A network security defense method and system for autonomous identification and attack monitoring

Abstract

The present invention discloses a network security defense method for autonomous identification and attack monitoring, which relates to the field of network security technology, including real-time data collection and preprocessing, and establishing an abnormal database through a twin training model to form an abnormal data source; the inspection assistant uses an autonomous identification model to judge the essence of the attack behavior according to the number of trigger sources, triggers the threat intelligence analysis library and adopts a multi-level defense deployment; when there is no trigger data source system to remain normal, the abnormal inspection assistant is used to perform full-process detection of abnormal behavior and perform feedback optimization. The present invention reduces the possibility of false alarms and missed alarms, reduces the need for manual intervention, realizes the rapid acquisition and organization of network data, makes subsequent analysis and processing more accurate and efficient, and provides data support for subsequent defense strategies.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security defense method and system for autonomously identifying attack monitoring. Background Art

[0002] With the popularization of the Internet and the development of information technology, network security issues are becoming increasingly severe, and various network attack methods are emerging in an endless stream. In order to protect the security of information systems, researchers have proposed many network security defense technologies. Among them, autonomous identification of attack monitoring technology is an important research direction. This technology realizes the effective identification and defense of network attacks by real-time data collection, analysis of abnormal behavior, and multi-level defense deployment.

[0003] In the development of autonomous attack detection and monitoring technology, researchers have proposed many different methods. Early methods mainly rely on rule-based defense strategies, which trigger defense measures by monitoring network traffic in real time and matching attack features. However, due to the continuous evolution of attack methods, rule-based methods have gradually exposed their limitations, such as high false alarm rate and poor adaptability.

[0004] In order to solve these problems, in recent years, autonomous attack identification monitoring methods based on machine learning technology have emerged. This type of method recognizes normal and abnormal data by training models, thereby realizing automatic identification of network attacks. Among them, the twin training model, as an efficient learning method, improves the model's ability to identify attack behaviors by constructing a twin model of normal data and abnormal data.

[0005] Although the existing autonomous attack detection and monitoring technologies have made some progress, there are still some problems in practical applications. For example, existing methods often rely on a single data source and are easily affected by data source anomalies, resulting in false positives or false negatives. In addition, existing methods often require manual intervention when dealing with complex attack behaviors, which reduces the degree of automation of defense.

[0006] Traditional network security defense methods mainly rely on preset rules and signatures, and lack the ability to effectively identify and defend against unknown and variant attack methods. Secondly, existing network security defense systems can only respond to known attack behaviors, but cannot predict and prevent potential attack behaviors. In addition, existing network security defense systems often lack adaptability and cannot automatically adjust defense strategies according to changes in the network environment. Summary of the invention

[0007] In view of the above existing problems, the present invention is proposed. The present invention collects data in real time and performs preprocessing, uses a twin training model to establish an anomaly database, autonomously identifies the essence of attack behavior and adopts a multi-level defense deployment, combines a threat intelligence analysis library to implement a primary defense strategy, and uses an abnormal inspection assistant to perform full-process detection and feedback optimization of abnormal behavior. The present invention can effectively identify and defend against unknown attacks and variant attacks, improve network security defense capabilities, and is suitable for network security protection, information security detection and defense, and other fields.

[0008] In order to solve the above technical problems, a network security defense method for autonomous identification and attack monitoring is proposed, including real-time data collection and preprocessing, and establishing an anomaly database through a twin training model to form an abnormal data source; the inspection assistant uses an autonomous identification model to judge the essence of the attack behavior according to the number of trigger sources, triggers the threat intelligence analysis library and adopts a multi-level defense deployment; when there is no trigger data source and the system remains normal, the abnormal inspection assistant is used to perform full-process detection of abnormal behavior and perform feedback optimization.

[0009] As a preferred solution of the network security defense method for autonomous identification of attack monitoring described in the present invention, the establishment of an abnormal database includes deploying UTM equipment at the network boundary 1 cm away from the firewall and router for data collection, deploying syslog servers on key servers and core switches to collect data, and using inspection factors to collect and transmit data in series. After preprocessing, the data is input into the twin training model for multi-level training, and the abnormal data and data that may have abnormalities in the twin model are summarized to form an abnormal database.

[0010] The anomaly database includes access and maintenance control attack classes, data security and privacy attack classes, authentication and session management attack classes, and network infrastructure and transport attack classes.

[0011] As a preferred solution of the network security defense method for autonomous identification and attack monitoring described in the present invention, the twin training model includes establishing an abnormal database through three-level training of the twin training model to form a data source: inputting preprocessed transmission data, each sub-network independently extracts key features of the input data through multiple neural network layers, and performs first-level similarity measurement training, second-level joint training and third-level boundary decision training. Through multiple iterative training, the model will improve its ability to distinguish between normal and abnormal data, store the abnormal data at the end of training in the abnormal database, and compare the boundary decision results of normal data and abnormal data to form an abnormal data source.

