain lag, making it impossible to detect malicious attacks or abnormal behavior in the first instance. Furthermore, the data dimensions are not comprehensive enough and the detection accuracy needs to be improved. There is a need to establish a proactive intrusion defense mechanism that combines comprehensive data dimensions with trust metrics and has high detection accuracy. Summary of the Invention

[0004] To overcome the shortcomings of existing technologies, one of the objectives of this invention is to provide a proactive intrusion prevention method, which identifies threats by labeling comprehensive network state trust metrics and metrics of each sub-dimension in network data and by using machine learning.

[0005] One of the objectives of this invention is achieved through the following technical solution:

[0006] A proactive intrusion prevention method includes the following steps:

[0007] Obtain preprocessed network data;

[0008] The network data is parsed using multi-dimensional traffic data analysis to obtain the network data labeled with network status reliability measurement results and measurement labels for each sub-dimension;

[0009] The labeled network data is processed using a machine learning classification algorithm to obtain the feature behavior classification of the network data.

[0010] Based on the classification results, suspicious nodes are detected through fine-grained real-time measurements, and the security policy is updated.

[0011] Furthermore, the preprocessing includes:

[0012] Normalize the raw network data;

[0013] The non-numerical data in the normalized original network data is encoded into a vector;

[0014] The network data is obtained by extracting attributes using a parsing tool.

[0015] Furthermore, the network data undergoes multi-dimensional traffic data analysis, including:

[0016] Verify the key network parameters in the network data;

[0017] Calculate the success rate of trusted interactions between nodes in the network data;

[0018] The network transmission status of the calculation node is measured and a reliability metric is performed. The network transmission status includes: data transmission latency, data transmission duplication rate, and data transmission forwarding rate.

[0019] Based on the network transmission state metric trust measurement results, calculate the trust value, satisfying:

[0020] Among them, T trans For reliable values, f is the weight parameter. delay f is a reliable measure of data transmission latency. dup f is a reliable measure of data transmission repetition rate. relay A reliable measure of data transmission forwarding rate;

[0021] Based on the aforementioned confidence value, a network state confidence measurement is performed, satisfying the following:

[0022] Among them, T net CHECK(ID, IP, MAC) is a verification function used to measure network state reliability. and T is the weight parameter. trans This is a reliable value.

[0023] Furthermore, the machine learning classification algorithm is a classification algorithm based on the sparrow search algorithm.

[0024] Furthermore, the sparrow search classification algorithm is an improved sparrow search algorithm that introduces chaotic mapping and random walk. The chaotic mapping is used to update the sparrow position, and the random walk is used to update the optimal sparrow.

[0025] When initializing the population, the sparrow search algorithm uses a chaotic mapping to initialize the population, and the expression of the chaotic mapping satisfies:

[0026] y n (t+1)=by n (t)(1-y n (t)), where, where, y n ∈[0,1], t is the current iteration number, and b is the control parameter;

[0027] The sparrow search algorithm is perturbed by a random walk to update the optimal sparrow. The random walk satisfies the following formula:

[0028] B(t)=[0, cumsum(2r(t1)-1),..., cumsum(2r(t) n )-1)], where B(t) is the set of steps for the random walk, cumsum is the cumulative sum, t is the maximum number of iterations taken during the random walk calculation, and r(t) is a random function that satisfies:

[0029]

[0030] After random walk computation and normalization, the following conditions are met:

[0031] Among them, a i b is the minimum value of the random walk of the i-th dimension sparrow; i It is the maximum value of the random walk of the i-th dimension sparrow; It is the minimum value of the i-th dimension sparrow in the t-th iteration; It is the maximum value of the i-th dimension sparrow in the t-th iteration.

[0032] Furthermore, machine learning classification algorithms include the following steps:

[0033] Initialize the population and search area;

[0034] The fitness function value of each sparrow is continuously updated within the number of iterations to obtain the sparrow with the optimal fitness value. The fitness function satisfies:

[0035] Fitness = min(1-Accuracy), where Accuracy is the accuracy.

[0036] Furthermore, suspicious node detection is performed through fine-grained real-time measurements, including:

[0037] Perform fine-grained real-time measurements to meet the following requirements:

[0038] Where μ1 and μ2 are weight parameters, T trans A reliable value;

[0039] To determine the reliability of the node to be observed, the following conditions must be met:

[0040] when If the node under observation is deemed safe and trustworthy, then it is considered safe and trustworthy; otherwise, it is considered untrustworthy.

[0041] Furthermore, the security strategy is an adaptive proactive immune security strategy, which includes: assessing the security threat situation of nodes and taking security mechanisms based on the level of security threats;

[0042] The security threat status of the assessment node satisfies:

[0043] Where S represents the security threat assessment result of the node, and Pr(st i ) represents the probability of facing each threat, and f is a function for calculating the degree of security threat faced by a node. Represents the security threat vector, n t The number of major security threats faced by the system;

[0044] The security mechanism includes: node trust assessment period ΔT, real-time fine-grained assessment Δt, and node trust self-test function;

[0045] The security mechanism also includes: controlling the input and output of the sensing node according to predictive control theory to satisfy:

[0046] Where y(t), u(t), and Δv(t) represent the output, input, and forward feedback measurable disturbance of the controlled object at time t, respectively, and Δ = 1 - z -1 , represents the difference operator, These are controlled parameters.

