A method, apparatus, device, and storage medium for detecting network attack risks.

Abstract

The present invention discloses a risk detection method, device, equipment and storage medium for network attacks. The method includes: in this embodiment, the first mutation weight of the enterprise being attacked by the network is calculated based on the business information and network traffic data of the enterprise when adding new business, and the second mutation weight of the enterprise being attacked by the network is calculated based on the application information and network traffic data of the enterprise when upgrading the application program, so as to merge the first mutation weight and the second mutation weight into the mutation level of the enterprise being attacked by the network, input the network traffic data into the sequence feature structure to extract the time series features, and obtain the traffic time series features; input the traffic time series features into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future. Improve the accuracy of predicting the risk of the enterprise being attacked by the network in the future, reduce the problems of underreporting and false reporting, and improve the network security of the enterprise.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method, device, equipment and storage medium for risk detection of network attacks. Background Art

[0002] With the vigorous development of network technology, the scale of the network is expanding. Software Defined Network (SDN) is widely used in different enterprises. SDN decouples data transmission and network control from each other, separates the control plane from the data plane, thereby removing the control function from the network equipment and logically realizing centralized control and management of the network.

[0003] In SDN, DDoS (Distributed Denial of Service attack) is a common network attack. Attackers control a large number of hosts to generate a large amount of illegal traffic to exhaust SDN resources, causing network delays and data packet loss.

[0004] Currently, most methods of protecting against DDoS and other network attacks use machine learning models or deep learning models to mine the regularity of historical traffic data in order to predict the risk of enterprises being subjected to DDoS and other network attacks in the future.

[0005] However, the regularity of an enterprise's traffic data is weak, which makes it difficult to accurately predict the risk of the enterprise suffering from network attacks such as DDoS in the future. This makes it easy for problems such as missed reports and false reports to occur, resulting in low network security for the enterprise. Summary of the invention

[0006] The present invention provides a network attack risk detection method, device, equipment and storage medium to solve the problem of how to improve the accuracy of detecting the risk of an enterprise being subjected to a network attack in the future.

[0007] According to one aspect of the present invention, a method for detecting a risk of a network attack is provided, comprising:

[0008] Query the business information of enterprises when adding new businesses, application information when upgrading applications, and network traffic data in multiple time periods;

[0009] Calculating a first mutation weight of the enterprise being attacked by a network according to the business information and the network traffic data;

[0010] Calculating a second mutation weight of the enterprise being attacked by the network according to the application information and the network traffic data;

[0011] Merging the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by a network;

[0012] Loading a risk detection network, wherein the risk detection network has a sequence feature structure and a plurality of detection branch structures trained for mutation levels;

[0013] Input the network traffic data into the sequence feature structure to extract the time series features to obtain traffic time series features;

[0014] The traffic time series characteristics are input into the detection branch structure corresponding to the mutation level of the network attack on the enterprise to detect the risk level of the enterprise being attacked by the network in the future.

[0015] According to another aspect of the present invention, there is provided a risk detection device for network attacks, comprising:

[0016] The enterprise information query module is used to query the business information of the enterprise when adding new business, the application information when upgrading the application program, and the network traffic data in multiple time periods;

[0017] A first mutation weight calculation module, used to calculate a first mutation weight of the enterprise being attacked by a network according to the business information and the network traffic data;

[0018] A second mutation weight calculation module, used to calculate a second mutation weight of the enterprise being attacked by the network according to the application information and the network traffic data;

[0019] A mutation level fusion module, used for fusing the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by the network;

[0020] A risk detection network loading module, used to load a risk detection network, wherein the risk detection network has a sequence feature structure and a plurality of detection branch structures trained for mutation levels;

[0021] A traffic time series feature extraction module, used for inputting the network traffic data into the sequence feature structure to extract the time series features and obtain traffic time series features;

[0022] The risk level detection module is used to input the traffic timing characteristics into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future.

[0023] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0024] at least one processor; and

[0025] a memory communicatively connected to the at least one processor; wherein,

[0026] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk detection method for network attacks described in any embodiment of the present invention.

[0027] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the risk detection method for network attacks described in any embodiment of the present invention when executed.

[0028] In this embodiment, the first mutation weight of the enterprise being attacked by a network is calculated based on the business information and network traffic data when the enterprise adds a new business, and the second mutation weight of the enterprise being attacked by a network is calculated based on the application information and network traffic data when the enterprise upgrades the application. The first mutation weight and the second mutation weight are thereby merged into a mutation level of the enterprise being attacked by a network, and the network traffic data is input into a sequence feature structure to extract time series features to obtain traffic time series features; the traffic time series features are input into a detection branch structure corresponding to the mutation level of the enterprise being attacked by a network to detect the risk level of the enterprise being attacked by a network in the future. On the one hand, the sequence feature structure provides common features, treating different risk levels as a whole, and does not distinguish between different risk levels. The features converge to the range of shallow features, which can reduce the workload of the detection branch structure and improve the accuracy of the detection branch structure classification. On the other hand, multiple detection branch structures are externally connected on the basis of the sequence feature structure. The network traffic at different risk levels varies greatly. The detection branch structure is mainly concerned with the fluctuations caused by the risk level and does not care about the underlying features. The complexity of its structure is less than that of a complete model. It can not only distinguish the classification at different risk levels and meet the business needs of risk detection, but also improve the accuracy of predicting the risk of future network attacks on enterprises, reduce problems such as underreporting and false alarms, and improve the network security of enterprises. It can also reduce the amount of calculation and reduce the use of resources.

[0029] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 is a flow chart of a network attack risk detection method provided according to Embodiment 1 of the present invention;

[0032] Figure 2 is a schematic diagram of the structure of a risk detection network provided according to the first embodiment of the present invention;

[0033] Figure 3 This is a schematic diagram of the structure of a network attack risk detection device provided according to Embodiment 2 of the present invention;

[0034] Figure 4 It is a structural schematic diagram of an electronic device provided according to Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can cover sequential implementations other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Embodiment 1

[0038] Figure 1 A flowchart of a method for detecting a risk of a network attack provided in the first embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes:

[0039] Step 101: query the business information of the enterprise when a new business is added, the application information when the application is upgraded, and the network traffic data in multiple time periods.

[0040] For an enterprise, it usually provides various services to users and / or merchants, such as search services, e-commerce services, online car-hailing services, instant messaging services, etc. These enterprises usually develop APPs (applications) for Android, iOS, HarmonyOS, Windows and other platforms for users and / or merchants to use, so that users and / or merchants can obtain the services provided by the enterprise.

[0041] In the course of operation, enterprises usually adjust their businesses. They may stop certain businesses, change the content of certain businesses, or add certain businesses. For example, an enterprise provides users with instant delivery services for online shopping. After the enterprise sets up a new warehouse, it adds instant delivery services for online shopping in the area where the warehouse is located.

[0042] In addition, the application will be continuously upgraded due to factors such as fixing bugs, improving functions, adapting to hardware, and improving user experience.

[0043] According to the statistics of the historical log files of the enterprise system, when the enterprise adds new business, upgrades application programs, etc., its system will be significantly more susceptible to network attacks such as DDoS. Therefore, in this embodiment, the enterprise's system can be queried for business information (such as business ID, timestamp, business output value, etc.) when adding new business, application information (such as application ID, application version number, timestamp, download volume, etc.) when upgrading application programs, and network traffic data within multiple time periods (such as one day, one week, etc.) in the past period of time (such as the past 3 months).

[0044] Among them, the business output value is the estimated output value of the company's new business, and the download volume is the sum of the number of times the application is downloaded from various channels (such as official website, application store, etc.).

[0045] Furthermore, for network traffic data, machine learning or deep learning can be used to analyze whether it has been subjected to network attacks such as DDoS.

[0046] Step 102: Calculate the first mutation weight of the enterprise being attacked by the network based on the business information and network traffic data.

[0047] Compared with the cyber attacks suffered by enterprises in the normal operation process, the cyber attacks suffered by enterprises when adding new businesses are sudden events. The mutation can be described by mutation function. Mutation function refers to a function that changes instantly at a certain point, which is used to describe phenomena with sudden nature.

[0048] In this embodiment, the characteristics of the event that the enterprise's system is attacked by a network when a new business is added can be extracted from the business information and network traffic data, and these characteristics are substituted into the mutation function to calculate the weight of the new business to the enterprise being attacked by the network as the first mutation weight.

