Data mining system and method based on computer network security

Abstract

The present application relates to the field of data mining, and specifically discloses a data mining system and method based on computer network security, which first obtains network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from the network security server, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains classification results through a classifier to determine whether to issue an intrusion alarm, thereby better mining the potential relationship between the data, improving the accuracy of the intrusion detection system, reducing the false alarm rate, and helping network administrators to respond quickly.

Description

Technical Field

[0001] The present application relates to the field of data mining, and more specifically, to a data mining system and method based on computer network security. Background Art

[0002] Network security refers to a series of measures and technologies to protect computer networks and their related equipment, systems and data from unauthorized access, use, disclosure, destruction, modification or interference. It involves aspects such as defending against network attacks, identifying and responding to security threats. The goal of network security is to ensure the availability, confidentiality, integrity and reliability of the network to protect the privacy of users and the security of information assets.

[0003] To achieve network security, a variety of security measures need to be taken, such as firewalls, intrusion detection systems, access control, security training, etc. However, existing alarm technologies are often based on rule or signature detection, which is prone to false alarms, causing the system to frequently issue false alarms, which interferes with the administrator's threat judgment.

[0004] Therefore, a data mining system and method based on computer network security is desired. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a data mining system and method based on computer network security, which first obtains network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from a network security server, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains a classification result through a classifier to determine whether to issue an intrusion alarm, thereby better mining the potential relationship between the data, improving the accuracy of the intrusion detection system, reducing the false alarm rate, and helping network administrators to respond quickly.

[0006] According to one aspect of the present application, a data mining system based on computer network security is provided, which includes:

[0007] A network security data acquisition module, used to acquire network traffic data at multiple predetermined time points collected by the intrusion detection system, security event information collected from the network security server, and system logs collected from the network security server;

[0008] A network traffic data feature extraction module, used for extracting features from the network traffic data collected by the intrusion detection system at a plurality of predetermined time points to obtain a network traffic correlation feature vector;

[0009] A security event semantic encoding module, used for performing security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector;

[0010] A system log semantic encoding module, used for performing system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector;

[0011] A log data feature encoding module, used for performing feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector;

[0012] A network security data feature fusion module, used to fuse the network traffic association feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector;

[0013] The intrusion alarm judgment generation module is used to pass the intrusion alarm classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm.

[0014] In the above-mentioned data mining system based on computer network security, the network traffic data feature extraction module includes: a network traffic data arrangement unit, which is used to arrange the network traffic data of multiple predetermined time points collected by the intrusion detection system according to the time dimension to obtain a network traffic input vector; a network traffic feature encoding unit, which is used to feature encode the network traffic input vector to obtain the network traffic associated feature vector.

[0015] In the above-mentioned data mining system based on computer network security, the network traffic feature encoding unit includes: multiplying the network traffic input vector by its transpose to obtain a network traffic association matrix; passing the network traffic association matrix through a network traffic feature encoder based on a convolutional neural network to obtain the network traffic association feature vector.

[0016] In the above-mentioned data mining system based on computer network security, the security event semantic encoding module includes: segmenting the security event information collected from the network security server to obtain multiple security event data items; passing the multiple security event data items through a security event information context encoder including an embedding layer to obtain a security log semantic understanding feature vector.

[0017] In the above-mentioned data mining system based on computer network security, the system log semantic encoding module includes: passing the system log collected from the network security server through a system log context encoder including an embedding layer to obtain multiple system log feature vectors; cascading the multiple system log feature vectors to obtain a system log semantic association feature vector.

[0018] In the above-mentioned data mining system based on computer network security, the log data feature encoding module includes: a log feature association unit, which is used to associate the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log association feature matrix; a log feature encoding unit, which is used to pass the network security log association feature matrix through a network security log feature encoder based on a deep convolutional neural network to obtain the network security log feature vector.

