A network security early warning method and system based on deep learning

Abstract

The application discloses a kind of network security early warning method and system based on deep learning, method includes: obtaining network traffic data from network traffic;Adversarial network attack data is constructed, discriminator is trained and optimized;According to the feature of network traffic data, time series model is constructed and abnormal detection rule is set;Design dynamic adjustment's federal learning framework to optimize learning the performance of each node;Periodic update mechanism is constructed, and model update is periodically obtained from central server;Sensor is deployed in key network node, real-time monitoring network traffic data, and data is analyzed and detected, when there is abnormal situation, timely alarm is sent out.The application improves the defense efficiency and intelligent level of network security system, also enhances its adaptability and practicality, so that it can effectively deal with modern network security threats.These features make the application have significant technical progress and practical value in the field of network security.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence, and in particular relates to a network security early warning method and system based on deep learning. Background Technology

[0002] With the rapid development of information technology, cybersecurity has become a global focus. Especially with the widespread adoption of technologies such as big data, cloud computing, and the Internet of Things, the types and complexity of cyberattacks are constantly increasing, and traditional cybersecurity defense methods are gradually showing their limitations. Traditional cybersecurity systems typically rely on known attack signatures and rules for threat detection, which makes them ineffective against new or unknown attack methods. For example, rule-based intrusion detection systems (IDS) and intrusion prevention systems (IPS) often fail to effectively identify threats such as zero-day attacks and advanced persistent threats (APTs) due to a lack of prior definitions or signatures.

[0003] Furthermore, with the continuous changes in the network environment and the constant advancement of network attack techniques, updating and adapting fixed algorithm models has become a major challenge. Existing defense systems often require manual intervention to update and adjust rules, which is not only time-consuming and labor-intensive but may also be slow to react to rapidly changing attack strategies. At the same time, most existing systems are designed for a single network environment, and few can perform well in multiple network environments. This limits their application scope and effectiveness, especially when faced with highly customized security requirements.

[0004] Due to the aforementioned issues, the industry urgently needs an advanced system that can automatically adapt to changes in the network environment, respond promptly to emerging threats, and share intelligence across multiple network nodes to strengthen security defenses. Such a system should be able to continuously learn and adapt to new attack patterns, reduce reliance on human intervention, and provide cross-network environment defense capabilities to address the challenges currently facing the cybersecurity field. Summary of the Invention

[0005] The purpose of this invention is to design a network security early warning method and system based on deep learning, which integrates dynamic adaptive technology, generative adversarial networks (GANs) and federated learning to achieve efficient identification and defense against new and changing attack strategies.

[0006] To achieve the above objectives, in a first aspect of the present invention, a network security early warning method based on deep learning is provided, the method comprising:

[0007] S1. Obtain network traffic data X from network traffic, preprocess the network traffic data X, and construct a dynamic adaptive model based on reinforcement learning to dynamically adjust the real-time data.

[0008] S2. Construct generative adversarial network attack data, train and optimize the discriminator, including:

[0009] S201. Input a random noise vector z and output a synthesized network attack data sample from the generator G. Then input either a real data sample x or a synthetic sample output by the generator G. The discriminator D outputs a single scalar;

[0010] S202, Introduce the edge loss update generator G and the loss function L. G And discriminator loss function L D The generator G and discriminator D are trained as follows:

[0011] L G =log(1-D(G(z)))+λ·max(0,m-∥G(z)-x∥)

[0012] Where m represents the preset boundary distance, λ represents the hyperparameter controlling the importance of the boundary loss, and ∥G(z)-x∥ represents the Euclidean distance between the generated sample and the real sample;

[0013] L D =-[logD(x)+log(1-D(G(z)))+δ·log(1-D(x))]

[0014] Where δ represents the penalty term used to adjust for overconfidence in real samples;

[0015] S203. Collect traffic data from different network layers, extract and label features for each network traffic data, preprocess the network traffic data to form a dataset, divide the dataset into training set, validation set and test set, and set evaluation indicators to evaluate the network.