[0012] The first-level similarity metric training includes using the extracted feature vector as input to calculate the similarity score :

[0013] ;

[0014] The second level of joint training involves the model learning feature extraction and similarity measurement simultaneously, and adjusting model parameters by comparing the results:

[0015] ;

[0016] The third level boundary decision training includes using the similarity score as input to train the decision boundary to determine whether the data sample is abnormal:

[0017] ;

[0018] when When , it means that the input data sample is very consistent with the normal data and is judged to be normal. When , it means that the input data sample is inconsistent with the normal data, it is judged to be abnormal, marked as abnormal data and stored in the abnormal database to form the data source.

[0019] in, , are the feature vectors of normal and abnormal behaviors of the i-th group training, It is the parameter of the information filtering function that adjusts the importance weights of different features. is the dimension of the feature vector, is the standard deviation of the Gaussian function, which is used to control the degree of smoothing of the similarity score; is the specified range of the eigenvector [0, 1], are the updated model parameters, is the set of model parameters, is the learning rate, which controls the step size of parameter update; Represents the model parameters The gradient of is the difference between the similarity measure S and the true label Y; Y is the true label, indicating and whether they belong to the same category; The extracted key feature vectors, is the similarity measurement function, is the weight factor of the similarity score of the i-th group, and is a parameter that affects the shape and extent of the boundary, is the similarity score of the i-th group of data samples, and is a parameter that adjusts the effect of the similarity score on the final decision.

[0020] As a preferred solution of the network security defense method for autonomous identification and attack monitoring described in the present invention, wherein: the data source includes maintaining full inspection monitoring and autonomously optimizing to adapt to different network conditions when no system abnormality is found and no data source is triggered during the monitoring process of the abnormal inspection assistant;

[0021] When the abnormal inspection assistant detects that the system is attacked and a single data source is triggered in the network data connected in series by the abnormal inspection assistant, the abnormal inspection assistant immediately locates the attack point and takes preliminary defense measures to prevent the fault from getting worse due to the attack. At the same time, the abnormal inspection assistant sends the attack sequence and the data source to the autonomous recognition model for attack behavior identification. According to the specific attack behavior, the corresponding defense measures are called. After the treatment is completed, the current treatment process is saved into the system. When the same problem occurs again, the abnormal inspection assistant directly takes the corresponding defense measures and sends the attack sequence to the recognition model to detect whether there is any attack behavior. If there is any attack behavior, the defense strategy is re-formulated and returned to the abnormal inspection assistant to re-execute the new defense strategy. If there is no attack behavior, it returns to the abnormal inspection assistant to notify that the measures will not be changed.

[0022] When the abnormal inspection assistant detects that the system is under attack and triggers multiple data sources in the network data connected in series by the abnormal inspection assistant, the system sends multiple abnormal inspection assistants to locate the attack point and take preliminary defense measures to control and prevent the attack from worsening. It notifies the staff and triggers the threat intelligence analysis library to analyze and sort the attack sequence, sends the output results and the attack sequence to the autonomous recognition model for attack behavior identification, and forms a new comprehensive defense strategy based on the output results and expert opinions for disposal and storage in the system.

[0023] As a preferred solution of the network security defense method for autonomous identification attack monitoring described in the present invention, the autonomous identification model includes receiving the attack sequence sent by the abnormal inspection assistant and the data source to identify abnormal attack behavior, and the Sigmoid function is used to express it as follows:

[0024] ;

[0025] Set the attack threshold a, when When it is less than a, it is considered that no attack behavior is detected. When it is greater than a, it is considered that an attack is detected, and according to the output Probability value, judge the probability of different attack behaviors, and mark the behavior with P=1 as attack behavior;

[0026] in, is the behavior recognition function, is a normalization function used to normalize the signals of all data sources to the same range. Determine the input change of data source j at time t, is the trust function of data source j, and the weight is given according to the reliability of the data source. I is the attack sequence. The time difference from data source j to the attack occurrence, Extract useful information from the data of data source j at time t, is the information filtering value, and is the start and end time, is to determine the input change of data source i at time t Whether the threshold is exceeded.

[0027] As a preferred solution of the network security defense method for autonomous identification and attack monitoring described in the present invention, the threat intelligence analysis library includes taking multiple data sources as input to fuse attack data, and scoring and sorting the fused results:

[0028] ;

[0029] in, is the attack score function that calculates the final attack score, The weight of the corresponding data source adjusts the impact of different data sources on the final score. It is to integrate the attack data from different data sources. It is a complex information filtering function to extract key information.