[0019] In the above-mentioned data mining system based on computer network security, the log feature association unit includes: using a joint encoder to jointly encode the security log semantic understanding feature vector and the system log semantic association feature vector using the following association formula to generate the network security log association feature matrix;

[0020] Wherein, the association formula is: ;

[0021] in represents vector multiplication, represents the network security log correlation feature matrix, represents the security log semantic understanding feature vector, represents the system log semantic association feature vector, Represents the semantic association feature vector of the system log.

[0022] In the above-mentioned data mining system based on computer network security, the intrusion alarm judgment generation module includes: calculating the probability density domain dimension derivative difference projection of the network traffic correlation feature vector relative to the network security log feature vector using the following difference projection formula to obtain the intrusion alarm classification feature vector; wherein the difference projection formula is: ;

[0023] in, represents the network traffic correlation feature vector, represents the network security log feature vector, It means adding by position. It means subtracting by position. represents positional division, represents the transpose of a vector, represents the one-norm of a vector, represents the Frobenius norm of the matrix, Represents the intrusion alarm classification feature vector.

[0024] According to another aspect of the present application, a data mining method based on computer network security is provided, which includes:

[0025] Obtaining network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from a network security server;

[0026] Performing feature extraction on the network traffic data collected by the intrusion detection system at a plurality of predetermined time points to obtain a network traffic correlation feature vector;

[0027] Performing security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector;

[0028] Performing system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector;

[0029] Performing feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector;

[0030] Merging the network traffic correlation feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector;

[0031] The intrusion alarm classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm.

[0032] In the above-mentioned data mining method based on computer network security, feature extraction is performed on the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain a network traffic correlation feature vector, including: multiplying the network traffic input vector by its transpose to obtain a network traffic correlation matrix; passing the network traffic correlation matrix through a network traffic feature encoder based on a convolutional neural network to obtain the network traffic correlation feature vector.

[0033] Compared with the prior art, the present application provides a data mining system and method based on computer network security, which first obtains network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from a network security server, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally obtains classification results through a classifier to determine whether to issue an intrusion alarm, thereby better mining the potential relationship between the data, improving the accuracy of the intrusion detection system, reducing the false alarm rate, and helping network administrators respond quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0035] Figure 1 It is a block diagram of a data mining system based on computer network security according to an embodiment of the present application.

[0036] Figure 2 It is a block diagram of a network traffic data feature extraction module in a data mining system based on computer network security according to an embodiment of the present application.

[0037] Figure 3 It is a block diagram of a log data feature encoding module in a data mining system based on computer network security according to an embodiment of the present application.

[0038] Figure 4 Flow chart of a data mining method based on computer network security according to an embodiment of the present application.

[0039] Figure 5 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0040] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0041] Exemplary Systems

[0042] Figure 1 is a block diagram of a data mining system based on computer network security according to an embodiment of the present application. Figure 1As shown, according to the data mining system 100 based on computer network security according to the embodiment of the present application, it includes: a network security data acquisition module 110, which is used to obtain network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from the network security server; a network traffic data feature extraction module 120, which is used to extract features from the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain network traffic correlation feature vectors; a security event semantic encoding module 130, which is used to perform security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector; a system log ... network traffic data feature extraction module 120, which is used to perform security event semantic encoding on the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain a network traffic correlation feature vector; a network traffic data feature extraction module 120, which is used to perform security event semantic encoding on the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain a network traffic correlation feature vector; a network traffic data feature extraction module 120, which is used to perform security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector; a network traffic data feature extraction module 120, which is used to perform security event semantic encoding on the network traffic data at multiple predetermined time points collected by the intrusion detection system The semantic encoding module 140 is used to perform system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector; the log data feature encoding module 150 is used to perform feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector; the network security data feature fusion module 160 is used to fuse the network traffic association feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector; the intrusion alarm judgment generation module 170 is used to pass the intrusion alarm classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm.