[0049] In a specific implementation, the mutation function is a dovetail mutation function, which contains three coefficients.

[0050] Then, the time period of the timestamp in the business information can be queried to obtain the first base point period.

[0051] Taking into account the delay of network attacks, if the network traffic data within I time periods after the first base point period indicates that the enterprise is under a network attack, the business information is marked as the first mutation information, where I is a positive integer, such as 3.

[0052] On the one hand, the number of first mutation information and the number of all business information are counted, so as to calculate the ratio between the number of first mutation information and the number of all business information, and obtain a first proportion of the first mutation information to all business information.

[0053] On the other hand, the first number of times that the enterprise was attacked by a network attack is screened out within I time period after each first mutation information.

[0054] All the first numbers are compared, and the first number with the highest value is selected from all the first numbers to obtain the first peak value.

[0055] On the other hand, the business output value in the first mutation information corresponding to the first peak value is queried.

[0056] The first proportion, the first peak value and the business output value are input as independent variables into the dovetail mutation function for fitting, and the first mutation coefficient, the second mutation coefficient and the third mutation coefficient are obtained; wherein the dovetail mutation function is expressed as:

[0057]

[0058] f(x) is a dovetail mutation function, x is the independent variable, p is the first mutation coefficient, q is the second mutation coefficient, and o is the third mutation coefficient.

[0059] The first mutation base is generated with the first mutation coefficient as the base and 1 / 2 as the exponent, the second mutation base is generated with the second mutation coefficient as the base and 1 / 3 as the exponent, and the third mutation base is generated with the third mutation base as the base and 1 / 4 as the exponent.

[0060] At this time, the first mutation base is expressed as The second mutation base number is expressed as The third mutation base is expressed as

[0061] The reciprocal of the first mutation base, the second mutation base and the third mutation base are linearly (i.e., weighted sum) fused into the first mutation weight of the enterprise under cyber attack.

[0062] The so-called linearity means that the reciprocal of the first mutation base, the second mutation base, and the third mutation base are respectively assigned corresponding fusion weights and then the sum is calculated. Then, the first mutation weight is expressed as follows:

[0063]

[0064] Among them, w1 is the first mutation weight, and α, β and γ are all fusion weights.

[0065] Step 103: Calculate the second mutation weight of the enterprise being attacked by the network based on the application information and the network traffic data.

[0066] Compared with the cyber attacks suffered by enterprises during normal business operations, the cyber attacks suffered by enterprises when upgrading applications are sudden events. Mutations can be described using mutation functions. Mutation functions refer to functions that change instantly at a certain point and are used to describe phenomena with a sudden nature.

[0067] In this embodiment, the characteristics of the event that the enterprise's system suffers a network attack when adding new business can be extracted from the application information and network traffic data, and these characteristics are substituted into the mutation function to calculate the weight of upgrading the application program for the enterprise being attacked by the network as the second mutation weight.

[0068] In a specific implementation, the mutation function is a dovetail mutation function, so the time period of the timestamp in the application information can be queried to obtain the second base point period.

[0069] Taking into account the time delay of network attacks, if the network traffic data within J time periods after the second base point period indicates that the enterprise is under a network attack, the application information is marked as the second mutation information; where J is a positive integer, such as 3.

[0070] On the one hand, the number of second mutation information and the number of all application information are counted, so as to calculate the ratio between the number of second mutation information and the number of all application information, and obtain the second proportion of the second mutation information to all application information.

[0071] On the other hand, the second number of times the enterprise is attacked by the network within J time periods after each second mutation information is screened out.

[0072] All the second-order numbers are compared, and the second-order number with the highest value is screened out from all the second-order numbers to obtain the second peak value.

[0073] On the other hand, the download volume of the application in the time period corresponding to the second peak value is queried.

[0074] The second ratio, the second peak value and the download volume are input as independent variables into the dovetail mutation function for fitting, and the fourth mutation coefficient, the fifth mutation coefficient and the sixth mutation coefficient are obtained; wherein the dovetail mutation function is expressed as:

[0075]

[0076] f(x) is a dovetail mutation function, x is the independent variable, p is the fourth mutation coefficient, q is the fifth mutation coefficient, and o is the sixth mutation coefficient.

[0077] The fourth mutation base is generated with the fourth mutation coefficient as the base and 1 / 2 as the exponent, the fifth mutation base is generated with the fifth mutation coefficient as the base and 1 / 3 as the exponent, and the sixth mutation base is generated with the sixth mutation coefficient as the base and 1 / 4 as the exponent.

[0078] At this time, the fourth mutation base is expressed as The fifth mutation base is expressed as The sixth mutation base is expressed as

[0079] The reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base are linearly fused into the second mutation weight of the enterprise being attacked by a cyber attack.

[0080] The so-called linearity means that the reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base are assigned corresponding fusion weights and then the sum is calculated. Then, the second mutation weight is expressed as follows:

[0081]

[0082] Among them, w2 is the second mutation weight, and α, β and γ are all fusion weights.

[0083] In this embodiment, since the newly added business will prompt the application upgrade to a certain extent, there is a certain correlation between the newly added business and the application upgrade. The first mutation weight of the newly added business for the enterprise being attacked by network attacks and the second mutation weight of the upgraded application for the enterprise being attacked by network attacks are both described using a dovetail mutation function, which is conducive to aligning the relevant features of the newly added business and the application upgrade, and is also conducive to the fusion of the first mutation weight and the second mutation weight.

[0084] Step 104: The first mutation weight and the second mutation weight are merged into a mutation level of the enterprise being attacked by the network.

[0085] In this embodiment, a linear or nonlinear approach can be used to merge the first mutation weight of the new business to the enterprise being attacked by network and the second mutation weight of the upgraded application to the enterprise being attacked by network in the two dimensions of new business and application upgrade into the mutation level of the enterprise being attacked by network, where the mutation level is the degree of comprehensive mutation of the enterprise being attacked by network.

[0086] In the specific implementation, since there is a certain correlation between the new business and the application upgrade, and the cusp mutation function can mine the correlation between the two factors in mutation, the first mutation weight and the second mutation weight can be used as input to fit the cusp mutation function to obtain the seventh mutation coefficient and the eighth mutation coefficient; wherein the cusp mutation function contains two coefficients, which are expressed as:

[0087] f(x)=x 4 +px 2 +qx

[0088] f(x) is a dovetail mutation function, x is the independent variable, p is the eighth mutation coefficient, and q is the ninth mutation coefficient.

[0089] The first mutation factor is generated with the eighth mutation coefficient as the base and 1 / 2 as the exponent, and the second mutation factor is generated with the ninth mutation coefficient as the base and 1 / 3 as the exponent.

[0090] At this time, the first mutation factor is expressed as The second mutation factor is expressed as

[0091] Substitute the first mutation factor and the second mutation factor into the following function for processing to obtain the mutation probability of the enterprise being attacked by the network:

[0092]

[0093] Among them, P is the mutation probability, M1 is the first mutation factor, M2 is the second mutation factor, A and B are constants, α and β are correlation coefficients, γ is the scaling factor, and ω is the fluctuation period.

[0094] In the above function, when (αM1+βM2) reaches a certain value, the mutation probability fluctuates with a certain fluctuation period ω with a weaker regularity to simulate the situation where the enterprise is attacked by a network.

[0095] The mutation probability is mapped to the mutation level of the enterprise under cyber attack using linear and piecewise functions.

[0096] If the mutation level is sorted in order, the mutation level is positively correlated with the mutation probability, that is, the greater the mutation probability, the higher the mutation level of the enterprise being attacked by the network, and conversely, the smaller the mutation probability, the lower the mutation level of the enterprise being attacked by the network.

[0097] Step 105: Load the risk detection network.

[0098] In this embodiment, a risk detection network can be pre-constructed and trained based on deep learning, wherein the risk detection network has a sequence feature structure and multiple detection branch structures trained for mutation levels, and the sequence feature structure and the multiple detection branch structures are in a cascade relationship.

[0099] Among them, the sequence feature structure is responsible for extracting basic features shared by multiple detection branch structures from network traffic data.