[0030] As a preferred solution of the network security defense method for autonomous identification and attack monitoring described in the present invention, the feedback optimization includes continuously optimizing the system when no system abnormality is found during the monitoring process of the abnormal inspection assistant, so that the system can adapt to different network environments. When the abnormal inspection assistant detects an attack, after the disposal is completed, feedback is given to the system interruption for learning and model updating:

[0031] ;

[0032] in, is the updated system status. Indicates improved system performance. Indicates that system performance has degraded; represents the system state at time t, To measure the difference between network environment and system status, represents the network environment status at time t, represents the abnormality of the output system at time t, Indicates the comparability of abnormality levels, Indicates the identified effective abnormal signal. Indicates adjusting system parameters based on anomaly detection results. Indicates that the optimization intensity is adjusted according to the degree of abnormality. Represents system parameters, Indicates the system parameter adjustment amount, Represents the learning rate function, which controls the speed of learning and model updating. Indicates learning and model updating based on feedback, Indicates that the model was updated successfully. Indicates that the model update failed; Indicates the average value of the normal state of the system.

[0033] Another object of the present invention is to provide a network security defense system for autonomous attack identification and monitoring. The present invention solves the problems of slow response of network attack monitoring, low accuracy of anomaly identification, inflexible defense strategy formulation, poor system adaptability and low operation accuracy in the prior art through real-time data collection and preprocessing, twin training model and anomaly database construction, autonomous identification model application, threat intelligence analysis library integration, anomaly inspection assistant and feedback optimization.

[0034] As a preferred solution of the network security defense system for autonomous identification and attack monitoring described in the present invention, it is characterized by including a data acquisition and preprocessing module, a twin training model and anomaly database module, an autonomous identification model module, a threat intelligence analysis library module, an anomaly inspection assistant module and a feedback optimization module.

[0035] The data acquisition and preprocessing module acquires network data in real time and performs preprocessing on the data, including cleaning and formatting, to facilitate subsequent analysis.

[0036] The twin training model and abnormal database module utilizes the collected data to perform training through the twin training model, establishes an abnormal database, stores abnormal data, identifies normal and abnormal data through the training model, and stores the abnormal data for subsequent analysis and defense.

[0037] The autonomous identification model module, when the system detects an attack, determines the nature of the attack behavior according to the autonomous identification model, takes corresponding defense measures, automatically identifies the attack behavior, and responds quickly to reduce the damage caused by the attack.

[0038] The threat intelligence analysis library module, when triggering multiple data sources, uses the threat intelligence analysis library to analyze the attack sequence, and formulates a new defense strategy based on the analysis results, deeply analyzes the attack behavior, and formulates an effective defense strategy.

[0039] The abnormal inspection assistant module performs abnormal behavior detection when no attack is detected, and takes preliminary defense measures when an attack is detected, monitors the network status in real time, and promptly discovers and handles abnormal situations.

[0040] The feedback optimization module continuously performs optimization learning according to the operation status of the system, adapts to different network environments, and improves operation accuracy.

[0041] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the method described in the network security defense of autonomous identification and attack monitoring are implemented.

[0042] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the method described in the network security defense of autonomous identification and attack monitoring are implemented.

[0043] The beneficial effects of the present invention are as follows: The present invention solves the problems in the prior art that the network security defense system has insufficient recognition ability for unknown attack behaviors, single defense measures, and cannot adapt to complex and changeable network environments. By constructing an abnormal database and an autonomous recognition model, normal and abnormal data are comprehensively identified, the recognition ability for unknown attack behaviors is improved, and human intervention is reduced; when an attack behavior is detected, the system can quickly locate the attack point and take preliminary defense measures, and provide multi-level defense measures to achieve rapid acquisition and organization of network data to form a complex and changeable network. Through the twin training model, an abnormal database is established to form an abnormal data source, which realizes rapid identification and classification of abnormal behaviors. The present invention effectively identifies and defends against unknown attacks and variant attacks, and improves network security defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work, among which:

[0045] Figure 1 An overall flow chart of a network security defense method for autonomously identifying attack monitoring provided by an embodiment of the present invention.

[0046] Figure 2 A performance comparison diagram of a network security defense method for autonomously identifying attack monitoring provided by an embodiment of the present invention.

[0047] Figure 3A system functional architecture diagram of a network security defense system for autonomous attack identification and monitoring provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0049] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0050] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it an embodiment that is mutually exclusive with other embodiments, either individually or selectively.

[0051] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0052] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0053] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0054] Example 1

[0055] Reference Figure 1 , which is the first embodiment of the present invention, and provides a network security defense method for autonomously identifying attack monitoring, comprising:

[0056] S1: Collect and preprocess data in real time, and establish an abnormal database through the twin training model to form an abnormal data source.