[0043] In the above-mentioned data mining system 100 based on computer network security, the network security data acquisition module 110 is used to obtain network traffic data at multiple predetermined time points collected by the intrusion detection system, security event information collected from the network security server, and system logs collected from the network security server. It should be understood that network security refers to a series of measures to protect computer systems and networks from unauthorized access, destruction, theft or destruction. It covers various technologies, policies and practices to prevent malicious hackers, viruses, spyware and other network threats from causing damage to information systems. In order to ensure network security, it is necessary to take a variety of comprehensive security measures, including but not limited to firewalls, intrusion detection systems, access control and security training. However, existing alarm technologies are usually based on rule or signature detection methods, which are prone to false alarms, causing the system to frequently issue false alarms, which interferes with the administrator's threat assessment. Considering that network security data is usually distributed in different systems and devices, including intrusion detection systems, security event information and system logs. Integrating these data can provide a more comprehensive and integrated network security situation, which helps to discover potential security threats. Network traffic data can reveal communication patterns and traffic patterns in the network, which helps to identify abnormal activities and potential intrusion behaviors. Security event information and system logs provide important information about the operating status of the system and applications, which can help analyze user behavior and system operations. Therefore, in the technical solution of this application, by analyzing network traffic data, security event information and system logs, abnormal activities, abnormal access patterns or other abnormal behaviors can be identified, so as to timely discover possible security threats and intrusion events, and determine whether to issue an intrusion alarm.

[0044] In the above-mentioned data mining system 100 based on computer network security, the network traffic data feature extraction module 120 is used to extract features from the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain network traffic related feature vectors. It should be understood that network traffic data is usually high-dimensional and contains a large amount of information. Through feature extraction, the original data can be converted into a more representative and compact feature vector, thereby reducing the dimension of the data and simplifying the data processing and analysis process. By extracting key network traffic features, the intrusion detection system can improve its ability to identify potential threats and its detection efficiency, and help identify normal and abnormal network traffic patterns. Among them, abnormal network traffic patterns may imply potential network attacks or intrusion behaviors, so that abnormal behaviors can be discovered more quickly and corresponding security measures can be taken.

[0045] Figure 2 FIG. 1 is a block diagram of a network traffic data feature extraction module in a data mining system based on computer network security according to an embodiment of the present application. Figure 2As shown, in a specific embodiment of the present application, the network traffic data feature extraction module 120 includes: a network traffic data arrangement unit 121, which is used to arrange the network traffic data of multiple predetermined time points collected by the intrusion detection system according to the time dimension to obtain a network traffic input vector; a network traffic feature encoding unit 122, which is used to feature encode the network traffic input vector to obtain the network traffic associated feature vector. It should be understood that arranging the network traffic data according to the time dimension can form a time series, which is conducive to the application of sequence models and time series analysis methods to identify potential regularities and anomalies, and as part of data preprocessing, prepare for subsequent feature extraction and model training. This data arrangement method helps to integrate and organize data, making data analysis and mining more efficient and accurate.

[0046] Furthermore, through feature encoding, the original network traffic data can be converted into a feature vector with more representation and generalization capabilities. This helps improve the performance of the model, enabling it to better generalize to unseen data, thereby improving the interpretability and separability of the data, thereby improving the training efficiency and accuracy of the model.

[0047] In a specific embodiment of the present application, the network traffic feature encoding unit 122 includes: multiplying the network traffic input vector by its transpose to obtain a network traffic association matrix; passing the network traffic association matrix through a network traffic feature encoder based on a convolutional neural network to obtain the network traffic association feature vector. It should be understood that different features in the network traffic data may affect each other, and the correlation between features can provide information about how the features change together. By calculating the product of the transpose of the network traffic input vector and the original vector, an association matrix can be obtained, in which each element represents the degree of association between corresponding features. This helps to analyze the correlation between different features and discover potential correlations between features. By analyzing the network traffic association matrix, the interactions and influences between features can be revealed, which helps to fully understand the characteristics of network traffic data.