[0016] S3. Construct a time series model and set anomaly detection rules based on the characteristics of network traffic data. Use machine learning to enhance the detection rules. Deploy the time series model in a real-time monitoring system to acquire network traffic data in real time to detect potential threats. At the same time, set a dynamic adaptive index (DAI) to test the performance of the current time series model. The dynamic adaptive index DAI is represented as follows:

[0017]

[0018] Where, N detected N represents the number of new attack types correctly detected during the test. new T represents the total number of new attack types that appeared during the test; avg This represents the average time from the occurrence of an attack to its detection; α, β, and γ represent the weighting coefficients.

[0019] S4. Design a dynamically adjustable federated learning framework to optimize the performance of each node, automatically adjust model parameters based on data from each node, monitor and provide feedback data in real time, and achieve cross-node performance comparison and model sharing by adaptively adjusting the learning rate.

[0020] S5. Establish a periodic update mechanism to periodically obtain model updates from the central server;

[0021] S6. Deploy sensors at key network nodes to monitor network traffic data in real time, analyze the data and detect anomalies, and issue alarms promptly when anomalies are detected.

[0022] Furthermore, S1 specifically includes:

[0023] S101. Collect network traffic data X from network traffic, process the network traffic data X in batches according to time windows, and use an autoencoder as a feature extractor to transform the network traffic data X into a low-dimensional feature vector v, i.e., v = E(X; θ E ), where θ E The parameters representing the encoder are then used to enhance the model's robustness to noise using a denoising autoencoder.

[0024] S102. Construct the reinforcement learning-based dynamic adaptive model as follows:

[0025] Design a neural network classifier C that takes the feature vector v as input and outputs the threat assessment probability y = σ(C(v; θ)). C ), where σ is the Sigmoid activation function used for binary classification;

[0026] An online learning strategy is adopted, allowing the model to be updated in real time. When new data arrives, the network parameters θ are updated in real time using a mini-batch gradient descent method. E and θ C ;

[0027] An adaptive learning rate α(t) is implemented to adjust the parameter update rate;

[0028] S103. Define a dynamic threshold γ(t). If the threat assessment probability y > the dynamic threshold γ(t), then identify the potential threat.

[0029] S104. Implement an automated response strategy, and adjust the response strategy automatically according to the threat level and type.

[0030] S105. By periodically reviewing the model's performance and error analysis, adjust the model structure and parameters, and use feedback data to retrain the model.

[0031] Furthermore, the feature extraction and annotation for each data packet or stream is performed as follows:

[0032] Feature extraction is performed on each network traffic data point, and the feature vector is represented as v = [v1, v2, ..., v i ,v n ], where each v i This represents a feature in the data;

[0033] Label the dataset manually or using automated tools. The label y indicates whether the data packet is malicious, y∈{0,1}, where 1 represents malicious and 0 represents normal.

[0034] Furthermore, the established evaluation metrics are used to evaluate the network, specifically including accuracy, precision, recall, and F1 score, calculated as follows:

[0035] The accuracy rate:

[0036] The accuracy:

[0037] The recall rate:

[0038] The F1 score:

[0039] Where TP, TN, FP, and FN represent the number of true positives, true negatives, false positives, and false negatives, respectively.

[0040] Furthermore, the construction of a time series model and the setting of anomaly detection rules based on the characteristics of network traffic data are as follows:

[0041] Network traffic data is treated as time-series data S(t), where t represents the time index;

[0042] Time series analysis techniques are applied to model time series data S(t);

[0043] Determine the behavior patterns of normal traffic data based on historical data, and set an anomaly threshold θ;

[0044] Determine whether the feature vector v within a certain time window exceeds the abnormal threshold θ.

[0045] Furthermore, S4 specifically includes:

[0046] S401. Perform an initial evaluation of each node in the network, as shown below:

[0047] S i =α·E i +β·DQ i +γ·Ci

[0048] Among them, S i E represents the node score of node i. i DQ represents efficiency. i Indicating data quality, C i α represents computational power, and β and γ represent weighting coefficients.