[0100] The number of detection branch structures is the same as the number of mutation levels. One detection branch structure is configured for each mutation level. The detection branch structure classifies the network traffic data of the mutation level based on the risk of being attacked by the network.

[0101] In one embodiment of the present invention, the process of training the risk detection network is as follows:

[0102] Step S11: construct a training set for the enterprises used as samples.

[0103] In this embodiment, one or more enterprises may be pre-selected as samples for training the risk detection network, wherein the training set includes network traffic data as samples (including positive samples and negative samples) and risk levels of network attacks as tags.

[0104] In order to increase the amount of sample data, the network traffic data of a certain detection branch that belongs to the positive sample can be set as the negative sample of other detection branch structures.

[0105] Furthermore, the training set is constructed as follows:

[0106] Query the business information of enterprises when adding new businesses, the application information when upgrading applications, and the network traffic data in multiple time periods, and write the network traffic data into the training set as samples;

[0107] Calculate the first mutation weight of the enterprise being attacked by the network based on business information and network traffic data;

[0108] Calculate the second mutation weight of the enterprise being attacked by the network based on application information and network traffic data;

[0109] The first mutation weight and the second mutation weight are combined into the mutation level of the enterprise under cyber attack, and the mutation level is labeled.

[0110] Among them, the first mutation weight of the enterprise being attacked by the network is calculated based on business information and network traffic data, including:

[0111] Query the time period of the business information to obtain the first base point period;

[0112] If the network traffic data within I time period after the first base point period indicates that the enterprise is under network attack, the business information is marked as the first mutation information; I is a positive integer;

[0113] Count the first proportion of the first mutation information to all business information;

[0114] Filter out the first number of times the enterprise was attacked by a network within a time period after each first mutation information;

[0115] Filter out the first number with the highest value from all the first numbers to obtain the first peak value;

[0116] Querying the business output value in the first mutation information corresponding to the first peak value;

[0117] The first proportion, the first peak value and the business output value are input as independent variables into the dovetail mutation function for fitting, and the first mutation coefficient, the second mutation coefficient and the third mutation coefficient are obtained; wherein the dovetail mutation function is expressed as:

[0118]

[0119] f(x) is a swallowtail mutation function, x is the independent variable, p is the first mutation coefficient, q is the second mutation coefficient, and o is the third mutation coefficient;

[0120] The first mutation base is generated by taking the first mutation coefficient as the base and 1 / 2 as the exponent, the second mutation base is generated by taking the second mutation coefficient as the base and 1 / 3 as the exponent, and the third mutation base is generated by taking the third mutation base as the base and 1 / 4 as the exponent;

[0121] The reciprocal of the first mutation base, the second mutation base, and the third mutation base are linearly fused into the first mutation weight of the enterprise being attacked by a network.

[0122] Among them, the second mutation weight of the enterprise being attacked by the network is calculated based on application information and network traffic data, including:

[0123] Query the time period of the application information to obtain the second base point period;

[0124] If the network traffic data within J time periods after the second base point period indicates that the enterprise is under network attack, the application information is marked as the second mutation information; J is a positive integer;

[0125] Count the second proportion of the second mutation information to all application information;

[0126] Filter out the second number of times the enterprise is attacked by the network within J time periods after each second mutation information;

[0127] The second number with the highest value is selected from all the second numbers to obtain the second peak value;

[0128] Query the download volume of the application in the time period corresponding to the second peak value;

[0129] The second ratio, the second peak value and the download volume are input as independent variables into the dovetail mutation function for fitting, and the fourth mutation coefficient, the fifth mutation coefficient and the sixth mutation coefficient are obtained; wherein the dovetail mutation function is expressed as:

[0130]

[0131] f(x) is a swallowtail mutation function, x is the independent variable, p is the fourth mutation coefficient, q is the fifth mutation coefficient, and o is the sixth mutation coefficient;

[0132] The fourth mutation base is generated by taking the fourth mutation coefficient as the base and 1 / 2 as the exponent, the fifth mutation base is generated by taking the fifth mutation coefficient as the base and 1 / 3 as the exponent, and the sixth mutation base is generated by taking the sixth mutation coefficient as the base and 1 / 4 as the exponent;

[0133] The reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base are linearly fused into the second mutation weight of the enterprise being attacked by a cyber attack.

[0134] The first mutation weight and the second mutation weight are combined into the mutation level of the enterprise being attacked by the network, including:

[0135] The first mutation weight and the second mutation weight are used as input to fit the cusp mutation function to obtain the seventh mutation coefficient and the eighth mutation coefficient; wherein the cusp mutation function is expressed as:

[0136] f(x)=x 4 +px 2 +qx

[0137] f(x) is a swallowtail mutation function, x is the independent variable, p is the eighth mutation coefficient, and q is the ninth mutation coefficient;

[0138] The first mutation factor is generated with the eighth mutation coefficient as the base and 1 / 2 as the exponent, and the second mutation factor is generated with the ninth mutation coefficient as the base and 1 / 3 as the exponent;

[0139] Substitute the first mutation factor and the second mutation factor into the following function for processing to obtain the mutation probability of the enterprise being attacked by the network:

[0140]

[0141] Among them, P is the mutation probability, M1 is the first mutation factor, M2 is the second mutation factor, A and B are constants, α and β are correlation coefficients, γ is the scaling factor, and ω is the fluctuation period;

[0142] Map the mutation probability to the mutation level of the enterprise being exposed to cyber attacks.

[0143] Step S12: Input the network traffic data as a sample into the sequence feature structure to extract the time series features and obtain the traffic time series features.

[0144] The network traffic data as samples are input into the sequence feature structure. The sequence feature structure processes the network traffic data as samples according to its structure, extracts time series features from the network traffic data as samples, and obtains traffic time series features.

[0145] In a specific implementation, the sequence feature structure includes a first long short-term memory network, a second long short-term memory network, a third long short-term memory network, a fourth long short-term memory network, a fifth long short-term memory network, a sixth long short-term memory network, a seventh long short-term memory network, an eighth long short-term memory network, a first convolutional layer, a second convolutional layer, a third convolutional layer, a fourth convolutional layer, a fifth convolutional layer, a sixth convolutional layer and a seventh convolutional layer;

[0146] Then, in the sequence feature structure, the average value of the network traffic data in the recent multiple time periods as samples is calculated to obtain the average traffic data;

[0147] Inputting the network traffic data in the most recent time period as a sample into the first long short-term memory network to extract the time series features, thereby obtaining the first real-time time series features;

[0148] Input the first real-time time series feature into the first convolution layer to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the second real-time time series feature;

[0149] Inputting the network traffic data in the most recent time period as samples into the second long short-term memory network to extract time series features, thereby obtaining third real-time time series features;

[0150] Input the third real-time time series feature into the second convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a fourth real-time time series feature;

[0151] Inputting the fourth real-time time series feature into the third long short-term memory network to extract the time series feature, thereby obtaining a fifth real-time time series feature;

[0152] The average flow data is input into the fourth long short-term memory network to extract the time series features, and the first average time series features are obtained;

[0153] Input the first average time series feature into the third convolutional layer to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the second average time series feature;

[0154] Input the second average time series feature into the fifth long short-term memory network to extract the time series feature, and obtain the third average time series feature;

[0155] Input the third average time series feature into the fourth convolutional layer to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain a fourth average time series feature;

[0156] Input the fourth average time series feature into the sixth long short-term memory network to extract the time series feature, so as to obtain the fifth average time series feature;

[0157] Input the fifth average time series feature into the fifth convolutional layer to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the sixth average time series feature;

[0158] The average flow data is input into the seventh long short-term memory network to extract the time series features, and the seventh average time series features are obtained;

[0159] Input the seventh average time series feature into the sixth convolutional layer to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the eighth average time series feature;

[0160] Input the eighth average time series feature into the eighth long short-term memory network to extract the time series feature, so as to obtain the ninth average time series feature;

[0161] The second real-time time series feature, the fifth real-time time series feature, the sixth average time series feature and the ninth average time series feature are concatenated into a flow time series feature.

[0162] Step S13: input the traffic time series features as samples into a preset decoder to obtain predicted network traffic data.

[0163] In this embodiment, the sequence feature structure is trained in a self-supervised manner to improve the versatility of the traffic time series features extracted by the sequence feature structure.