[0048] Furthermore, convolutional neural networks perform well in processing spatial data such as images, and are also suitable for processing network traffic association matrices with spatial structures. Convolutional neural networks can effectively extract local features and spatial relationships, which helps capture the spatial structure and correlation between features in network traffic data. Through feature encoding by convolutional neural networks, abstract feature representations in the network traffic association matrix can be gradually extracted. This helps capture high-level features in the data, thereby better representing the essential characteristics of network traffic data. Convolutional neural networks can model the complex relationships of data through multiple layers of nonlinear transformations, so that the model can better adapt to nonlinear associations and patterns in network traffic data. Specifically, each layer of the network traffic feature encoder based on the convolutional neural network performs the following operations on the input data in the forward pass of the layer: performing convolution processing based on the convolution kernel on the input data to obtain a convolution feature map; performing pooling processing based on the feature matrix on the convolution feature map to obtain a pooled feature map; performing nonlinear activation on the pooled feature map to obtain an activated feature map; wherein the input of the first layer of the network traffic feature encoder based on the convolutional neural network is the network traffic association matrix, and the output of the last layer of the network traffic feature encoder based on the convolutional neural network is the network traffic association feature vector.

[0049] In the above-mentioned data mining system 100 based on computer network security, the security event semantic encoding module 130 is used to perform security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector. It should be understood that security event information may contain a large amount of text descriptions and structured data. Through security event semantic encoding, this information can be converted into a more semantically understandable feature vector, which helps to deeply understand the meaning of the security event and the association behind it. Among them, security event semantic encoding can help extract key features, including the subject, keywords, context, etc. of the event, so as to better represent the content and meaning of the security log data, so as to achieve semantic understanding, thereby improving the efficiency of security event analysis, and supporting model training and application of security events.

[0050] In a specific embodiment of the present application, the security event semantic encoding module 130 includes: segmenting the security event information collected from the network security server to obtain multiple security event data items; passing the multiple security event data items through a security event information context encoder including an embedding layer to obtain a security log semantic understanding feature vector. It should be understood that word segmentation can help extract keywords and phrases in each security event data item, and clean and normalize the security event information, so as to better represent the characteristics and content of the security event. By segmenting the security event information, the text information can be split into smaller semantic units, which helps to better understand the meaning and content represented by each security event data item, so as to improve the efficiency and accuracy of data processing.

[0051] Furthermore, security incidents often do not occur in isolation, and there may be certain associations and contextual information between them. Through the security incident information context encoder, the relationship and contextual information between security incident data items can be effectively captured, which helps to more comprehensively understand the background and association of security incidents. The security incident information context encoder can fuse the semantic information of multiple security incident data items together to obtain feature vectors with more semantic similarity. This helps to identify similar security incidents, discover potential threat patterns and abnormal behaviors. Through the security incident information context encoder containing an embedding layer, multiple security incident data items can be converted into more representative feature vectors, improving the expressiveness and discrimination of the features, which is conducive to subsequent data analysis and processing. Specifically, each of the multiple security event data items is respectively input into the embedding layer of the security event information context encoder including the embedding layer so that the embedding layer converts the multiple security event data items into security event word embedding vectors to obtain a sequence of security event word embedding vectors; the sequence of security event word embedding vectors is input into the converter-based Bert model of the security event information context encoder including the embedding layer to obtain multiple security event word semantic feature vectors; and the multiple security event word semantic feature vectors are cascaded to obtain the security log semantic understanding feature vector.

[0052] In the above-mentioned data mining system 100 based on computer network security, the system log semantic coding module 140 is used to perform system log semantic coding on the system log collected from the network security server to obtain a system log semantic association feature vector. It should be understood that system logs usually contain a large amount of text descriptions and structured data. Through system log semantic coding, this information can be converted into a feature vector with more semantic understanding, which helps to deeply understand the meaning of the system log and the association behind it. System log semantic coding can help extract key features, such as event type, keywords, context, etc., so as to better represent the content and meaning of system log data. The feature vector obtained by system log semantic coding can help discover the association and pattern between system logs, help identify abnormal behavior, detect potential threats, and perform association analysis of security events.