[0057] Furthermore, UTM devices are deployed at the network boundary 1 cm away from firewalls and routers for data collection, syslog servers are deployed on key servers and core switches to collect data, and inspection factors are used to collect and transmit data in series. After preprocessing, the data is input into the twin training model for multi-level training, and the abnormal data and data that may exist abnormalities in the twin model are summarized to form an abnormal database.

[0058] The anomaly database includes access and maintenance control attack classes, data security and privacy attack classes, authentication and session management attack classes, and network infrastructure and transport attack classes.

[0059] Preferably, the access and maintenance control attack categories include: unauthorized access attempt records including password cracking and brute force cracking attempts; traffic patterns and statistics of denial of service attacks DoS and DDoS; service abuse behaviors, such as logs of vulnerability scans and vulnerability exploitation attempts.

[0060] The data security and privacy attack category includes: malicious code execution events, such as detection records of viruses, worms, and Trojan horses; logs of information leakage and theft activities, including network sniffing, data leakage, and social engineering attacks; file and database access logs, which are used to detect abnormal data access patterns.

[0061] The authentication and session management attack category includes: records of spoofing and impersonation attacks, such as IP address spoofing, DNS spoofing, and email forgery; application layer attack events, including logs of web application attacks, API abuse, and session hijacking; and logs of authentication mechanisms, including successful, failed, and abnormal authentication attempts.

[0062] The network infrastructure and transport attack category includes: logs of network infrastructure attacks, such as attacks on routers, DNS servers, and firewalls; detection and response records of IDS / IPS evasion techniques; and abnormal patterns in network traffic and transport layers, such as abnormal packet sizes, transmission times, and protocol usage.

[0063] Preferably, the set value of 1 cm is the most preferred value of the technology. Considering the network environment and the actual application scenarios, if the placement position is less than or equal to 0.9 cm from the network boundary, the requirements for environmental conditions and sensor sensitivity and accuracy are too high, which are difficult to meet in the actual production process and will cause large error fluctuations, which will become a bottleneck of the network, bring great difficulties to data acquisition, and lead to decreased network performance; if the placement position is greater than or equal to 1.1 cm from the network boundary, it will cause a large error in measurement accuracy, while minimizing the impact on the internal network structure.

[0064] It should be noted that data collection and preprocessing uses multimodal learning technology to collect not only network traffic data, but also host logs, application layer protocols, user behavior and other information. Deep learning technology is used to extract and fuse features from multi-source data to generate high-dimensional feature vectors:

[0065] ;

[0066] in, Represents the high-dimensional feature vector after deep learning processing, represents the deep learning feature extraction function, is the fused high-dimensional feature vector, is the activation function, W is the weight matrix of the deep learning network, is the bias vector of the deep learning network.

[0067] It should also be noted that the abnormal database is established through the three-level training of the twin training model to form a data source: the preprocessed transmission data is input, each sub-network independently extracts the key features of the input data through multiple neural network layers, and performs the first-level similarity measurement training, the second-level joint training and the third-level boundary decision training. Through multiple iterative training, the model will improve its ability to distinguish between normal and abnormal data, store the abnormal data at the end of training in the abnormal database, and compare the boundary decision results of normal data and abnormal data to form an abnormal data source.

[0068] The first-level similarity metric training includes using the extracted feature vector as input to calculate the similarity score :

[0069] ;

[0070] The second level of joint training involves the model learning feature extraction and similarity measurement simultaneously, and adjusting model parameters by comparing the results:

[0071] ;

[0072] The third level boundary decision training includes using the similarity score as input to train the decision boundary to determine whether the data sample is abnormal:

[0073] ;

[0074] when When , it means that the input data sample is very consistent with the normal data and is judged to be normal. When , it means that the input data sample is inconsistent with the normal data, and it is judged to be abnormal. The abnormal data is marked and stored in the abnormal database to form the data source;

[0075] in, , are the feature vectors of normal and abnormal behaviors of the i-th group training, It is the parameter of the information filtering function that adjusts the importance weights of different features. is the dimension of the feature vector, is the standard deviation of the Gaussian function, which is used to control the degree of smoothing of the similarity score; is the specified range of the eigenvector [0, 1], are the updated model parameters, is the set of model parameters, is the learning rate, which controls the step size of parameter update; Represents the model parameters The gradient of is the difference between the similarity measure S and the true label Y; Y is the true label, indicating and whether they belong to the same category; The extracted key feature vectors, is the similarity measurement function, is the weight factor of the similarity score of the i-th group, and is a parameter that affects the shape and extent of the boundary, is the similarity score of the i-th group of data samples, and is a parameter that adjusts the effect of the similarity score on the final decision.