[0047] Furthermore, update the security policy, including:

[0048] Send the formal description (SA) of the security threat behavior to the nearest endpoint;

[0049] The security threat probability correction function mf(Pr,SA) is calculated based on the security threat probability Pr and the formal description SA.

[0050] Recalculate SI based on the correction function mf(Pr,SA);

[0051] Update the data based on the SI to complete the security policy update.

[0052] The second objective of this invention is to provide an active intrusion prevention device that achieves active defense against network threats by labeling network data, combining machine learning algorithms, and updating security policies.

[0053] The second objective of this invention is achieved by the following technical solution:

[0054] An active intrusion prevention device, comprising:

[0055] The data acquisition module is used to acquire preprocessed network data;

[0056] The threat analysis module is used to perform multi-dimensional traffic data parsing on the network data to obtain the network data labeled with network status trust measurement results and measurement labels for each sub-dimension; and to calculate the characteristic behavior classification of the network data by using a machine learning classification algorithm.

[0057] The policy update module is used to detect suspicious nodes and update the security policy based on the classification results through fine-grained real-time measurement.

[0058] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0059] This invention utilizes multi-dimensional traffic data analysis to establish a trust metric, enabling precise labeling of multi-dimensional features of network data. This increases data accuracy and security. Combined with machine learning classification algorithms to learn network threat intrusion prevention mechanisms, it can quickly classify attack features and detect malicious behavior, achieving effective malicious attack identification while reducing time complexity. Furthermore, this invention performs fine-grained trust metrics to isolate malicious terminals and control their impact, achieving proactive detection, response, and isolation. Attached Figure Description

[0060] Figure 1 This is a flowchart of an active intrusion prevention method according to Embodiment 1;

[0061] Figure 2 This is a flowchart of the multi-dimensional traffic data parsing process in Example 1;

[0062] Figure 3 This is a flowchart of the sparrow search algorithm in Example 1;

[0063] Figure 4 This is a structural block diagram of the active intrusion prevention device in Embodiment 2. Detailed Implementation

[0064] The present invention will now be described in more detail with reference to the accompanying drawings. It should be noted that the following description of the present invention with reference to the accompanying drawings is merely illustrative and not restrictive. Various embodiments can be combined with each other to form other embodiments not shown in the following description.

[0065] Example 1

[0066] Example 1 provides a proactive intrusion prevention method, which aims to perform multi-dimensional analysis of network data, add feature labels to the data, and then use machine learning to analyze network attacks.

[0067] Attacks targeting the power Internet of Things (IoT) include a significant number of malicious traffic or virus attacks originating from outside the system. These attacks are highly covert, with attackers operating covertly, possibly even originating from overseas. Malicious data packets are mixed into normal traffic, probing through external interfaces of the power system, and the attack process varies widely. If a successful attack occurs, it can lead to sensitive data leaks, system shutdowns, and even unpredictable and severe consequences. Therefore, the distribution IoT requires reliable security mechanisms to identify and block malicious attacks, and intrusion prevention systems are a crucial component of this.

[0068] Machine learning, since its inception in the 1950s, has developed rapidly and been widely applied in various fields, including cybersecurity. The latest trend in machine learning is to extract useful, previously undiscovered knowledge from massive amounts of data in big data environments. Based on the characteristics of machine learning, intrusion detection systems can quickly identify abnormal traffic within large volumes of network traffic and automatically match the anomaly to the type of network attack, thereby triggering appropriate alerts and preventative measures.

[0069] This embodiment proposes an intelligent proactive intrusion prevention mechanism based on trust metrics. In this mechanism, multi-dimensional communication data is acquired through various traffic detectors. After data preprocessing, multi-dimensional network trust metrics are used to assess terminal security. A feature annotation method combining trust metrics is designed, and a machine learning classification algorithm based on an improved sparrow search algorithm is used to detect malicious behavior. Malicious behavior will trigger an alert, and fine-grained trust metrics will be performed to isolate malicious terminals and control the scope of impact, achieving proactive detection, response, and isolation.

[0070] The intrusion detection method described in this embodiment works by capturing the incoming and outgoing traffic of the protected network, preprocessing the data, using machine learning to implement intrusion detection technology, and finally responding to malicious behavior to achieve proactive defense.

[0071] Based on the principles described above, please refer to... Figure 1 As shown, a proactive intrusion prevention method includes the following steps:

[0072] S1. Obtain the preprocessed network data;

[0073] In S1, network data refers to information carried by traffic packets in the network. This information is transmitted between two or more devices. A network detector parses the traffic packets to obtain the information encapsulated within them.