[0053] In a specific embodiment of the present application, the system log semantic encoding module 140 includes: passing the system log collected from the network security server through a system log context encoder containing an embedded layer to obtain multiple system log feature vectors; cascading the multiple system log feature vectors to obtain a system log semantic association feature vector. It should be understood that system logs often contain rich context information. Through the system log context encoder, the association, time sequence, event triggering and other information between system logs can be captured, which helps to more comprehensively understand the background and association of system log data. The system log context encoder can convert system log data into more representative feature vectors to improve the expressiveness and discrimination of features. These feature vectors can help distinguish different types of system logs and identify abnormal patterns and behaviors. The feature vectors obtained by the system log context encoder can reflect the semantic similarity between system logs, help to discover similar system log events, identify potential threat patterns and abnormal behaviors, so as to better capture the association and context information between system logs, improve feature representation capabilities, and support data processing and system log analysis. Specifically, the system log collected from the network security server is segmented to obtain a system log word sequence; the embedding layer of the system log context encoder including the embedding layer is used to map each word in the system log word sequence into a word embedding vector to obtain a sequence of system log word embedding vectors; the sequence of system log word embedding vectors is semantically encoded based on global context using a converter-based Bert model of the system log context encoder including the embedding layer to obtain multiple system log feature vectors.

[0054] Furthermore, different system log feature vectors may contain different information and features. Cascading these feature vectors can integrate the information of different system logs to enrich the representation of system log data, thereby comprehensively considering the characteristics of multiple system logs and more comprehensively representing the semantic associations of system log data, thereby providing more information to support subsequent analysis and decision-making.

[0055] In the above-mentioned data mining system 100 based on computer network security, the log data feature encoding module 150 is used to feature encode the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector. It should be understood that the security log semantic understanding feature vector and the system log semantic association feature vector contain information at different levels, and this information can be integrated through feature encoding to generate a more comprehensive network security log feature vector. Feature encoding can standardize the features so that the features have a uniform scale and distribution, which helps to improve the stability and convergence speed of the model. The network security log feature vector that has been feature encoded can reduce the complexity of the feature space, simplify the difficulty of data processing and model training, and improve the efficiency and performance of the model.

[0056] Figure 3 FIG. 1 is a block diagram of a log data feature encoding module in a data mining system based on computer network security according to an embodiment of the present application. Figure 3 As shown, in a specific embodiment of the present application, the log data feature encoding module 150 includes: a log feature association unit 151, which is used to associate the security log semantic understanding feature vector with the system log semantic association feature vector to obtain a network security log association feature matrix; a log feature encoding unit 152, which is used to pass the network security log association feature matrix through a network security log feature encoder based on a deep convolutional neural network to obtain the network security log feature vector. It should be understood that by associating the security log semantic understanding feature vector with the system log semantic association feature vector, the content of the security log data and the association between different system logs can be comprehensively considered to generate a more comprehensive network security log feature representation, thereby enriching the feature representation and providing more information to support subsequent network security analysis and decision-making.

[0057] Furthermore, the deep convolutional neural network has excellent feature extraction capabilities when processing data such as images and texts, and can effectively extract abstract and advanced feature representations from the network security log associated feature matrix. Among them, network security log data usually contains a large amount of information and complex associations, and the deep convolutional neural network can better handle this complexity and extract important features from the data. The feature encoder based on the deep convolutional neural network can extract more representative and rich feature representations, thereby supporting data analysis and security incident processing in the field of network security. Specifically, each layer of the network security log feature encoder based on the deep convolutional neural network is used to perform convolution processing, pooling processing and nonlinear activation processing on the input data in the forward pass of the layer to output the network security log feature vector by the last layer of the network security log feature encoder based on the deep convolutional neural network, wherein the input of the network security log feature encoder based on the deep convolutional neural network is the network security log associated feature matrix.