[0076] It should also be noted that when no system abnormalities are found and no data source is triggered during the monitoring process of the abnormal inspection assistant, the entire inspection and monitoring process is maintained and autonomous optimization is performed to adapt to different network conditions.

[0077] When the abnormal inspection assistant detects that the system is attacked and a single data source is triggered in the network data connected in series by the abnormal inspection assistant, the abnormal inspection assistant immediately locates the attack point and takes preliminary defense measures to prevent the fault from getting worse due to the attack. At the same time, the abnormal inspection assistant sends the attack sequence and the data source to the autonomous recognition model for attack behavior identification. According to the specific attack behavior, the corresponding defense measures are called. After the disposal is completed, the disposal process is saved into the system. When the same problem occurs again, the abnormal inspection assistant directly takes the corresponding defense measures and sends the attack sequence to the recognition model to detect whether there are other attack behaviors. If there are, the defense strategy is re-formulated and returned to the abnormal inspection assistant to re-execute the new defense strategy. If not, the abnormal inspection assistant is returned to notify that the measures will not be changed.

[0078] When the abnormal inspection assistant detects that the system is under attack and triggers multiple data sources in the network data connected in series by the abnormal inspection assistant, the system sends multiple abnormal inspection assistants to locate the attack point and take preliminary defense measures to control and prevent the attack from worsening. It notifies the staff and triggers the threat intelligence analysis library to analyze and sort the attack sequence, sends the output results and the attack sequence to the autonomous recognition model for attack behavior identification, and forms a new comprehensive defense strategy based on the output results and expert opinions for disposal and storage in the system.

[0079] S2: The inspection assistant uses the autonomous identification model to determine the essence of the attack behavior based on the number of trigger sources, triggers the threat intelligence analysis library and adopts multi-level defense deployment.

[0080] Furthermore, the attack sequence sent by the abnormal inspection assistant is accepted and the data source is used to identify abnormal attack behaviors. The Sigmoid function is expressed as follows:

[0081] ;

[0082] Set the attack threshold a, when When it is less than a, it is considered that no attack behavior is detected. When it is greater than a, it is considered that an attack is detected, and according to the output Probability value, judge the probability of different attack behaviors, and mark the behavior with P=1 as attack behavior;

[0083] in, is the behavior recognition function, is a normalization function used to normalize the signals of all data sources to the same range. Determine the input change of data source j at time t, is the trust function of data source j, and the weight is given according to the reliability of the data source. I is the attack sequence. The time difference from data source j to the attack occurrence, Extract useful information from the data of data source j at time t, is the information filtering value, and is the start and end time, is to determine the input change of data source i at time t Whether the threshold is exceeded.

[0084] Preferably, a supervised learning algorithm is combined to train the labeled attack data using a deep neural network, with a deep neural network having L layers, each layer containing neurons, where l represents the index of the layer, l=1, 2, ..., L, the input layer is the first layer, and the output layer is the Lth layer:

[0085] ;

[0086] in, denote the bias of the lth layer, represents the activation function, v represents the input data, u represents the true label, and m represents the number of training samples.

[0087] Furthermore, the threat intelligence analysis library includes attack data fusion using multiple data sources as input, and scoring and ranking the fusion results:

[0088] ;

[0089] in, is the attack score function that calculates the final attack score, The weight of the corresponding data source adjusts the impact of different data sources on the final score. It is to integrate the attack data from different data sources. It is a complex information filtering function to extract key information.

[0090] It should be noted that adaptive decision-making is performed to dynamically adjust the branches and leaf nodes of the decision tree according to real-time data and defense effects; the decision tree is used to determine the type and severity of the attack and determine the corresponding defense measures.

[0091] Based on the results of the decision tree, deploy a multi-level defense strategy, including access control, intrusion detection, malicious code protection, etc. Dynamically change the network configuration and attributes through mobile target defense to increase the difficulty of attack for attackers:

[0092] ;

[0093] when The larger the value, the better the mobile target defense effect is, and the more difficult it is for the attacker to attack. It represents the effect of mobile target defense, x, y and z represent the degree of change of real-time data, the level of defense effect and the difficulty of attacker’s attack respectively, t represents the change of real-time data over time, and σ represents the standard deviation of the difficulty of attacker’s attack.

[0094] S3: When the system remains normal without triggering the data source, use the abnormal inspection assistant to perform full detection of abnormal behavior and perform feedback optimization.

[0095] Furthermore, through continuous learning, attack identification models and defense strategies are constantly updated to respond to emerging threats.