[0164] In the self-supervised approach, the sequence feature structure can be regarded as an encoder, and a decoder whose structure is adapted to the sequence feature structure is constructed to assist in training. At this time, the sequence feature structure of the encoder provides a downsampling operation, and the decoder provides an upsampling operation. When training the sequence feature structure, the decoder can be loaded into the memory for operation, so that the sequence feature structure and the decoder form a complete neural network.

[0165] The structure of the decoder can be symmetrical with the structure of the sequence feature structure, and a third-party pre-trained neural network such as VGG (Visual Geometry Group) and ResNet (Residual Network) can also be used as the decoder, which is not limited in this embodiment.

[0166] In the self-supervised approach, the traffic time series features as samples are input into a preset decoder to obtain predicted network traffic data.

[0167] Step S14: training a sequence feature structure based on the network traffic data and the predicted network traffic data.

[0168] In this embodiment, the network traffic data and the predicted network traffic data are substituted into a preset loss function for calculation, for example, MAE (Mean Absolute Error), MSE (Mean Squared Error), etc., to obtain a loss value, and the loss value is substituted into optimization algorithms such as SGD (stochastic gradient descent) and Adam (Adaptive momentum), and the update amplitude of the sequence feature structure and the parameters in the decoder are calculated, and the sequence feature structure and the parameters of the decoder are updated according to the update amplitude until the preset training conditions are met, for example, the number of iterations reaches a certain threshold, the loss value is less than a certain threshold, the change amplitude of the loss value in multiple iterations of training is less than a certain threshold, and so on.

[0169] Step S15: If the training sequence feature structure is completed, the traffic time series feature as a sample is input into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future.

[0170] If the training sequence feature structure is completed, the decoder is discarded, the parameters in the sequence feature structure are kept unchanged, and each detection branch structure is trained independently.

[0171] When each detection branch structure is trained independently, the traffic timing characteristics as samples are input into the detection branch structure corresponding to the mutation level of the enterprise's network attack. In the detection branch structure, the traffic timing characteristics are processed according to its structure to detect the risk level of the enterprise being attacked by the network in the future.

[0172] In a specific implementation, each detection branch structure includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a first atrous space pyramid pooling layer, a second atrous space pyramid pooling layer and a normalized exponential function;

[0173] Then, in the detection branch structure corresponding to the mutation level of the network attack on the enterprise, the flow time series feature as a sample is input into the first fully connected layer to perform mapping operation, batch normalization operation and linear rectification operation in sequence to obtain the first detection time series feature;

[0174] Input the first detection time series feature into the first atrous spatial pyramid pooling layer, and sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a second detection time series feature;

[0175] splicing the first detection timing feature and the second detection timing feature into a third detection timing feature;

[0176] Input the third detection time series feature into the second atrous spatial pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a fourth detection time series feature;

[0177] splicing the first detection timing feature and the fourth detection timing feature into a fifth detection timing feature;

[0178] Input the fifth detection time series feature into the second fully connected layer to perform a mapping operation to obtain a sixth detection time series feature;

[0179] Adding the flow time series feature and the sixth detection time series feature to obtain a seventh detection time series feature;

[0180] Inputting the seventh detection time series feature into the third fully connected layer to perform a mapping operation to obtain an eighth detection time series feature;

[0181] The eighth detection time series feature is input into the normalized exponential function to divide the risk level of the enterprise being attacked by network in the future.

[0182] Step S16: training the detection branch structure according to the risk level used as the label and the detected risk level.

[0183] In this embodiment, the risk level used as a label and the detected risk level are substituted into a preset loss function for calculation, for example, KL divergence (Kullback Leibler Divergence, also known as relative entropy), CE (CrossEntropy), etc., to obtain a loss value, and the loss value is substituted into optimization algorithms such as SGD and Adam to calculate the update amplitude of the parameters in the sequence feature structure and the detection branch structure, and the parameters in the detection branch structure are updated according to the update amplitude, and the parameters in the sequence feature structure are not updated until the preset training conditions are met, for example, the number of iterations reaches a certain threshold, the loss value is less than a certain threshold, the change amplitude of the loss value in multiple iterations of training is less than a certain threshold, and so on.

[0184] In this embodiment, since the training method of the risk detection network (i.e., step S11-step S16) and the application method of the risk detection network (i.e., step 101-step 107) are basically similar, the description is relatively simple. For relevant details, please refer to the partial description of the application method of the risk detection network (i.e., step 101-step 107). This embodiment will not be described in detail here.

[0185] Step 106: Input the network traffic data into the sequence feature structure to extract the time series features and obtain the traffic time series features.

[0186] In this embodiment, the network traffic data may be input into a sequence feature structure, and the sequence feature structure extracts time series features from the network traffic data according to its structure to obtain traffic time series features.

[0187] In the specific implementation, Figure 2 As shown, the sequence feature structure includes a first long short-term memory network LSTM_1, a second long short-term memory network LSTM_2, a third long short-term memory network LSTM_3, a fourth long short-term memory network LSTM_4, a fifth long short-term memory network LSTM_5, a sixth long short-term memory network LSTM_6, a seventh long short-term memory network LSTM_7, an eighth long short-term memory network LSTM_8, a first convolutional layer ConV_1, a second convolutional layer ConV_2, a third convolutional layer ConV_3, a fourth convolutional layer ConV_4, a fifth convolutional layer ConV_5, a sixth convolutional layer ConV_6 and a seventh convolutional layer ConV_7.

[0188] Among them, the first long short-term memory network LSTM_1, the second long short-term memory network LSTM_2, the third long short-term memory network LSTM_3, the fourth long short-term memory network LSTM_4, the fifth long short-term memory network LSTM_5, the sixth long short-term memory network LSTM_6, the seventh long short-term memory network LSTM_7, and the eighth long short-term memory network LSTM_8 all belong to LSTM (Long Short Term Memory, long short-term memory network).

[0189] LSTM introduces a special memory cell, which contains three important gating mechanisms:

[0190] 1. Input Gate: determines which information will be input into the memory unit.

[0191] 2. Forget Gate: Determines which information will be deleted or forgotten from the memory unit.

[0192] 3. Output Gate: Determines which information will be output from the memory unit to the next layer or the next time step.

[0193] These gating mechanisms adjust the state of memory cells and the flow of information through some mathematical operations (such as sigmoid functions and multiplication), allowing LSTM to effectively capture and retain long-term temporal dependencies.

[0194] The structure of LSTM enables it to better process long sequence data such as network traffic data, avoiding the gradient vanishing or gradient exploding problems, and enables the risk detection network to better model long-term dependencies when processing time series tasks.

[0195] In addition, the first convolutional layer ConV_1, the second convolutional layer ConV_2, the third convolutional layer ConV_3, the fourth convolutional layer ConV_4, the fifth convolutional layer ConV_5, the sixth convolutional layer ConV_6 and the seventh convolutional layer ConV_7 are all convolutional layers. The convolutional layer is composed of several convolutional units and can provide convolution operations. The purpose of the convolution operation is to extract different features of the input. Shallow convolutional layers may only extract some low-level features. Networks with more layers can iteratively extract higher-level features from low-level features.

[0196] like Figure 2As shown, the network traffic data in the most recent multiple time periods are arranged in sequence on the time axis T, and the average value of the network traffic data in the most recent multiple time periods can be calculated to obtain average traffic data. The average traffic data can reduce the fluctuation caused by the mutation and obtain the general change of the network traffic, which is contrasted with the mutation, thereby highlighting the fluctuation of the mutation.

[0197] The network traffic data in the most recent time period can retain more mutation information. The network traffic data in the most recent time period is input into the first long short-term memory network LSTM_1 to extract the time series features and obtain the first real-time time series features.

[0198] The first real-time time series feature is input into the first convolutional layer ConV_1 to perform convolution operation, batch normalization operation (Batch Normalization, BN) and linear rectification operation (Rectified Linear Unit, ReLU) in sequence to obtain the second real-time time series feature.

[0199] The network traffic data in the most recent time period is input into the second long short-term memory network LSTM_2 to extract the time series features and obtain the third real-time time series features.

[0200] The third real-time time series feature is input into the second convolutional layer ConV_2 to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the fourth real-time time series feature.

[0201] The fourth real-time time series feature is input into the third long short-term memory network LSTM_3 to extract the time series feature to obtain the fifth real-time time series feature.