[0074] The purpose of preprocessing in S1 is to prevent attributes with small value ranges from losing meaning due to being overwritten. The preprocessing process specifically includes:

[0075] Normalize the raw network data;

[0076] The non-numerical data in the normalized original network data is encoded into a vector;

[0077] The network data is obtained by extracting attributes using a parsing tool.

[0078] The above normalization uses the packet count attribute as an example. Assuming there are a total of n data entries, this embodiment uses the min-max method for normalization:

[0079]

[0080] x i Let x represent the i-th data value, where 1 ≤ i ≤ n. min Let x represent the minimum value among n data points. max Let x' represent the largest value among n data points. i This represents the normalized value.

[0081] In this embodiment, the above encoding uses one-hot encoding to encode non-numerical data in network data into vectors. Taking application layer services as an example, if there are a total of 5 types including HTTP, DNS, SMTP, FTP, and SSH, the attribute value is encoded into a 5-bit vector, with each bit representing a protocol, and converted into the corresponding identity matrix.

[0082] The aforementioned attribute extraction can be achieved using parsing tools. For example, Netflow, Suricata, and Snort can be used to parse traffic packets at multiple levels and dimensions. Netflow is a network traffic parser used to monitor network communication; it allows parsing of traffic packets based on their inherent characteristics. Suricata is a network intrusion detection system; it can parse traffic packets from the perspective of malicious traffic characteristics. Snort is an intrusion detection system that uses a rule-driven language; it can also help us parse malicious traffic characteristics. These three traffic capture tools each have their own characteristics, improving the comprehensiveness of the captured data dimensions.

[0083] Please refer to Table 1.1. The Netflow analysis tool focuses on parsing network traffic characteristics, while Snort and Suricata are mainly used to analyze malicious traffic characteristics. Alarm logs are a core element. Research has found that directly using the address attribute (ip), port attribute (port), time attribute (time), and application service attribute (service) in Netflow and Suricata for attack type identification is ineffective. To improve identification results, it is necessary to use statistical methods to generate network connection attributes.

[0084] Table 1.1 Network Connection Attributes

[0085]

[0086] The remaining attributes from the basic attributes of each detector, as well as the newly generated core attributes such as network connectivity attributes, are input into the network trust measurement algorithm to determine the network status.

[0087] S2. Perform multi-dimensional traffic data parsing on the network data to obtain the network data labeled with network status credibility measurement results and measurement labels for each sub-dimension;

[0088] Please refer to Figure 2 As shown, S2 specifically includes:

[0089] S21. Verify the key network parameters in the network data;

[0090] The specific process of parameter verification is a conventional technical method, and will not be described in detail in this embodiment.

[0091] S22. Calculate the success rate of trusted interactions between nodes in the network data;

[0092] The calculation of the success rate of trusted interaction in S22 satisfies:

[0093]

[0094] in, It represents the number of failed interactions by the terminal node within the most recent time interval Δt. This represents the total number of interactions within the most recent time interval Δt. Trusted interaction status prioritizes recent interaction performance, resulting in the node's trusted interaction success rate. A higher failure rate indicates a lower trusted interaction success rate.

[0095] S23. Calculate the network transmission status of the node and perform a reliability measurement. The network transmission status includes: data transmission latency, data transmission duplication rate, and data transmission forwarding rate.

[0096] Data transmission latency is calculated because of the complexity of the power distribution IoT deployment environment and the limited node resources. Communication between IoT nodes can tolerate a certain range of latency; if the latency exceeds this range, it decreases over time. The node latency measurement function is shown in the following formula:

[0097]

[0098] Where t is the time elapsed after the node sends the transmission request, T thresholdThis represents the maximum latency within the normal range during node transmission. Since network routing and channel transmission both require time, and network transmission stability fluctuates, a node's latency is considered normal when the transmission latency is less than a predetermined threshold. When the transmission latency exceeds the predetermined threshold, the latency metric decreases rapidly as transmission time increases.

[0099] The purpose of calculating the data transmission repetition rate is to address the fact that attacked IoT nodes may repeatedly send the same information, such as a controlled bot node repeatedly sending the same request to launch a DDoS attack. Therefore, the data transmission repetition rate is also an important indicator for measuring the trustworthiness of a node. The trustworthiness measurement function for the data transmission repetition rate of a node is shown in the following formula:

[0100]

[0101] Here, R represents the data transmission duplication rate of a node within the evaluation period ΔT. Because duplicate requests may occur during connection establishment between nodes, and the data sent or forwarded may also be duplicated, a data forwarding duplication rate threshold R0 is set. When the data transmission duplication rate is lower than the set threshold, a reliable duplication rate metric for the node is obtained based on the metric function. When the data transmission duplication rate is higher than the set threshold, it can be considered to be under attack or hijacked, therefore its metric value is set to 0. λ0 is a control parameter, where λ0 > 1.

[0102] When IoT nodes are attacked by malicious nodes, abnormal situations such as data tampering, data theft, and data injection may occur. Therefore, the network transmission status measurement in this embodiment also includes a reliable measurement of data transmission forwarding rate.