[0058] In a specific embodiment of the present application, the log feature association unit 151 includes: using a joint encoder to jointly encode the security log semantic understanding feature vector and the system log semantic association feature vector using the following association formula to generate the network security log association feature matrix; wherein the association formula is: ;

[0059] in represents vector multiplication, represents the network security log correlation feature matrix, represents the security log semantic understanding feature vector, represents the semantic association feature vector of the system log, Represents the semantic association feature vector of the system log.

[0060] In the above-mentioned data mining system 100 based on computer network security, the network security data feature fusion module 160 is used to fuse the network traffic associated feature vector and the network security log feature vector to obtain the intrusion alarm classification feature vector. It should be understood that both network traffic and network security log data contain important security information. By fusing the feature vectors of the two, the information of different data sources can be comprehensively considered, the richness of feature representation can be enhanced, and the accuracy and robustness of the intrusion detection system can be improved.

[0061] In particular, in the technical solution of the present application, it is considered that the network traffic associated feature vector and the network security log feature vector come from different source data distributions. Specifically, the network traffic data and the security log data usually come from different systems and devices. The network traffic data mainly reflects the network communication situation, while the security log data mainly records the operating status, events and abnormal situations of the system and application. Therefore, there may be large differences in the information content, distribution characteristics and data structure they contain. Network traffic data is usually continuous numerical data, while security log data may be structured text data. This difference in data type will lead to large differences in feature extraction and representation. Due to the different sources and properties of network traffic data and security log data, they may have significant differences in probability density distribution. This difference will cause the feature vector to be unevenly distributed in the feature space, thereby affecting the effect of feature fusion and the performance of the classifier. That is, since the network traffic associated feature vector and the network security log feature vector come from different data distributions, they may have large differences in the feature space, resulting in a probability density imbalance during the fusion process. This imbalance may affect the robustness of the feature manifold of the intrusion alarm classification feature vector, making the classifier face greater challenges in the classification process and reducing the accuracy of the classification results. Based on this, the probability density domain dimension derivative difference projection of the network traffic correlation feature vector relative to the network security log feature vector is calculated to obtain the intrusion alarm classification feature vector.

[0062] Specifically, the following difference projection formula is used to calculate the probability density domain dimension derivative difference projection of the network traffic correlation feature vector relative to the network security log feature vector to obtain the intrusion alarm classification feature vector; wherein the difference projection formula is:

[0063] ;

[0064] in, represents the network traffic correlation feature vector, represents the network security log feature vector, It means adding by position. It means subtracting by position. represents positional division, represents the transpose of a vector, represents the one-norm of a vector, represents the Frobenius norm of the matrix, Represents the intrusion alarm classification feature vector.

[0065] That is, considering that the network traffic association feature vector and the network security log feature vector come from different source data distributions, the network traffic association feature vector will have a probability density domain dimension derivative difference relative to the network security log feature vector, resulting in an imbalance in the probability density between each position in the intrusion alarm classification feature vector in the process of fusing the network traffic association feature vector and the network security log feature vector to obtain the intrusion alarm classification feature vector, which reduces the robustness of the feature manifold of the intrusion alarm classification feature vector, thereby affecting the accuracy of the classification result obtained by the classifier.

[0066] In view of the above technical problems, in the technical solution of the present application, the probability density domain dimension derivative difference projection of the network traffic associated feature vector relative to the network security log feature vector is calculated to obtain the intrusion alarm classification feature vector, which performs depth perception of the full scene homography association matrix of the vector based on the feature-based depth characteristics represented by the vector to align the feature vector based on the homography of the scene depth flow. In this way, the network traffic associated feature vector and the network security log feature vector have similar probability density distributions in the same probability density domain, thereby eliminating or reducing the probability density domain dimension derivative difference between the two, and improving the balance of the probability density between each position in the intrusion alarm classification feature vector.

[0067] In the above-mentioned data mining system 100 based on computer network security, the intrusion alarm judgment generation module 170 is used to pass the intrusion alarm classification feature vector through the classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm. It should be understood that the classifier can learn the characteristics and patterns between different categories based on the training data, thereby improving the accuracy and reliability of the intrusion alarm classification, so as to quickly and accurately determine the severity and urgency of the intrusion alarm and take appropriate response measures.