[0202] The average traffic data is input into the fourth long short-term memory network LSTM_4 to extract the time series features and obtain the first average time series features.

[0203] The first average time series feature is input into the third convolutional layer ConV_3 to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the second average time series feature.

[0204] The second average time series feature is input into the fifth long short-term memory network LSTM_5 to extract the time series feature to obtain the third average time series feature.

[0205] The third average time series feature is input into the fourth convolutional layer ConV_4 to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the fourth average time series feature.

[0206] The fourth average time series feature is input into the sixth long short-term memory network LSTM_6 to extract the time series feature to obtain the fifth average time series feature.

[0207] The fifth average time series feature is input into the fifth convolutional layer ConV_5 to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the sixth average time series feature.

[0208] The average traffic data is input into the seventh long short-term memory network LSTM_7 to extract the time series features and obtain the seventh average time series features.

[0209] The seventh average time series feature is input into the sixth convolutional layer ConV_6 to perform convolution operation, batch normalization operation and linear rectification operation in sequence to obtain the eighth average time series feature.

[0210] The eighth average time series feature is input into the eighth long short-term memory network LSTM_8 to extract the time series feature to obtain the ninth average time series feature.

[0211] The second real-time time series feature, the fifth real-time time series feature, the sixth average time series feature and the ninth average time series feature are concatenated into a traffic time series feature.

[0212] In this embodiment, there are two branches for extracting features from the network traffic data in the most recent time period, wherein the depth of one branch is longer and the depth of the other branch is shorter, so that features of different levels can be extracted from the network traffic data in the most recent time period, thereby improving the richness of the features; there are two branches for extracting features from the average traffic data, wherein the depth of one branch is longer and the depth of the other branch is shorter, so that features of different levels can be extracted from the average traffic data, thereby improving the richness of the features.

[0213] In addition, the depth of the two branches for extracting features from the average traffic data is longer than the depth of the two branches for extracting features from the network traffic data in the most recent time period, which allows higher-level features to be mined from general changes in network traffic, improving the generalization of features, while shallow-level features are mined from mutations in network traffic, retaining the volatility of mutations, making the contrast between the two more obvious.

[0214] Step 107: Input the traffic time series characteristics into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future.

[0215] In this embodiment, the traffic timing characteristics are input into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network. In the detection branch structure, the traffic timing characteristics are processed according to its structure to detect the risk level of the enterprise being attacked by the network in the future.

[0216] The enterprise's system can adjust its network security protection measures to prevent network attacks according to the risk level, such as adjusting the intensity of cleaning and filtering abnormal network traffic, adjusting distributed cluster defense, intelligent DNS (Domain Name System) resolution, etc.

[0217] In the specific implementation, Figure 2 As shown, each detection branch structure includes a first fully connected layer FC_1, a second fully connected layer FC_2, a third fully connected layer FC_3, a first atrous spatial pyramid pooling layer ASPP_1, a second atrous spatial pyramid pooling layer ASPP_2 and a normalized exponential function Softmax.

[0218] Among them, the first fully connected layer FC_1, the second fully connected layer FC_2, and the third fully connected layer FC_3 all belong to fully connected layers (FC). In the fully connected layer, each neuron in the previous layer is connected to each neuron in the next layer. When the detection branch structure needs to complete the classification task, the fully connected layer in the detection branch structure weights the features and maps the extracted features to the classification target.

[0219] The first atrous spatial pyramid pooling layer ASPP_1 and the second atrous spatial pyramid pooling layer ASPP_2 both belong to the atrous spatial pyramid pooling layer (ASPP). The atrous spatial pyramid pooling layer samples the input features in parallel with atrous convolutions at different sampling rates, concatenates the sampled features together, expands the number of channels, and reduces the number of channels to the expected value through 1×1 convolution, thereby capturing the context of features at multiple scales.

[0220] Detecting the risk level of an enterprise being attacked by a cyber attack in the future is a multi-classification task. Softmax is the activation function in multi-classification tasks. In multi-classification tasks, if there are more than two class labels, class membership is required. For any real vector of length K, Softmax can compress it into a real vector of length K, with a value in the range of (0,1) and the sum of the elements in the vector being 1.

[0221] like Figure 2 As shown, in the detection branch structure corresponding to the mutation level of the enterprise under network attack, the traffic time series feature is input into the first fully connected layer FC_1 to perform mapping operation, batch normalization operation and linear rectification operation in sequence to obtain the first detection time series feature.

[0222] The first detection time series feature is input into the first atrous spatial pyramid pooling layer ASPP_1 to perform pooling operation, batch normalization operation and linear rectification operation in sequence to obtain the second detection time series feature.

[0223] Concatenating the first detection time series feature and the second detection time series feature into a third detection time series feature;

[0224] The third detection time series feature is input into the second atrous spatial pyramid pooling layer ASPP_2 to sequentially perform pooling operations, batch normalization operations, and linear rectification operations to obtain a fourth detection time series feature.

[0225] The first detection timing feature and the fourth detection timing feature are concatenated into a fifth detection timing feature.

[0226] The fifth detection time series feature is input into the second fully connected layer FC_2 to perform a mapping operation to obtain a sixth detection time series feature.

[0227] Adding the flow time series feature and the sixth detection time series feature to obtain the seventh detection time series feature;

[0228] Input the seventh detection time series feature into the third fully connected layer FC_3 to perform a mapping operation to obtain an eighth detection time series feature;

[0229] The eighth detection time series feature is input into the normalized exponential function Softmax to divide the risk level of the enterprise being attacked by network in the future.

[0230] In this embodiment, the first mutation weight of the enterprise being attacked by a network is calculated based on the business information and network traffic data when the enterprise adds a new business, and the second mutation weight of the enterprise being attacked by a network is calculated based on the application information and network traffic data when the enterprise upgrades the application. The first mutation weight and the second mutation weight are thereby merged into a mutation level of the enterprise being attacked by a network, and the network traffic data is input into a sequence feature structure to extract time series features to obtain traffic time series features; the traffic time series features are input into a detection branch structure corresponding to the mutation level of the enterprise being attacked by a network to detect the risk level of the enterprise being attacked by a network in the future. On the one hand, the sequence feature structure provides common features, treating different risk levels as a whole, and does not distinguish between different risk levels. The features converge to the range of shallow features, which can reduce the workload of the detection branch structure and improve the accuracy of the detection branch structure classification. On the other hand, multiple detection branch structures are externally connected on the basis of the sequence feature structure. The network traffic at different risk levels varies greatly. The detection branch structure is mainly concerned with the fluctuations caused by the risk level and does not care about the underlying features. The complexity of its structure is less than that of a complete model. It can not only distinguish the classification at different risk levels and meet the business needs of risk detection, but also improve the accuracy of predicting the risk of future network attacks on enterprises, reduce problems such as underreporting and false alarms, and improve the network security of enterprises. It can also reduce the amount of calculation and reduce the use of resources.

[0231] Embodiment 2

[0232] Figure 3 This is a schematic diagram of the structure of a network attack risk detection device provided by Embodiment 2 of the present invention. Figure 3 As shown, the device comprises:

[0233] The enterprise information query module 301 is used to query the business information of the enterprise when adding new business, the application information when upgrading the application program, and the network traffic data in multiple time periods;

[0234] A first mutation weight calculation module 302, used to calculate a first mutation weight of the enterprise being attacked by the network according to the business information and the network traffic data;

[0235] A second mutation weight calculation module 303, used to calculate a second mutation weight of the enterprise being attacked by the network according to the application information and the network traffic data;

[0236] A mutation level fusion module 304 is used to fuse the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by the network;

[0237] A risk detection network loading module 305 is used to load a risk detection network, wherein the risk detection network has a sequence feature structure and a plurality of detection branch structures trained for mutation levels;

[0238] Traffic time series feature extraction module 306, used for inputting the network traffic data into the sequence feature structure to extract the time series features and obtain traffic time series features;

[0239] The risk level detection module 307 is used to input the traffic time series characteristics into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future.