[0096] It should be noted that when no system anomalies are found during the monitoring process of the abnormal inspection assistant, the system is continuously optimized to adapt the system to different network environments. When the abnormal inspection assistant detects an attack, after the disposal is completed, it will be fed back to the system interruption for learning and model update:

[0097] ;

[0098] in, is the updated system status. Indicates improved system performance. Indicates that system performance has degraded; represents the system state at time t, To measure the difference between network environment and system status, represents the network environment status at time t, represents the abnormality of the output system at time t, Indicates the comparability of abnormality levels, Indicates the identified effective abnormal signal. Indicates adjusting system parameters based on anomaly detection results. Indicates that the optimization intensity is adjusted according to the degree of abnormality. Represents system parameters, Indicates the system parameter adjustment amount, Represents the learning rate function, which controls the speed of learning and model updating. Indicates learning and model updating based on feedback, Indicates that the model was updated successfully. Indicates that the model update failed; Indicates the average value of the normal state of the system.

[0099] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0100] Example 2

[0101] Reference Figure 1-Figure 2 , which is an embodiment of the present invention, provides a network security defense method for autonomous identification and attack monitoring. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through experiments.

[0102] The experimental environment is set up as follows: the network topology includes firewalls, routers, key servers and core switches; UTM devices are deployed at the network boundary, and syslog servers are deployed on key servers and core switches.

[0103] Both the new method and the traditional method are connected to the same network environment.

[0104] The experimental steps include real-time collection of network traffic data and preprocessing, including data cleaning and normalization. The new method uses the twin training model to establish an anomaly database. The traditional method uses a preset signature database to simulate various types of attacks in the network, including denial of service attacks and SQL injection attacks. The key indicators of the two methods for attacks, such as detection rate, false alarm rate, and response time, are recorded.

[0105] For the method of the present invention, the parameters of the twin model are optimized through continuous iterative training to improve its ability to identify abnormal behaviors.

[0106] Table 1 Attack results of four different situations

[0107]

[0108] The attack identification time was relatively short in all test scenarios, averaging only 0.65 seconds. This shows that our system can quickly identify cyber attacks, which is crucial to preventing attacks from causing greater damage. Compared with existing technologies, this approach can respond faster and reduce potential losses.

[0109] Secondly, the response time of the defensive measures is also relatively fast, averaging 1.08 seconds. This shows that the system can take immediate action after identifying the attack and effectively curb the spread of the attack. Fast response time is the key to network security, especially when facing complex network attacks.

[0110] In terms of attack success rate, our system shows significant advantages. In all test scenarios, the average attack success rate is only 5.25%, which is much lower than the average level of existing technologies. This shows that our system can effectively block most attacks and protect the security of the network.

[0111] Finally, system recovery time is also an important indicator. Our system can recover quickly after being attacked, with an average recovery time of 2.5 minutes. Fast recovery means less interruption time for network services and minimized impact on user experience.

[0112] For traditional methods, the signature database is updated regularly to cope with new attack types.

[0113] Table 2 Performance comparison of the two methods under different attack types

[0114]

[0115] The method of the present invention showed a higher detection rate in both types of attacks, especially for denial of service attacks, the detection rate reached 98%, which is much higher than the 85% of the traditional method. The false alarm rate of the method of the present invention is generally lower than that of the traditional method, especially when dealing with SQL injection attacks, the false alarm rate of the method of the present invention is only 1.2%, while the traditional method is as high as 8.1%. The response time of the method of the present invention is shorter, the response time for denial of service attacks is 0.8 seconds, while the traditional method needs 1.5 seconds.

[0116] In summary, the method of the present invention is significantly superior to the traditional method in terms of real-time performance, accuracy and efficiency. The new method can more quickly and accurately identify and respond to network attacks through real-time data collection and twin training model to establish an abnormal database, significantly improving the ability of network security defense.

[0117] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0118] Example 3

[0119] The third embodiment of the present invention is different from the first two embodiments in that:

[0120] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0121] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0122] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0123] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0124] Example 4

[0125] Reference Figure 3 , which is the fourth embodiment of the present invention, and this embodiment provides a network security defense system for autonomous identification and attack monitoring, including a data acquisition and preprocessing module, a twin training model and anomaly database module, an autonomous identification model module, a threat intelligence analysis library module, an anomaly inspection assistant module and a feedback optimization module.

[0126] The data collection and preprocessing module collects network data in real time and preprocesses the data, such as cleaning and formatting, to facilitate subsequent analysis, ensuring that the data input into the system is accurate and useful, laying the foundation for subsequent model training and data analysis.

[0127] The twin training model and anomaly database module uses the collected data to train the twin training model, establishes an anomaly database, stores abnormal data, identifies normal and abnormal data through the training model, and stores the abnormal data for subsequent analysis and defense.

[0128] Autonomous Identification Model Module When the system detects an attack, it determines the nature of the attack behavior based on the autonomous identification model and takes corresponding defensive measures to automatically identify the attack behavior and respond quickly to reduce the damage caused by the attack.