[0068] In summary, the embodiment of the present application first obtains network traffic data at multiple predetermined time points collected by the intrusion detection system, security event information collected from the network security server, and system logs collected from the network security server, and then uses deep learning technology to perform feature extraction and correlation analysis on the three. Finally, a classification result is obtained through a classifier to determine whether to issue an intrusion alarm, thereby better mining the potential relationship between the data, so as to improve the accuracy of the intrusion detection system, reduce the false alarm rate, and help network administrators respond quickly.

[0069] As described above, the data mining system 100 based on computer network security according to the embodiment of the present application can be implemented in various terminal devices, such as a server deployed with a data mining algorithm based on computer network security. In one example, the data mining system 100 based on computer network security can be integrated into the terminal device as a software module and / or a hardware module. For example, the data mining system 100 based on computer network security can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the data mining system 100 based on computer network security can also be one of the many hardware modules of the terminal device.

[0070] Alternatively, in another example, the computer network security-based data mining system 100 and the terminal device may be separate devices, and the computer network security-based data mining system 100 may be connected to the terminal device via a wired and / or wireless network and transmit interactive information in an agreed data format.

[0071] Exemplary Methods

[0072] Figure 4 This is a flow chart of a data mining method based on computer network security according to an embodiment of the present application. Figure 4 As shown, according to the data mining method based on computer network security of the embodiment of the present application, it includes: S110, obtaining network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from a network security server; S120, performing feature extraction on the network traffic data at multiple predetermined time points collected by the intrusion detection system to obtain a network traffic association feature vector; S130, performing security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector; S140, performing system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector; S150, performing feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector; S160, fusing the network traffic association feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector; S170, passing the intrusion alarm classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm.

[0073] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned data mining method based on computer network security have been referred to above. Figures 1 to 3The invention has been described in detail in the description of the data mining system based on computer network security, and therefore, its repeated description will be omitted.

[0074] Exemplary Electronic Devices

[0075] Below, reference Figure 5 To describe an electronic device according to an embodiment of the present application.

[0076] like Figure 5 As shown, the electronic device 10 includes an input device 11, an input interface 12, a central processing unit 13, a memory 14, an output interface 15, an output device 16, and a bus 17. The input interface 12, the central processing unit 13, the memory 14, and the output interface 15 are connected to each other through the bus 17, and the input device 11 and the output device 16 are connected to the bus 17 through the input interface 12 and the output interface 15, respectively, and then connected to other components of the electronic device 10.

[0077] Specifically, the input device 11 receives input information from the outside and transmits the input information to the central processing unit 13 through the input interface 12; the central processing unit 13 processes the input information based on the computer executable instructions stored in the memory 14 to generate output information, temporarily or permanently stores the output information in the memory 14, and then transmits the output information to the output device 16 through the output interface 15; the output device 16 outputs the output information to the outside of the electronic device 10 for user use.

[0078] In one embodiment, Figure 5 The electronic device 10 shown can be implemented as a network device, which may include: a memory configured to store programs; a processor configured to run the programs stored in the memory to execute any one of the data mining methods based on computer network security described in the above embodiments.

[0079] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0080] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

Claims

1. A data mining system based on computer network security, characterized in that: include: A network security data acquisition module, used to acquire network traffic data at multiple predetermined time points collected by the intrusion detection system, security event information collected from the network security server, and system logs collected from the network security server; A network traffic data feature extraction module, used for extracting features from the network traffic data collected by the intrusion detection system at a plurality of predetermined time points to obtain a network traffic correlation feature vector; A security event semantic encoding module, used for performing security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector; A system log semantic encoding module, used for performing system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector; A log data feature encoding module, used for performing feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector; A network security data feature fusion module, used to fuse the network traffic association feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector; An intrusion alarm judgment generation module, used for passing the intrusion alarm classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm; Wherein, the intrusion alarm judgment generation module includes: The following difference projection formula is used to calculate the probability density domain dimension derivative difference projection of the network traffic correlation feature vector relative to the network security log feature vector to obtain the intrusion alarm classification feature vector; wherein the difference projection formula is: ； in, represents the network traffic correlation feature vector, represents the network security log feature vector, It means adding by position. It means subtracting by position. represents positional division, represents the transpose of a vector, represents the one-norm of a vector, represents the Frobenius norm of the matrix, Represents the intrusion alarm classification feature vector.