[0103] Data forwarding anomalies encompass two aspects: data over-transmission (transmitting more data than requested) and data under-transmission (transmitting less data than requested). If either over-transmission or under-transmission is significant, both constitute data transmission anomalies. The reliable measurement function for a node's data transmission forwarding rate is shown in the following formula:

[0104]

[0105] Among them, Data req Data is the amount of data that the management node requests the end node to send. send λ1 represents the actual amount of data sent. If the actual amount of data sent is significantly greater than or significantly less than the requested amount of data, the node is considered to be in an abnormal state. Therefore, trust metrics are established for these two scenarios to enable the management node to promptly identify nodes that are maliciously idling or injecting malicious data. λ1 and λ2 are control parameters.

[0106] S24. Based on the network transmission state metric trust measurement results, calculate the trust value, satisfying:

[0107] Among them, T trans For reliable values, f is the weight parameter. delay f is a reliable measure of data transmission latency. dup f is a reliable measure of data transmission repetition rate. relay A reliable measure of data transmission forwarding rate;

[0108] The weight parameters mentioned above can be set to

[0109] S25. Based on the aforementioned trust value, perform a network state trust measurement to satisfy:

[0110] Among them, T net CHECK(ID, IP, MAC) is a verification function used to measure network state reliability. and T is the weight parameter. trans This is a reliable value.

[0111] S25 first checks if the key network parameters are correct. If incorrect, the node's network state is directly considered untrustworthy. If the key network parameters are correct, the node's network state metric function is obtained by combining the trusted interaction success rate and the transmission state trust metric. Please refer to the relevant formulas in S25 for the function. The weight parameters can be set to...

[0112] The comprehensive network state reliability metric and the metrics of each sub-dimension are labeled in the original data and input into the active defense algorithm, i.e., the subsequent machine learning classification algorithm, to improve the accuracy of malicious behavior identification. Because the computing power of power sensing nodes in the distribution IoT is limited, malicious programs often exploit the vulnerabilities of sensing layer nodes to launch attacks and spread between power sensing nodes, causing abnormal network behavior or network parameters. The method described in this embodiment uses multi-dimensional network state reliability metrics to preprocess traffic data, improve identification accuracy, and enhance the training effect of the algorithm.

[0113] It should be noted that the parsing tools and encoding methods used above are merely examples of this embodiment. In actual processing, relevant tools or methods can be selected according to requirements, and are not limited to the processing process described above.

[0114] S3. Calculate the labeled network data using a machine learning classification algorithm to obtain the feature behavior classification of the network data;

[0115] In this embodiment, a support vector machine based on an improved sparrow search algorithm is used to classify feature behaviors, detect intrusion behaviors, and respond accordingly, achieving proactive defense. Data is the source of intrusion detection for machine learning algorithms. Trusted labeled data achieved through multi-dimensional comprehensive network state metrics helps machine learning algorithms more accurately identify malicious behaviors. Improved machine learning algorithms reduce the probability of local convergence. Based on the results of intrusion detection, this mechanism will promptly isolate malicious nodes and block the spread of malicious programs by providing feedback and updating security policies, thus achieving proactive defense.

[0116] Specifically, the Sparrow Search algorithm possesses better search capabilities than Particle Swarm Optimization (PSO) and Grey Wolf Optimization (GSO), but it still suffers from slow running speed and susceptibility to local convergence. Therefore, this embodiment uses chaotic mapping and random walks to improve the Sparrow Search Algorithm (SSA), enhancing its search and exploration capabilities, thereby achieving better global optimization.

[0117] The Logistic map is a typical example of a chaotic map, and its expression is as follows:

[0118] y n (t+1)=by n (t)(1-y n (t)), where, where, y n ∈[0,1], t is the current iteration number, and b is the control parameter. The larger the control parameter b, the more uniform the mapping distribution. In this embodiment, b is set to 4, at which point the system is in a completely chaotic state, and the mapping distribution is most uniform. Initial condition y n The sequence generated under the Logistic mapping is aperiodic and non-convergent, but outside the range [0,1], the generated sequence will converge to a certain specific value.

[0119] The core concept of random walks is that the conserved quantities carried by each of the random walkers correspond to a diffusion transport law, similar to Brownian motion, representing an ideal mathematical state of Brownian motion. The process of a random walk can be mathematically represented as:

[0120] B(t)=[0, cumsum(2r(t1)-1),..., cumsum(2r(t) n )-1)], where B(t) is the set of steps for the random walk, cumsum is the cumulative sum, t is the maximum number of iterations taken during the random walk calculation, and r(t) is a random function that satisfies:

[0121]

[0122] However, because the feasible region in the algorithm has boundaries, the above formula cannot be used directly to calculate the sparrow's position. Furthermore, the sparrow's random walk needs to remain within the feasible region of the algorithm, requiring appropriate normalization.

[0123] Among them, a i b is the minimum value of the random walk of the i-th dimension sparrow; i It is the maximum value of the random walk of the i-th dimension sparrow; It is the minimum value of the i-th dimension sparrow in the t-th iteration; It is the maximum value of the i-th dimension sparrow in the t-th iteration.