[0049] S402. Based on node scores, dynamically classify nodes into high-performance nodes and low-performance nodes;

[0050] S403. Each node monitors network traffic in real time and adjusts the frequency of information exchange and data processing strategies between nodes through reinforcement learning algorithms, as shown below:

[0051]

[0052] Where Q(s,a) represents the quality function of taking action a in state s, R(s,a) represents the reward function, η represents the learning rate, and λ represents the discount factor;

[0053] S404. Based on the data and feedback collected from each node, automatically adjust the parameters of the global model and deploy it to all nodes;

[0054] S405. Set and monitor key performance indicators, collect indicator data for analysis, automatically adjust learning parameters and data synchronization strategies, and then adaptively adjust the learning rate to optimize the federated learning process based on the model's performance on different nodes. Regularly compare the performance of models submitted by different nodes, identify the best-performing model, and push its parameters or strategies to other nodes.

[0055] Furthermore, the federated learning process is further optimized by adaptively adjusting the learning rate based on the model's performance at different nodes, wherein the learning rate adjustment function is expressed as follows:

[0056] λ(n,t)=λ0·exp(-κ·E(n,t))

[0057] Where λ0 represents the initial learning rate, κ represents the adjustment strength coefficient, and E(n,t) represents the error rate of the nth node at time t.

[0058] Furthermore, S5 specifically includes:

[0059] S501. Preprocess the network traffic data collected periodically.

[0060] S502, Each node updates the detection model M based on the local data collected in S501. i , means as follows:

[0061]

[0062] Wherein, the model parameter is θ i Local data is D i η represents the learning rate, and L represents the loss function, which measures the deviation between the model's predictions and the actual data.

[0063] S503, All nodes update their model parameters The data is sent to the central server, which aggregates the parameters using a weighted average method, as shown below:

[0064]

[0065] Among them, w i It is the weight, Θ (t+1) Represents global model parameters;

[0066] S504, Set the global model parameter Θ (t+1) The system sends updates to the local model back to each node, while each node monitors and records the performance of its model.

[0067] Furthermore, S6 specifically includes:

[0068] S601. Deploy sensors at key network nodes to process and store large amounts of network data;

[0069] S602. Capture real-time network traffic data and preprocess and extract features from the data;

[0070] S603. Identify abnormal patterns in the data and determine whether an alarm needs to be issued.

[0071] In a second aspect, the present invention provides a deep learning-based network security early warning system, comprising a computer-readable storage medium and a processor, wherein the computer-readable storage medium is used to store an executable program; and the processor is used to read the executable program stored in the computer-readable storage medium and execute the aforementioned deep learning-based network security early warning method.

[0072] The beneficial technical effects of the present invention are at least as follows:

[0073] (1) By employing deep reinforcement learning, this system can adjust its defense strategies and parameters in real time to adapt to changes in the network environment. This adaptive capability solves the problem that traditional systems cannot react quickly to new or changing attacks.

[0074] (2) By using GAN to generate unknown attack samples to train the defense model, the present invention significantly improves the system’s ability to detect unknown attacks, thereby overcoming the limitations of existing technologies that rely on known signatures and rules.

[0075] (3) The federated learning framework allows multiple network nodes to share model updates without directly sharing sensitive data. This not only enhances the defense capabilities of each node but also improves the intelligence level and privacy protection of the entire network system, solving the problem of application limitations in a single network environment in existing technologies.

[0076] (4) This invention not only improves the defense effectiveness and intelligence level of network security systems, but also enhances their adaptability and practicality, enabling them to effectively cope with modern network security threats. These features make this invention a significant technological advancement and practical value in the field of network security. Attached Figure Description

[0077] The present invention will be further described with reference to the accompanying drawings, but the embodiments in the drawings do not constitute any limitation on the present invention. For those skilled in the art, other drawings can be obtained based on the following drawings without creative effort.