[0129] When multiple data sources are triggered, the threat intelligence analysis library module uses the threat intelligence analysis library to analyze the attack sequence, formulate new defense strategies based on the analysis results, deeply analyze the attack behavior, and formulate more effective defense strategies.

[0130] The abnormal inspection assistant module detects abnormal behavior when no attack is detected, and takes preliminary defense measures when an attack is detected, monitors the network status in real time, and promptly detects and handles abnormal situations.

[0131] The feedback optimization module continuously optimizes according to the system's operating conditions to adapt to different network environments, improve the system's adaptability and accuracy, and enable it to cope with various network environments more effectively.

[0132] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security defense method for autonomously identifying attack monitoring, characterized in that: include, Collect and preprocess data in real time, and establish an abnormal database through the twin training model to form an abnormal data source; The inspection assistant uses the autonomous recognition model to determine the essence of the attack behavior based on the number of data sources that trigger abnormalities, triggers the threat intelligence analysis library, and adopts multi-level defense deployment; When there is no abnormal data source triggering the identification of attack behavior and the system remains normal, the abnormal inspection assistant is used to detect abnormal behavior throughout the process and perform feedback optimization; The establishment of the abnormal database includes deploying UTM equipment at the network boundary 1 cm away from the firewall and router for data collection, deploying syslog servers on key servers and core switches to collect data, and using inspection factors to collect and transmit data in series, inputting the twin training model for multi-level training after preprocessing, and summarizing the abnormal data and data that may have abnormalities in the twin model to form an abnormal database; The anomaly database includes access and maintenance control attack categories, data security and privacy attack categories, authentication and session management attack categories, and network infrastructure and transport attack categories; The twin training model includes establishing an abnormal database to form an abnormal data source through three-level training of the twin training model, inputting preprocessed transmission data, each sub-network independently extracts key features of the input data through multiple neural network layers, and performs first-level similarity measurement training, second-level joint training and third-level boundary decision training. Through multiple iterative training, the model will improve its ability to distinguish between normal and abnormal data, store the abnormal data after training in the abnormal database, and compare the boundary decision results of normal data and abnormal data to form an abnormal data source; The first-level similarity metric training includes using the extracted feature vector as input to calculate the similarity score S i : The second level of joint training involves the model learning feature extraction and similarity measurement simultaneously, and adjusting model parameters by comparing the results: The third level boundary decision training includes using the similarity score as input to train the decision boundary to determine whether the data sample is abnormal: When F(x)=1, it means that the input data sample is very consistent with the normal data and is judged to be normal. When F(x)=0, it means that the input data sample is inconsistent with the normal data and is judged to be abnormal. The abnormal data is marked and stored in the abnormal database to form the data source. Among them, x n，i 、x a，i are the feature vectors of normal and abnormal behaviors of the i-th group of training, respectively, λ is the parameter of the information filtering function to adjust the importance weights of different features, N is the dimension of the feature vector, σ is the standard deviation of the Gaussian function, which is used to control the smoothness of the similarity score; f norm is the specified range of the eigenvector [0, 1], θ new is the updated model parameter, θ is the set of model parameters, α is the learning rate, which controls the step size of parameter update; Represents the model parameter θ new The gradient of L loss is the difference between the similarity measure S and the true label Y; Y is the true label, indicating whether x and x′ belong to the same category; x is the key feature vector extracted, s is the similarity measurement function, α i is the weight factor of the similarity score of the i-th group, β i and γ i is a parameter that affects the shape and range of the boundary, S i is the similarity score of the i-th group of data samples, δ i and ∈ i is a parameter that adjusts the effect of the similarity score on the final decision.

2. A network security defense method for autonomously identifying attack monitoring as claimed in claim 1, characterized in that: The data source includes maintaining full inspection monitoring and performing autonomous optimization to adapt to different network conditions when no system abnormalities are found and no abnormal data source is triggered during the monitoring process of the abnormal inspection assistant; When the abnormal inspection assistant detects that the system is attacked and a single abnormal data source is triggered in the network data connected in series by the abnormal inspection assistant, the abnormal inspection assistant immediately locates the attack point and takes preliminary defense measures to prevent the fault from getting worse due to the attack. At the same time, the abnormal inspection assistant sends the attack sequence and the data source to the autonomous recognition model for attack behavior identification. According to the specific attack behavior, the corresponding defense measures are called. After the treatment is completed, the current treatment process is saved into the system. When the same problem occurs again, the abnormal inspection assistant directly takes the corresponding defense measures and sends the attack sequence to the recognition model to detect whether there is any attack behavior. If there is any attack behavior, the defense strategy is re-formulated and returned to the abnormal inspection assistant to re-execute the new defense strategy. If there is no attack behavior, the abnormal inspection assistant is returned to notify that the measures will not be changed. When the abnormal inspection assistant detects that the system is attacked and triggers multiple abnormal data sources in the network data connected in series by the abnormal inspection assistant, the system sends multiple abnormal inspection assistants to locate the attack point and take preliminary defense measures to control and prevent the attack from worsening. It notifies the staff and triggers the threat intelligence analysis library to analyze and sort the attack sequence, sends the output results and the attack sequence to the autonomous recognition model for attack behavior identification, and forms a new comprehensive defense strategy based on the output results and expert opinions for disposal and storage in the system.