[0124] The improved algorithm described above mainly consists of two stages: First, during population initialization, a Logistic mapping is used to initialize the population; then, after the sparrow search, a random walk is used to perturb the optimal sparrow, improving its search performance. At the beginning of the iterations, the boundary of the random walk is relatively large, which is beneficial for improving the global search performance; after multiple iterations, the walk boundary becomes smaller, improving the algorithm's local search performance for the optimal position. The algorithm flow can be found in [reference needed]. Figure 3 As shown:

[0125] Assumption Let represent the position of the i-th sparrow in the t-th generation of the population in the d-th dimension. T is the maximum number of iterations. α is a random number between (0, 1]. Γ is a random number following a standard normal distribution. L represents an i×d matrix with all elements being 1. R∈[0, 1] and ST∈[0.5, 1] ​​represent the warning value and the safety value, respectively. This represents the worst position of the sparrow in the d-th dimension during the t-th iteration. Let A represent the optimal position of the sparrow in the d-th dimension at the (t+1)-th iteration of the population. Let A be a single-row multidimensional matrix with each element being 1 or -1, and A... + =A T (AA T ) -1 . This is the current globally optimal position. β represents the step size control parameter. K is a random number between [-1, 1], representing the sparrow's movement direction. δ is a very small constant to avoid the denominator being zero; f i f represents the fitness value of the i-th sparrow. g and f w These are the best and worst fitness values ​​for the current sparrow population, respectively. The improved sparrow search algorithm is as follows:

[0126] Input: Sparrow population Population fitness function fn = Fitness(X) i ), threshold fn 0

[0127] Output: Optimal individual X(fn)

[0128] 1. Initialize the population using a logistic mapping strategy, and initialize the predator-follower ratio;

[0129] 2. Calculate fitness value And sort;

[0130] 3. / / Sparrow updates the location of the discoverer;

[0131] 4. Formula 2 / / Sparrow updates follower positions;

[0132] 5. Formula 3 / / Sparrow updates the position of the watchman;

[0133] 6. Calculate fitness value And update the sparrow's location;

[0134] 7. Update the optimal sparrow using a random walk B(t);

[0135] 8. Calculate fitness value And update the sparrow's location;

[0136] 9. Does the stopping condition fn > fn satisfy? 0 If the condition is met, exit and output the result X(fn); otherwise, repeat Step 2-8.

[0137] The machine learning classification algorithm in S3 includes the following steps:

[0138] Initialize the population and search area: Set the population size to 20-40 and the dimension to 2, which are the two parameters: the penalty factor C and the kernel function parameter g, and set the upper and lower boundaries of the search range;

[0139] The fitness function of the algorithm is set. In this embodiment, it is designed to be the minimum error rate of the training set in order to obtain the best training and testing results. First, the accuracy is defined, and the formula is as follows:

[0140]

[0141] The four elements are: True Positive (TP): the number of normal samples classified as normal traffic; False Negative (FN): the number of abnormal samples classified as abnormal traffic; False Positive (FP): the number of normal samples classified as abnormal traffic (false positives); and True Negative (TN): the number of abnormal samples classified as normal traffic (false negatives).

[0142] The fitness function is defined as follows:

[0143] Fitness = min(1-Accuracy), where Accuracy is the accuracy.

[0144] Within the maximum number of iterations, the fitness function value of each sparrow is continuously updated to determine the sparrow with the optimal fitness value, and its position parameters are obtained. The optimal penalty factor C and kernel function parameter g are then output.

[0145] S4. Based on the classification results, detect suspicious nodes through fine-grained real-time measurement and update the security policy.

[0146] The principle behind S4 is that abnormal behavior or nodes detected by machine learning-based intrusion detection algorithms are reported to the management node in real time. The management node then uses fine-grained real-time measurements to investigate suspicious nodes. Simultaneously, endpoint nodes automatically update their security policies to help other nodes defend against new threats.

[0147] Anomaly nodes detected by the intrusion detection algorithm are reported to the management node. The management node performs fine-grained real-time measurements on these anomaly nodes. The management node allows them to join the IoT system with restrictions and lists them as nodes to be observed. The management node periodically performs fine-grained trust assessments on these nodes, the specific process of which is as follows:

[0148] The management node performs a trustworthiness assessment on the node to be observed every Δt time interval, where ΔT = n. t Δt, n t To control the granularity of the evaluation parameters, the management node analyzes and calculates the interaction status of the terminal nodes within a time interval Δt, obtaining the fine-grained transmission state reliability value of the nodes. and interaction trust value Then calculate the instantaneous trust metric value of the terminal node. The calculation process is shown in the following formula:

[0149]

[0150] Where μ1 and μ2 are weight parameters, μ1 + μ2 = 1, which is the default setting. Management node sets instant trust threshold If the instantaneous trust value of the terminal node If a node is considered to have positive interactions with other nodes during that time period, then it is considered to have either been slacking off or engaging in malicious interactions.