2. The data mining system based on computer network security according to claim 1 is characterized in that: The network traffic data feature extraction module includes: A network traffic data arranging unit, configured to arrange the network traffic data collected by the intrusion detection system at a plurality of predetermined time points according to a time dimension to obtain a network traffic input vector; The network traffic feature encoding unit is used to perform feature encoding on the network traffic input vector to obtain the network traffic associated feature vector.

3. The data mining system based on computer network security according to claim 2 is characterized in that: The network traffic feature encoding unit comprises: Multiplying the network traffic input vector by its transpose to obtain a network traffic correlation matrix; The network traffic correlation matrix is ​​passed through a network traffic feature encoder based on a convolutional neural network to obtain the network traffic correlation feature vector.

4. The data mining system based on computer network security according to claim 3 is characterized in that: The security event semantic encoding module includes: Segmenting the security event information collected from the network security server to obtain a plurality of security event data items; The multiple security event data items are passed through a security event information context encoder including an embedding layer to obtain a security log semantic understanding feature vector.

5. The data mining system based on computer network security according to claim 4 is characterized in that: The system log semantic encoding module includes: Passing the system log collected from the network security server through a system log context encoder including an embedding layer to obtain a plurality of system log feature vectors; The multiple system log feature vectors are cascaded to obtain a system log semantic association feature vector.

6. The data mining system based on computer network security according to claim 5 is characterized in that: The log data feature encoding module includes: A log feature association unit, used to associate the security log semantic understanding feature vector with the system log semantic association feature vector to obtain a network security log association feature matrix; The log feature encoding unit is used to obtain the network security log feature vector by passing the network security log correlation feature matrix through a network security log feature encoder based on a deep convolutional neural network.

7. The data mining system based on computer network security according to claim 6 is characterized in that: The log feature association unit includes: Using a joint encoder to jointly encode the security log semantic understanding feature vector and the system log semantic association feature vector using the following association formula to generate the network security log association feature matrix; Wherein, the association formula is: ； in represents vector multiplication, represents the network security log correlation feature matrix, represents the security log semantic understanding feature vector, represents the semantic association feature vector of the system log, Represents the semantic association feature vector of the system log.

8. A data mining method based on computer network security, using the data mining system based on computer network security according to claim 1, characterized in that: include: Obtaining network traffic data at multiple predetermined time points collected by an intrusion detection system, security event information collected from a network security server, and system logs collected from a network security server; Performing feature extraction on the network traffic data collected by the intrusion detection system at a plurality of predetermined time points to obtain a network traffic correlation feature vector; Performing security event semantic encoding on the security event information collected from the network security server to obtain a security log semantic understanding feature vector; Performing system log semantic encoding on the system log collected from the network security server to obtain a system log semantic association feature vector; Performing feature encoding on the security log semantic understanding feature vector and the system log semantic association feature vector to obtain a network security log feature vector; Merging the network traffic correlation feature vector and the network security log feature vector to obtain an intrusion alarm classification feature vector; The intrusion alarm classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to determine whether to issue an intrusion alarm.

9. The data mining method based on computer network security according to claim 8, characterized in that: Extracting features from the network traffic data collected by the intrusion detection system at a plurality of predetermined time points to obtain network traffic correlation feature vectors includes: Multiplying the network traffic input vector by its transpose to obtain a network traffic correlation matrix; The network traffic correlation matrix is ​​passed through a network traffic feature encoder based on a convolutional neural network to obtain the network traffic correlation feature vector.

Images