3. A network security defense method for autonomously identifying attack monitoring as claimed in claim 2, characterized in that: The autonomous identification model includes receiving the attack sequence sent by the abnormal inspection assistant and the abnormal data source to identify the abnormal attack behavior, which is expressed by the Sigmoid function as follows: Set the attack threshold a. When G(x) is less than a, it is considered that no attack behavior is detected. When G(x) is greater than a, it is considered that an attack behavior is detected. And according to the output probability value P(G(x)|I, j), the probability of different attack behaviors is judged, and the behavior with P=1 is marked as an attack behavior. Among them, G(x) is the behavior recognition function, N(DS(t)) is the normalization function used to normalize the signals of all data sources to the same range, ΔI j (t) Determine the input change of data source j at time t, G(DS j ) is the trust function of data source j, and the weight is given according to the reliability of the data source, I is the attack sequence, DT j The time difference from data source j to the attack occurrence, DS j (t) Extract useful information from the data of data source j at time t, f filter is the information filtering value, t0 and t f is the start and end time, c is the input change ΔI of data source i at time t j (t) Whether the threshold is exceeded.

4. A network security defense method for autonomously identifying attack monitoring as claimed in claim 3, characterized in that: The threat intelligence analysis library includes taking multiple data sources as input to fuse attack data, and scoring and ranking the fused results: Among them, Φ is the attack score function to calculate the final attack score, q n is the weight of the corresponding data source to adjust the impact of different data sources on the final score, g(x) is the fusion of attack data from different data sources, and f n (x n ) is a complex information filtering function to extract key information.

5. A network security defense method for autonomously identifying attack monitoring as claimed in claim 4, characterized in that: The feedback optimization includes continuously optimizing the system when no system abnormality is found during the monitoring process of the abnormal inspection assistant, so that the system can adapt to different network environments. When the abnormal inspection assistant detects an attack, after the disposal is completed, feedback is given to the system interruption for learning and model update: O(t)=η(t)·(S new (t)-S(t)) Among them, S new is the updated system status, S new >0 indicates improved system performance, S new ≤0 indicates that the system performance has degraded; S(t) represents the system state at time t, p i To measure the difference between network environment and system status, N i (t) represents the network environment status at time t, A(t) represents the abnormality degree of the output system at time t, A(t) represents the comparability of the abnormality degree, υ(t) represents the identified effective abnormal signal, F(t) represents the adjustment of system parameters based on the abnormality detection results, τ(t) represents the adjustment of optimization intensity according to the abnormality degree, E represents the system parameters, ΔE represents the system parameter adjustment amount, η(t) represents the learning rate function, which controls the speed of learning and model updating, O(t) represents learning and model updating based on feedback, O(t)>0 represents the model update success, O(t)≤0 represents the model update failure; S represents the average value of the normal state of the system.

6. A system using a network security defense method for autonomously identifying attack monitoring as claimed in any one of claims 1 to 5, characterized in that: It includes data collection and preprocessing module, twin training model and anomaly database module, autonomous identification model module, threat intelligence analysis library module, anomaly inspection assistant module and feedback optimization module; The data acquisition and preprocessing module acquires network data in real time and preprocesses the data, including cleaning and formatting, to facilitate subsequent analysis; The twin training model and abnormal database module uses the collected data to train the twin training model, establishes an abnormal database, stores abnormal data, identifies normal and abnormal data through the training model, and stores the abnormal data for subsequent analysis and defense; The autonomous identification model module, when the system detects an attack, determines the nature of the attack behavior based on the autonomous identification model, and takes corresponding defense measures, automatically identifies the attack behavior, and responds quickly to reduce the damage caused by the attack; The threat intelligence analysis library module, when multiple abnormal data sources are triggered, uses the threat intelligence analysis library to analyze the attack sequence, and formulates a new defense strategy based on the analysis results, deeply analyzes the attack behavior, and formulates an effective defense strategy; The abnormal inspection assistant module detects abnormal behavior when no attack is detected, and takes preliminary defensive measures when an attack is detected, monitors the network status in real time, and promptly detects and handles abnormal situations; The feedback optimization module continuously performs optimization learning according to the operation status of the system, adapts to different network environments, and improves operation accuracy.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images