[0151] Trustworthiness assessment of the observed node: Within one evaluation period ΔT, the management node evaluates the observed node and obtains n.t An instantaneous trust metric. The management node calculates the comprehensive trust metric value of the node to be observed over the observation and evaluation period ΔT, as shown in the following formula:

[0152]

[0153] Management node determination Is it greater than the threshold T? dm ,like If the node under observation is considered safe and trustworthy, it is allowed to join the trusted group as a normal node; if If the node to be observed does not meet the requirements of this domain, it will be rejected from joining the trusted group.

[0154] Furthermore, S4 also includes an adaptive proactive immune security strategy. Specifically, in the distribution IoT, there are numerous security threats, which can be categorized as follows: 1. Physical attacks, 2. Denial-of-service attacks, 3. Attacks targeting node identities, 4. Privacy data theft, etc. Assuming the security threats existing in the network are represented by vectors... It means that n t This represents the number of major security threats facing the system. Security policies can be represented by a quadruple (S, TR, I, O). S assesses the security threat situation of a node. S is calculated as follows:

[0155]

[0156] Pr(st i ) represents the probability of facing each threat. f is a function for calculating the degree of security threat faced by a node.

[0157] Security strategies include: assessing the security threats to nodes and implementing security mechanisms based on the level of security threats.

[0158] TR refers to the security mechanisms adopted based on the level of security threat, including the selection of important security parameters or functions, specifically the node trust assessment period ΔT, the real-time assessment fine-grainedness Δt, and the node trust self-test function. I represents the input information, and O represents the expected output of the node. Specifically, environmental data is acquired as input, and the digital quantity after digital-to-analog conversion is used as output. The description of the expected output of the node determines whether the node is trustworthy. The security and trustworthiness of the terminal node essentially means that the calculation result meets the user's expectations. If the node output meets the expectations, it is considered trustworthy.

[0159] In the Internet of Things (IoT) for power distribution, the network environment is complex and ever-changing, the inputs of terminal sensing nodes are highly variable, and the operation of sensing nodes is subject to significant uncertainty. This makes it difficult to quantify and determine whether the output of a terminal node at a given moment meets expectations. To address this issue, this embodiment references predictive control theory to control the input and output (I and O) of the sensing nodes and makes adaptive adjustments. The process can be described as follows:

[0160]

[0161] y(t), u(t), and Δv(t) represent the output, input, and front-feedback measurable disturbance of the controlled object at time t, respectively. The y(t) and u(t) of the terminal node are the manifestations of the output control strategy and input control strategy in the security policy. Δ = 1 - z -1 , represents the difference operator. As these are controlled parameters, they need to be identified and obtained online.

[0162] S4 also includes updating security policies. Specifically, since end nodes face constantly emerging threats, security policies must be able to respond synchronously to new security threats. Furthermore, when a sensing node detects a new threat, it must not only update its own security policy but also issue a timely warning, ensuring that all nodes in the sensing network can update their security policies to address new threats.

[0163] Assuming the formal description of the new security threat behavior is SA, for the security policy description quadruple (S, TR, I, O) of the sensing node, its security threat probability Pr needs to be adjusted. Let the security threat probability correction function be mf(Pr, SA), and simultaneously recalculate SI based on the new security threat probability. Also, modify TR, I, and O. The security threat warning and policy update process is as follows:

[0164] 1. The terminal node will encrypt the SA and send it to the nearest terminal node.

[0165] 2. The terminal node calculates mf(Pr, SA) based on Pr and SA.

[0166] 3. The sensing node recalculates SI (Security Policy Description Quadruple (S, TR, I, O)) based on mf(Pr, SA).

[0167] 4. The sensing node updates TR, I, and O according to SI, ultimately realizing the update of the security policy.

[0168] Example 2

[0169] Example 2 discloses a device corresponding to the active intrusion prevention method of the above embodiments, which is a virtual device structure of the above embodiments. Please refer to... Figure 4 As shown, it includes:

[0170] Data acquisition module 210 is used to acquire preprocessed network data;

[0171] The threat analysis module 220 is used to perform multi-dimensional traffic data parsing on the network data to obtain the network data labeled with network status trust measurement results and measurement labels for each sub-dimension; and to calculate the characteristic behavior classification of the network data by using a machine learning classification algorithm.

[0172] The policy update module 230 is used to detect suspicious nodes and update the security policy based on the classification results through fine-grained real-time measurement.

[0173] Preferably, the preprocessing includes:

[0174] Normalize the raw network data;

[0175] The non-numerical data in the normalized original network data is encoded into a vector;

[0176] The network data is obtained by extracting attributes using a parsing tool.

[0177] Preferably, the network data undergoes multi-dimensional traffic data parsing, including:

[0178] Verify the key network parameters in the network data;

[0179] Calculate the success rate of trusted interactions between nodes in the network data;

[0180] The network transmission status of the calculation node is measured and a reliability metric is performed. The network transmission status includes: data transmission latency, data transmission duplication rate, and data transmission forwarding rate.