[0240] In one embodiment of the present invention, the first mutation weight calculation module 302 is further used to:

[0241] Query the time period in which the business information is located to obtain a first base point period;

[0242] If the network traffic data within I time periods after the first base point period indicates that the enterprise is under network attack, the business information is marked as first mutation information; I is a positive integer;

[0243] Counting a first ratio of the first mutation information to all the business information;

[0244] Filtering out the first number of times the enterprise is attacked by a network within the I time period after each of the first mutation information;

[0245] Filter out the first number with the highest value from all the first numbers to obtain a first peak value;

[0246] Querying the business output value in the first mutation information corresponding to the first peak value;

[0247] The first ratio, the first peak value and the business output value are input as independent variables into a dovetail mutation function for fitting, so as to obtain a first mutation coefficient, a second mutation coefficient and a third mutation coefficient; wherein the dovetail mutation function is expressed as:

[0248]

[0249] f(x) is the dovetail mutation function, x is the independent variable, p is the first mutation coefficient, q is the second mutation coefficient, and o is the third mutation coefficient;

[0250] The first mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the first mutation base, the second mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the second mutation base, and the third mutation base is used as the base and 1 / 4 is used as the exponent to generate the third mutation base;

[0251] The reciprocal of the first mutation base, the second mutation base, and the third mutation base are linearly fused into a first mutation weight of the enterprise being attacked by a network.

[0252] In one embodiment of the present invention, the second mutation weight calculation module 303 is further used to:

[0253] Query the time period in which the application information is located to obtain a second base point period;

[0254] If the network traffic data within J time periods after the second base point period indicates that the enterprise is under network attack, the application information is marked as second mutation information; J is a positive integer;

[0255] Counting a second ratio of the second mutation information to all the application information;

[0256] Filtering out the second number of times the enterprise is attacked by the network within J time periods after each of the second mutation information;

[0257] Filter out the second number with the highest value from all the second numbers to obtain a second peak value;

[0258] querying the download volume of the application in the time period corresponding to the second peak value;

[0259] The second ratio, the second peak value and the download volume are input as independent variables into a dovetail mutation function for fitting, so as to obtain a fourth mutation coefficient, a fifth mutation coefficient and a sixth mutation coefficient; wherein the dovetail mutation function is expressed as:

[0260]

[0261] f(x) is the dovetail mutation function, x is the independent variable, p is the fourth mutation coefficient, q is the fifth mutation coefficient, and o is the sixth mutation coefficient;

[0262] The fourth mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the fourth mutation base, the fifth mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the fifth mutation base, and the sixth mutation coefficient is used as the base and 1 / 4 is used as the exponent to generate the sixth mutation base;

[0263] The reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base are linearly merged into a second mutation weight of the enterprise being attacked by a network.

[0264] In one embodiment of the present invention, the mutation level fusion module 304 is further used to:

[0265] The first mutation weight and the second mutation weight are used as input cusp mutation function for fitting to obtain the seventh mutation coefficient and the eighth mutation coefficient; wherein the cusp mutation function is expressed as:

[0266] f(x)=x 4 +px 2 +qx

[0267] f(x) is the dovetail mutation function, x is the independent variable, p is the eighth mutation coefficient, and q is the ninth mutation coefficient;

[0268] The first mutation factor is generated by taking the eighth mutation coefficient as the base and 1 / 2 as the exponent, and the second mutation factor is generated by taking the ninth mutation coefficient as the base and 1 / 3 as the exponent;

[0269] Substitute the first mutation factor and the second mutation factor into the following function for processing to obtain the mutation probability of the enterprise being attacked by a network attack:

[0270]

[0271] Wherein, P is the mutation probability, M1 is the first mutation factor, M2 is the second mutation factor, A and B are constants, α and β are correlation coefficients, γ is the scaling factor, and ω is the fluctuation period;

[0272] The mutation probability is mapped to a mutation level of the enterprise being attacked by a network.

[0273] In one embodiment of the present invention, the sequence feature structure includes a first long short-term memory network, a second long short-term memory network, a third long short-term memory network, a fourth long short-term memory network, a fifth long short-term memory network, a sixth long short-term memory network, a seventh long short-term memory network, an eighth long short-term memory network, a first convolutional layer, a second convolutional layer, a third convolutional layer, a fourth convolutional layer, a fifth convolutional layer, a sixth convolutional layer and a seventh convolutional layer;

[0274] The flow time series feature extraction module 306 is also used for:

[0275] Calculate the average of the network flow data in the most recent multiple time periods to obtain average flow data;

[0276] Inputting the network traffic data in the most recent time period into the first long short-term memory network to extract time series features, thereby obtaining first real-time time series features;

[0277] Inputting the first real-time time series feature into the first convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second real-time time series feature;

[0278] Inputting the network traffic data in the most recent time period into the second long short-term memory network to extract time series features, thereby obtaining third real-time time series features;

[0279] Input the third real-time time series feature into the second convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a fourth real-time time series feature;

[0280] Inputting the fourth real-time time series feature into the third long short-term memory network to extract the time series feature, so as to obtain a fifth real-time time series feature;

[0281] Inputting the average flow data into the fourth long short-term memory network to extract time series features to obtain first average time series features;

[0282] Inputting the first average time series feature into the third convolutional layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second average time series feature;

[0283] Inputting the second average time series feature into the fifth long short-term memory network to extract the time series feature, so as to obtain a third average time series feature;

[0284] Inputting the third average time series feature into the fourth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a fourth average time series feature;

[0285] Inputting the fourth average time series feature into the sixth long short-term memory network to extract the time series feature, so as to obtain the fifth average time series feature;

[0286] Inputting the fifth average time series feature into the fifth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a sixth average time series feature;

[0287] Inputting the average flow data into the seventh long short-term memory network to extract time series features, thereby obtaining a seventh average time series feature;

[0288] Inputting the seventh average time series feature into the sixth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain an eighth average time series feature;

[0289] Inputting the eighth average time series feature into the eighth long short-term memory network to extract the time series feature, so as to obtain a ninth average time series feature;

[0290] The second real-time time series feature, the fifth real-time time series feature, the sixth average time series feature and the ninth average time series feature are concatenated into a flow time series feature.

[0291] In one embodiment of the present invention, each of the detection branch structures includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a first atrous space pyramid pooling layer, a second atrous space pyramid pooling layer and a normalized exponential function;

[0292] The risk level detection module 307 is also used for:

[0293] In the detection branch structure corresponding to the mutation level of the network attack on the enterprise, the traffic time series feature is input into the first fully connected layer to perform mapping operation, batch normalization operation and linear rectification operation in sequence to obtain a first detection time series feature;

[0294] Inputting the first detection time series feature into the first atrous spatial pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a second detection time series feature;

[0295] splicing the first detection timing feature and the second detection timing feature into a third detection timing feature;

[0296] Input the third detection time series feature into the second atrous space pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a fourth detection time series feature;

[0297] splicing the first detection timing feature and the fourth detection timing feature into a fifth detection timing feature;

[0298] Inputting the fifth detection time series feature into the second fully connected layer to perform a mapping operation to obtain a sixth detection time series feature;

[0299] Adding the flow time series feature and the sixth detection time series feature to obtain a seventh detection time series feature;

[0300] Inputting the seventh detection time series feature into the third fully connected layer to perform a mapping operation to obtain an eighth detection time series feature;

[0301] The eighth detection time series feature is input into the normalized exponential function to classify the risk level of the enterprise being attacked by network in the future.

[0302] In one embodiment of the present invention, it also includes:

[0303] A training set construction module, used to construct a training set for an enterprise as a sample, wherein the training set includes network traffic data as a sample and a risk level of network attack as a label;

[0304] A sample feature extraction module, used for inputting the network traffic data as a sample into the sequence feature structure to extract the time series features and obtain the traffic time series features;

[0305] A sample traffic prediction module, used for inputting the traffic time series features as samples into a preset decoder to obtain predicted network traffic data;

[0306] A sequence feature structure training module, used for training the sequence feature structure according to the network traffic data and the predicted network traffic data;

[0307] A sample level detection module, for inputting the traffic time series feature as a sample into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network, to detect the risk level of the enterprise being attacked by the network in the future, if the training of the sequence feature structure is completed;

[0308] The detection branch structure training module is used to train the detection branch structure according to the risk level as a label and the detected risk level.

[0309] The network attack risk detection device provided in the embodiment of the present invention can execute the network attack risk detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the network attack risk detection method.