[0078] Figure 1 This is a flowchart of a network security early warning method based on deep learning according to the present invention. Detailed Implementation

[0079] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0080] In one or more embodiments, such as Figure 1 As shown, a network security early warning method based on deep learning is disclosed in this invention, which includes steps S1-S6:

[0081] S1. Obtain network traffic data X from network traffic, preprocess the network traffic data X, and construct a dynamic adaptive model based on reinforcement learning to dynamically adjust to real-time data, including:

[0082] S101. Collect network traffic data X from network traffic, process the network traffic data X in batches according to time windows, and use an autoencoder as a feature extractor to transform the network traffic data X into a low-dimensional feature vector v, i.e., v = E(X; θ E ), where θ E The parameters representing the encoder are then used to enhance the model's robustness to noise, especially in complex network environments, by employing a denoising autoencoder.

[0083] The preferred time window is 1 minute.

[0084] S102. Construct the reinforcement learning-based dynamic adaptive model as follows:

[0085] Design a neural network classifier C that takes the feature vector v as input and outputs the threat assessment probability y = σ(C(v; θ)). C ), where σ is the Sigmoid activation function used for binary classification (normal / threat); where an appropriate activation function, such as ReLU, is chosen to prevent gradient vanishing and improve the speed and accuracy of model learning;

[0086] An online learning strategy is adopted, allowing the model to be updated in real time. When new data arrives, the network parameters θ are updated in real time using a mini-batch gradient descent method. E and θ C ;

[0087] An adaptive learning rate α(t) is implemented to adjust the parameter update rate; where, Used to adjust the parameter update rate to ensure the model can quickly adapt to new threat patterns. α0 represents the initial value, and βt represents the decay factor that changes over time.

[0088] S103. Define a dynamic threshold γ(t), which is adjusted based on the system's historical performance and the current network environment. If the threat assessment probability y > the dynamic threshold γ(t), then potential threats are identified. The threshold adjustment strategy can be automatically adjusted based on historical data of false alarm rate and false negative rate to ensure a balance between detection sensitivity and specificity.

[0089] S104. Implement an automated response strategy, and adjust the response strategy automatically according to the threat level and type.

[0090] For example, it can isolate the threatened subnet, automatically notify system administrators for further investigation, or activate deeper intrusion detection tools. The response strategy automatically adjusts based on the threat level and type to ensure timely and effective mitigation of potential security risks.

[0091] S105. By periodically reviewing the model's performance and error analysis, adjust the model structure and parameters, and use feedback data to retrain the model.

[0092] Specifically, by regularly reviewing the model's performance and analyzing errors, the model structure and parameters are further adjusted. For example, the complexity and performance of the model can be optimized by adding or removing neural network layers. Simultaneously, external threat intelligence data is introduced to assist the model in learning and identifying emerging and complex attack patterns. A user feedback mechanism is implemented, allowing end-users to report false positives or false negatives; the system learns and adjusts itself based on this feedback. Feedback data is used for model retraining to improve accuracy and reduce the false positive rate.

[0093] S2. Construct generative adversarial network attack data, train and optimize the discriminator, including:

[0094] S201. Input a random noise vector z and output a synthesized network attack data sample from the generator G. Then input either a real data sample x or a synthetic sample output by the generator G. The discriminator D outputs a single scalar;

[0095] Specifically, the generator G attempts to create network attack data that is as realistic as possible to deceive the discriminator. It consists of multiple fully connected or convolutional layers, each followed by batch normalization and the LeakyReLU activation function.

[0096] The discriminator D is tasked with distinguishing whether the input sample is real or created by the generator G. It consists of multiple fully connected or convolutional layers, each followed by batch normalization and LeakyReLU activation function, and the final layer uses the Sigmoid activation function.