[0181] Based on the network transmission state metric trust measurement results, calculate the trust value, satisfying:

[0182] Among them, T trans For reliable values, f is the weight parameter. delay f is a reliable measure of data transmission latency. dup f is a reliable measure of data transmission repetition rate. relay A reliable measure of data transmission forwarding rate;

[0183] Based on the aforementioned confidence value, a network state confidence measurement is performed, satisfying the following:

[0184] Among them, T netCHECK(ID, IP, MAC) is a verification function used to measure network state reliability. and T is the weight parameter. trans This is a reliable value.

[0185] Preferably, the machine learning classification algorithm is a classification algorithm based on the sparrow search algorithm.

[0186] Preferably, the machine learning classification algorithm includes the following steps:

[0187] Initialize the population and search area;

[0188] The fitness function value of each sparrow is continuously updated within the number of iterations to obtain the sparrow with the optimal fitness value. The fitness function satisfies:

[0189] Fitness = min(1-Accuracy), where Accuracy is the accuracy.

[0190] Preferably, updating the security policy includes:

[0191] Send the formal description (SA) of the security threat behavior to the nearest endpoint;

[0192] The security threat probability correction function mf(Pr,SA) is calculated based on the security threat probability Pr and the formal description SA.

[0193] Recalculate SI based on the correction function mf(Pr,SA);

[0194] Update the data based on the SI to complete the security policy update.

[0195] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause an electronic device (which may be a mobile phone, personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0196] It is worth noting that in the above embodiments of the active intrusion prevention method device, the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional unit are only for easy differentiation and are not used to limit the scope of protection of the present invention.

[0197] For those skilled in the art, various other corresponding changes and modifications can be made based on the technical solutions and concepts described above, and all such changes and modifications should fall within the protection scope of the claims of this invention.

Claims

1. A proactive intrusion prevention method, characterized in that, Includes the following steps: Obtain preprocessed network data; The network data is parsed using multi-dimensional traffic data analysis to obtain the network data labeled with network status reliability measurement results and measurement labels for each sub-dimension; The network data is subjected to multi-dimensional traffic data analysis, including: Verify the key network parameters in the network data; Calculate the trusted interaction success rate of nodes in the network data; the calculation of the trusted interaction success rate satisfies: in, Indicates the success rate of trusted interactions. Is the terminal node in the most recent The number of failed interactions within a given time period. For the most recent Total number of interactions within a given time period; The network transmission status of the calculation node is measured and a reliability metric is performed. The network transmission status includes: data transmission latency, data transmission duplication rate, and data transmission forwarding rate. Based on the network transmission state metric trust measurement results, calculate the trust value, satisfying: ,in, For reliable values, For weight parameters, As a reliable measure of data transmission latency, As a reliable measure of data transmission repetition rate, A reliable measure of data transmission forwarding rate; The node's latency metric satisfies: When the transmission delay is less than a predetermined threshold, the node's delay status is within the normal range; when the transmission delay is greater than the predetermined threshold, the transmission time increases and the delay status metric decreases. The reliability metric function for data transmission repetition rate of a node is shown in the following formula: For nodes in the evaluation period Data transmission repetition rate within a time period The threshold for data forwarding duplication rate. For control parameters, ; The reliable metric function for a node's data transmission forwarding rate is shown in the following formula: The amount of data the management node requests the terminal nodes to send. This represents the actual amount of data sent. and For control parameters; Based on the aforementioned confidence value, a network state confidence measurement is performed, satisfying the following: ,in, As a measure of network state reliability, For verification function, and For weight parameters, A reliable value; The labeled network data is processed using a machine learning classification algorithm to obtain a feature behavior classification of the network data. Based on the classification results, suspicious nodes are detected using fine-grained real-time metrics, and the security policy is updated accordingly. The detection of suspicious nodes using fine-grained real-time metrics includes: Perform fine-grained real-time measurements to meet the following requirements: ,in, and For weight parameters, A reliable value; To determine the reliability of the node to be observed, the following conditions must be met: ,when If the node is deemed safe and trustworthy, then the node to be observed is considered safe and trustworthy; otherwise, the node to be observed is considered untrustworthy. Indicates an evaluation cycle; Indicates a time interval; Parameters for controlling the level of detail in the evaluation; Represents the immediate trust value of the terminal node; Indicates the instantaneous reliability threshold; This represents a fine-grained reliability value for the transmission status of a node. Indicates the trust value of the interaction; Indicates the overall confidence threshold; Indicates the evaluation period The comprehensive credibility metric within.

2. The active intrusion prevention method as described in claim 1, characterized in that, The preprocessing includes: Normalize the raw network data; The non-numerical data in the normalized original network data is encoded into a vector; The network data is obtained by extracting attributes using a parsing tool.

3. The active intrusion prevention method as described in claim 1, characterized in that, The machine learning classification algorithm is a classification algorithm based on the sparrow search algorithm.