[0310] Embodiment 3

[0311] Figure 4 A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0312] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0313] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0314] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the risk detection method for network attacks.

[0315] In some embodiments, the risk detection method of a network attack may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the risk detection method of a network attack described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the risk detection method of a network attack in any other appropriate manner (e.g., by means of firmware).

[0316] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0317] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0318] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting risk of network attacks, characterized in that: include: Query the business information of enterprises when adding new businesses, application information when upgrading applications, and network traffic data in multiple time periods; Calculating a first mutation weight of the enterprise being attacked by a network according to the business information and the network traffic data; Calculating a second mutation weight of the enterprise being attacked by the network according to the application information and the network traffic data; Merging the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by a network; Loading a risk detection network, wherein the risk detection network has a sequence feature structure and a plurality of detection branch structures trained for mutation levels; Input the network traffic data into the sequence feature structure to extract the time series features to obtain traffic time series features; Inputting the traffic time series feature into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future; The step of calculating the first mutation weight of the enterprise being attacked by a network according to the business information and the network traffic data includes: Query the time period in which the business information is located to obtain a first base point period; If the network traffic data within I time periods after the first base point period indicates that the enterprise is under network attack, the business information is marked as first mutation information; I is a positive integer; Counting a first ratio of the first mutation information to all the business information; Filtering out the first number of times the enterprise is attacked by a network within the I time period after each of the first mutation information; Filter out the first number with the highest value from all the first numbers to obtain a first peak value; Querying the business output value in the first mutation information corresponding to the first peak value; The first ratio, the first peak value and the business output value are input as independent variables into a dovetail mutation function for fitting, so as to obtain a first mutation coefficient, a second mutation coefficient and a third mutation coefficient; wherein the dovetail mutation function is expressed as: f(x) is the dovetail mutation function, x is the independent variable, p is the first mutation coefficient, q is the second mutation coefficient, and o is the third mutation coefficient; The first mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the first mutation base, the second mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the second mutation base, and the third mutation coefficient is used as the base and 1 / 4 is used as the exponent to generate the third mutation base; Linearly merge the reciprocal of the first mutation base, the second mutation base, and the third mutation base into a first mutation weight of the enterprise being attacked by a network; The calculating, based on the application information and the network traffic data, a second mutation weight of the enterprise being attacked by the network includes: Query the time period in which the application information is located to obtain a second base point period; If the network traffic data within J time periods after the second base point period indicates that the enterprise is under network attack, the application information is marked as second mutation information; J is a positive integer; Counting a second ratio of the second mutation information to all the application information; Filtering out the second number of times the enterprise is attacked by the network within J time periods after each of the second mutation information; Filter out the second number with the highest value from all the second numbers to obtain a second peak value; querying the download volume of the application in the time period corresponding to the second peak value; The second ratio, the second peak value and the download volume are input as independent variables into a dovetail mutation function for fitting, so as to obtain a fourth mutation coefficient, a fifth mutation coefficient and a sixth mutation coefficient; wherein the dovetail mutation function is expressed as: f(x) is the dovetail mutation function, x is the independent variable, p is the fourth mutation coefficient, q is the fifth mutation coefficient, and o is the sixth mutation coefficient; The fourth mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the fourth mutation base, the fifth mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the fifth mutation base, and the sixth mutation coefficient is used as the base and 1 / 4 is used as the exponent to generate the sixth mutation base; Linearly merge the reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base into a second mutation weight of the enterprise being attacked by a network; The step of fusing the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by a network includes: The first mutation weight and the second mutation weight are used as input cusp mutation function for fitting to obtain the seventh mutation coefficient and the eighth mutation coefficient; wherein the cusp mutation function is expressed as: f(x)=x 4 +px 2 +qx f(x) is the dovetail mutation function, x is the independent variable, p is the seventh mutation coefficient, and q is the eighth mutation coefficient; The first mutation factor is generated by taking the seventh mutation coefficient as the base and 1 / 2 as the exponent, and the second mutation factor is generated by taking the eighth mutation coefficient as the base and 1 / 3 as the exponent; Substitute the first mutation factor and the second mutation factor into the following function for processing to obtain the mutation probability of the enterprise being attacked by a network attack: Wherein, P is the mutation probability, M1 is the first mutation factor, M2 is the second mutation factor, A and B are constants, α and β are correlation coefficients, γ is the scaling factor, and ω is the fluctuation period; Mapping the mutation probability to a mutation level of the enterprise being attacked by a network; The sequence feature structure includes a first long short-term memory network, a second long short-term memory network, a third long short-term memory network, a fourth long short-term memory network, a fifth long short-term memory network, a sixth long short-term memory network, a seventh long short-term memory network, an eighth long short-term memory network, a first convolutional layer, a second convolutional layer, a third convolutional layer, a fourth convolutional layer, a fifth convolutional layer, a sixth convolutional layer and a seventh convolutional layer; The step of inputting the network traffic data into the sequence feature structure to extract the time series features and obtain the traffic time series features comprises: Calculate the average of the network flow data in the most recent multiple time periods to obtain average flow data; Inputting the network traffic data in the most recent time period into the first long short-term memory network to extract time series features, thereby obtaining first real-time time series features; Inputting the first real-time time series feature into the first convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second real-time time series feature; Inputting the network traffic data in the most recent time period into the second long short-term memory network to extract time series features, thereby obtaining third real-time time series features; Input the third real-time time series feature into the second convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a fourth real-time time series feature; Inputting the fourth real-time time series feature into the third long short-term memory network to extract the time series feature, so as to obtain a fifth real-time time series feature; Inputting the average flow data into the fourth long short-term memory network to extract time series features to obtain first average time series features; Inputting the first average time series feature into the third convolutional layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second average time series feature; Inputting the second average time series feature into the fifth long short-term memory network to extract the time series feature, so as to obtain a third average time series feature; Inputting the third average time series feature into the fourth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a fourth average time series feature; Inputting the fourth average time series feature into the sixth long short-term memory network to extract the time series feature, so as to obtain the fifth average time series feature; Inputting the fifth average time series feature into the fifth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a sixth average time series feature; Inputting the average flow data into the seventh long short-term memory network to extract time series features, thereby obtaining a seventh average time series feature; Inputting the seventh average time series feature into the sixth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain an eighth average time series feature; Inputting the eighth average time series feature into the eighth long short-term memory network to extract the time series feature, so as to obtain a ninth average time series feature; splicing the second real-time time series feature, the fifth real-time time series feature, the sixth average time series feature and the ninth average time series feature into a flow time series feature; Each of the detection branch structures includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a first atrous space pyramid pooling layer, a second atrous space pyramid pooling layer and a normalized exponential function; The step of inputting the traffic time series feature into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future includes: In the detection branch structure corresponding to the mutation level of the network attack on the enterprise, the traffic time series feature is input into the first fully connected layer to perform mapping operation, batch normalization operation and linear rectification operation in sequence to obtain a first detection time series feature; Inputting the first detection time series feature into the first atrous spatial pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a second detection time series feature; splicing the first detection timing feature and the second detection timing feature into a third detection timing feature; Input the third detection time series feature into the second atrous space pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a fourth detection time series feature; splicing the first detection timing feature and the fourth detection timing feature into a fifth detection timing feature; Inputting the fifth detection time series feature into the second fully connected layer to perform a mapping operation to obtain a sixth detection time series feature; Adding the flow time series feature and the sixth detection time series feature to obtain a seventh detection time series feature; Inputting the seventh detection time series feature into the third fully connected layer to perform a mapping operation to obtain an eighth detection time series feature; The eighth detection time series feature is input into the normalized exponential function to classify the risk level of the enterprise being attacked by network in the future.

2. The method according to claim 1, characterized in that Also includes: Constructing a training set for the enterprise as a sample, wherein the training set includes network traffic data as a sample and a risk level of network attack as a label; Input the network traffic data as a sample into the sequence feature structure to extract the time series features, and obtain the traffic time series features; Inputting the traffic time series features as samples into a preset decoder to obtain predicted network traffic data; Training the sequence feature structure according to the network traffic data and the predicted network traffic data; If the training of the sequence feature structure is completed, the traffic time series feature as a sample is input into the detection branch structure corresponding to the mutation level of the enterprise being attacked by the network to detect the risk level of the enterprise being attacked by the network in the future; The detection branch structure is trained according to the risk level as a label and the detected risk level.

3. A network attack risk detection device, characterized in that: include: The enterprise information query module is used to query the business information of the enterprise when adding new business, the application information when upgrading the application program, and the network traffic data in multiple time periods; A first mutation weight calculation module, used to calculate a first mutation weight of the enterprise being attacked by a network according to the business information and the network traffic data; A second mutation weight calculation module, used to calculate a second mutation weight of the enterprise being attacked by the network according to the application information and the network traffic data; A mutation level fusion module, used for fusing the first mutation weight and the second mutation weight into a mutation level of the enterprise being attacked by the network; A risk detection network loading module, used to load a risk detection network, wherein the risk detection network has a sequence feature structure and a plurality of detection branch structures trained for mutation levels; A traffic time series feature extraction module, used for inputting the network traffic data into the sequence feature structure to extract the time series features and obtain traffic time series features; A risk level detection module, used for inputting the traffic time series characteristics into the detection branch structure corresponding to the mutation level of the network attack on the enterprise to detect the risk level of the enterprise being attacked by the network in the future; Wherein, the first mutation weight calculation module is also used for: Query the time period in which the business information is located to obtain a first base point period; If the network traffic data within I time periods after the first base point period indicates that the enterprise is under network attack, the business information is marked as first mutation information; I is a positive integer; Counting a first ratio of the first mutation information to all the business information; Filtering out the first number of times the enterprise is attacked by a network within the I time period after each of the first mutation information; Filter out the first number with the highest value from all the first numbers to obtain a first peak value; Querying the business output value in the first mutation information corresponding to the first peak value; The first ratio, the first peak value and the business output value are input as independent variables into a dovetail mutation function for fitting, so as to obtain a first mutation coefficient, a second mutation coefficient and a third mutation coefficient; wherein the dovetail mutation function is expressed as: f(x) is the dovetail mutation function, x is the independent variable, p is the first mutation coefficient, q is the second mutation coefficient, and o is the third mutation coefficient; The first mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the first mutation base, the second mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the second mutation base, and the third mutation coefficient is used as the base and 1 / 4 is used as the exponent to generate the third mutation base; Linearly merge the reciprocal of the first mutation base, the second mutation base, and the third mutation base into a first mutation weight of the enterprise being attacked by a network; The second mutation weight calculation module is also used for: Query the time period in which the application information is located to obtain a second base point period; If the network traffic data within J time periods after the second base point period indicates that the enterprise is under network attack, the application information is marked as second mutation information; J is a positive integer; Counting a second ratio of the second mutation information to all the application information; Filtering out the second number of times the enterprise is attacked by the network within J time periods after each of the second mutation information; Filter out the second number with the highest value from all the second numbers to obtain a second peak value; querying the download volume of the application in the time period corresponding to the second peak value; The second ratio, the second peak value and the download volume are input as independent variables into a dovetail mutation function for fitting, so as to obtain a fourth mutation coefficient, a fifth mutation coefficient and a sixth mutation coefficient; wherein the dovetail mutation function is expressed as: f(x) is the dovetail mutation function, x is the independent variable, p is the fourth mutation coefficient, q is the fifth mutation coefficient, and o is the sixth mutation coefficient; The fourth mutation coefficient is used as the base and 1 / 2 is used as the exponent to generate the fourth mutation base, the fifth mutation coefficient is used as the base and 1 / 3 is used as the exponent to generate the fifth mutation base, and the sixth mutation coefficient is used as the base and 1 / 4 is used as the exponent to generate the sixth mutation base; Linearly merge the reciprocal of the fourth mutation base, the fifth mutation base, and the sixth mutation base into a second mutation weight of the enterprise being attacked by a network; The mutation level fusion module is also used for: The first mutation weight and the second mutation weight are used as input cusp mutation function for fitting to obtain the seventh mutation coefficient and the eighth mutation coefficient; wherein the cusp mutation function is expressed as: f(x)=x 4 +px 2 +qx f(x) is the dovetail mutation function, x is the independent variable, p is the seventh mutation coefficient, and q is the eighth mutation coefficient; The first mutation factor is generated by taking the seventh mutation coefficient as the base and 1 / 2 as the exponent, and the second mutation factor is generated by taking the eighth mutation coefficient as the base and 1 / 3 as the exponent; Substitute the first mutation factor and the second mutation factor into the following function for processing to obtain the mutation probability of the enterprise being attacked by a network attack: Wherein, P is the mutation probability, M1 is the first mutation factor, M2 is the second mutation factor, A and B are constants, α and β are correlation coefficients, γ is the scaling factor, and ω is the fluctuation period; Mapping the mutation probability to a mutation level of the enterprise being attacked by a network; The sequence feature structure includes a first long short-term memory network, a second long short-term memory network, a third long short-term memory network, a fourth long short-term memory network, a fifth long short-term memory network, a sixth long short-term memory network, a seventh long short-term memory network, an eighth long short-term memory network, a first convolutional layer, a second convolutional layer, a third convolutional layer, a fourth convolutional layer, a fifth convolutional layer, a sixth convolutional layer and a seventh convolutional layer; The traffic time series feature extraction module is also used for: Calculate the average of the network flow data in the most recent multiple time periods to obtain average flow data; Inputting the network traffic data in the most recent time period into the first long short-term memory network to extract time series features, thereby obtaining first real-time time series features; Inputting the first real-time time series feature into the first convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second real-time time series feature; Inputting the network traffic data in the most recent time period into the second long short-term memory network to extract time series features, thereby obtaining third real-time time series features; Input the third real-time time series feature into the second convolution layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a fourth real-time time series feature; Inputting the fourth real-time time series feature into the third long short-term memory network to extract the time series feature, so as to obtain a fifth real-time time series feature; Inputting the average flow data into the fourth long short-term memory network to extract time series features to obtain first average time series features; Inputting the first average time series feature into the third convolutional layer to sequentially perform convolution operation, batch normalization operation and linear rectification operation to obtain a second average time series feature; Inputting the second average time series feature into the fifth long short-term memory network to extract the time series feature, so as to obtain a third average time series feature; Inputting the third average time series feature into the fourth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a fourth average time series feature; Inputting the fourth average time series feature into the sixth long short-term memory network to extract the time series feature, so as to obtain the fifth average time series feature; Inputting the fifth average time series feature into the fifth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain a sixth average time series feature; Inputting the average flow data into the seventh long short-term memory network to extract time series features, thereby obtaining a seventh average time series feature; Inputting the seventh average time series feature into the sixth convolutional layer to sequentially perform a convolution operation, a batch normalization operation, and a linear rectification operation to obtain an eighth average time series feature; Inputting the eighth average time series feature into the eighth long short-term memory network to extract the time series feature, so as to obtain a ninth average time series feature; splicing the second real-time time series feature, the fifth real-time time series feature, the sixth average time series feature and the ninth average time series feature into a flow time series feature; Each of the detection branch structures includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a first atrous space pyramid pooling layer, a second atrous space pyramid pooling layer and a normalized exponential function; The risk level detection module is also used for: In the detection branch structure corresponding to the mutation level of the network attack on the enterprise, the traffic time series feature is input into the first fully connected layer to perform mapping operation, batch normalization operation and linear rectification operation in sequence to obtain a first detection time series feature; Inputting the first detection time series feature into the first atrous spatial pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a second detection time series feature; splicing the first detection timing feature and the second detection timing feature into a third detection timing feature; Input the third detection time series feature into the second atrous space pyramid pooling layer to sequentially perform a pooling operation, a batch normalization operation, and a linear rectification operation to obtain a fourth detection time series feature; splicing the first detection timing feature and the fourth detection timing feature into a fifth detection timing feature; Inputting the fifth detection time series feature into the second fully connected layer to perform a mapping operation to obtain a sixth detection time series feature; Adding the flow time series feature and the sixth detection time series feature to obtain a seventh detection time series feature; Inputting the seventh detection time series feature into the third fully connected layer to perform a mapping operation to obtain an eighth detection time series feature; The eighth detection time series feature is input into the normalized exponential function to classify the risk level of the enterprise being attacked by network in the future.

4. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk detection method for network attacks according to any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is used to enable a processor to implement the risk detection method for network attacks according to any one of claims 1 to 2 when executed.

Images