4. The active intrusion prevention method as described in claim 3, characterized in that, The sparrow search classification algorithm is an improved sparrow search algorithm that introduces chaotic mapping and random walk. The chaotic mapping is used to update the sparrow position, and the random walk is used to update the optimal sparrow. When initializing the population, the sparrow search algorithm uses a chaotic mapping to initialize the population, and the expression of the chaotic mapping satisfies: ， Among them, among them, , This represents the current iteration number. For control parameters; The sparrow search algorithm is perturbed by a random walk to update the optimal sparrow. The random walk satisfies the following formula: ,in, Given the set of steps for a random walk. To calculate the cumulative sum, The maximum number of iterations is taken during random walk computation. Let be a random function, satisfying: ； After random walk computation and normalization, the following conditions are met: ,in, It is the first The minimum value of a random walk by a sparrow; It is the first The maximum value of a sparrow's random walk; It is the first The sparrow in the first The minimum value in the nth iteration; It is the first The sparrow in the first Maximum value in the second iteration.

5. The active intrusion prevention method as described in claim 3 or 4, characterized in that, Machine learning classification algorithms include the following steps: Initialize the population and search area; The fitness function value of each sparrow is continuously updated within the number of iterations to obtain the sparrow with the optimal fitness value. The fitness function satisfies: ,in, For accuracy.

6. The active intrusion prevention method as described in claim 1, characterized in that, The security strategy is an adaptive proactive immune security strategy, which includes: assessing the security threat situation of nodes and taking security mechanisms based on the level of security threat; The security threat status of the assessment node satisfies: ,in, The results of the security threat assessment for the node. This represents the probability of facing each threat. It is a function for calculating the degree of security threat faced by a node. Represents a security threat vector. The number of major security threats faced by the system; The security mechanism includes: node trust assessment cycle. Real-time evaluation of fine granularity Node trust self-test function; The security mechanism also includes: controlling the input and output of the sensing node according to predictive control theory to satisfy: ,in, , , These represent the output, input, and forward feedback measurable disturbance of the controlled object at time t, respectively. , represents the difference operator, , , These are controlled parameters.

7. The active intrusion prevention method as described in claim 1 or 6, characterized in that, Update security policies, including: Formal description of security threat behavior Send to the nearest terminal node; Based on security threat probability and formal description Calculate the security threat probability correction function ; According to the correction function Recalculate the security policy; according to Update the data and complete the security policy update.

8. An active intrusion prevention device, characterized in that, It includes: The data acquisition module is used to acquire preprocessed network data; The threat analysis module is used to perform multi-dimensional traffic data parsing on the network data to obtain the network data labeled with network status trust measurement results and measurement labels for each sub-dimension; The labeled network data is then analyzed using a machine learning classification algorithm to obtain a feature behavior classification of the network data. The network data is subjected to multi-dimensional traffic data analysis, including: Verify the key network parameters in the network data; Calculate the trusted interaction success rate of nodes in the network data; the calculation of the trusted interaction success rate satisfies: in, Indicates the success rate of trusted interactions. Is the terminal node in the most recent The number of failed interactions within a given time period. For the most recent Total number of interactions within a given time period; The network transmission status of the calculation node is measured and a reliability metric is performed. The network transmission status includes: data transmission latency, data transmission duplication rate, and data transmission forwarding rate. Based on the network transmission state metric trust measurement results, calculate the trust value, satisfying: ,in, For reliable values, For weight parameters, As a reliable measure of data transmission latency, As a reliable measure of data transmission repetition rate, A reliable measure of data transmission forwarding rate; The node's latency metric satisfies: When the transmission delay is less than a predetermined threshold, the node's delay status is within the normal range; when the transmission delay exceeds the predetermined threshold, the transmission time increases, and the delay status metric decreases. The reliable metric function for the node's data transmission repetition rate is shown in the following formula: For nodes in the evaluation period Data transmission repetition rate within a time period The threshold for data forwarding duplication rate. For control parameters, ; The reliable metric function for a node's data transmission forwarding rate is shown in the following formula: The amount of data the management node requests the terminal nodes to send. This represents the actual amount of data sent. and For control parameters; Based on the aforementioned confidence value, a network state confidence measurement is performed, satisfying the following: ,in, As a measure of network state reliability, For verification function, and For weight parameters, A reliable value; The labeled network data is processed using a machine learning classification algorithm to obtain a feature behavior classification of the network data. The policy update module is used to detect suspicious nodes based on the classification results using fine-grained real-time metrics and update the security policy; the detection of suspicious nodes using fine-grained real-time metrics includes: Perform fine-grained real-time measurements to meet the following requirements: ,in, and For weight parameters, A reliable value; To determine the reliability of the node to be observed, the following conditions must be met: ,when If the node is deemed safe and trustworthy, then the node to be observed is considered safe and trustworthy; otherwise, the node to be observed is considered untrustworthy. Indicates an evaluation cycle; Indicates a time interval; Parameters for controlling the level of detail in the evaluation; Represents the immediate trust value of the terminal node; Indicates the instantaneous reliability threshold; This represents a fine-grained reliability value for the transmission status of a node. Indicates the trust value of the interaction; Indicates the overall confidence threshold; Indicates the evaluation period The comprehensive credibility metric within.

Images