[0097] S202. To ensure that the generated attack samples can more effectively deceive the discriminator, and to give the discriminator a higher threshold for distinguishing between real and fake attacks, an edge loss is introduced to update the generator G loss function L. G And discriminator loss function L D The generator G and discriminator D are trained as follows:

[0098] L G =log(1-D(G(z)))+λ·max(0,m-∥G(z)-x∥)

[0099] Where m represents the preset boundary distance, λ represents the hyperparameter controlling the importance of the boundary loss, and ∥G(z)-x∥ represents the Euclidean distance between the generated sample and the real sample;

[0100] L D =-[logD(X)+log(1-D(G(z)))+δ·log(1--D(X))]

[0101] Where δ represents the penalty term used to adjust for overconfidence in real samples;

[0102] S203. Collect traffic data from different network layers, extract and label features for each network traffic data, preprocess the network traffic data to form a dataset, divide the dataset into training set, validation set and test set, and set evaluation indicators to evaluate the network.

[0103] Specifically, S2031, using real network traffic data containing various known network attacks (such as DDoS, SQL injection, etc.), the data is transformed into a format suitable for neural network processing through a preprocessing step;

[0104] S2032. The data is transformed into a format suitable for neural network processing through a preprocessing step. The generated samples are used to stress test existing network security systems and evaluate their ability to detect newly generated threats.

[0105] Wherein, S2031 includes:

[0106] Select real traffic data that includes various types of network attacks, such as DDoS, SQL injection, cross-site scripting (XSS), and phishing attacks; the data collection should include data from different network layers (e.g., application layer, transport layer, and network layer) to ensure data diversity and coverage.

[0107] S2032 includes:

[0108] Feature extraction is performed on each data packet or stream. Common features include, but are not limited to, packet size, stream duration, destination port, and protocol type. The feature vector is represented as v = [v1, v2, ..., v n ], where each v i To represent a feature in the data, the dataset is labeled manually or using automated tools. The label y indicates whether the data packet is malicious, y∈{0,1}, where 1 represents malicious and 0 represents normal.

[0109] Standardized or normalized feature data, using Normalization is performed to eliminate the influence between features of different magnitudes. For missing data, interpolation or imputation based on the mean of similar samples is used.

[0110] The dataset is divided into training, validation, and test sets, typically in proportions of 60%, 20%, and 20%, respectively. The training set is used to train the model, the validation set is used to tune the model parameters, and the test set is used to evaluate the model's performance.

[0111] The main evaluation metrics include accuracy, precision, recall, and F1 score, calculated as follows:

[0112] accuracy

[0113] Accuracy

[0114] Recall rate

[0115] F1 score

[0116] Wherein, TP, TN, FP, and FN represent the number of true positives, true negatives, false positives, and false negatives, respectively;

[0117] K-fold cross-validation is used to improve the robustness of the evaluation, and K=5 or K=10 is generally chosen. This method can maximize the use of limited data resources and reduce the risk of overfitting.

[0118] Real-time performance testing is performed on attack samples generated by the integrated generative adversarial network to check the security system's response capability to new and complex attacks.

[0119] Attack samples generated by the ensemble generative adversarial network (EGAN) are periodically integrated into the training data of existing security systems to improve the system's ability to identify unknown attacks. The EGAN model is also periodically updated to include emerging attack patterns and strategies, ensuring that the generated attack samples always reflect the latest threat landscape.

[0120] S3. Construct a time series model and set anomaly detection rules based on the characteristics of network traffic data. Use machine learning to enhance the detection rules. Deploy the time series model in a real-time monitoring system to acquire network traffic data in real time to detect potential threats. At the same time, set a dynamic adaptive index (DAI) to test the performance of the current time series model. The dynamic adaptive index DAI is represented as follows:

[0121]

[0122] Where, N detected N represents the number of new attack types correctly detected during the test. new T represents the total number of new attack types that appeared during the test; avg This represents the average time from the occurrence of an attack to its detection; α, β, and γ represent the weighting coefficients.

[0123] Specifically, typical characteristics include statistical descriptions of data packet intervals (mean, variance), traffic peaks, and traffic troughs.

[0124] The time series model is constructed as follows:

[0125] Network traffic data is treated as time-series data S(t), where t represents the time index;

[0126] Apply time series analysis techniques, such as ARIMA models or seasonal decomposition, to model S(t).

[0127] The anomaly detection rules are defined as follows:

[0128] Determine the behavior patterns of normal traffic based on historical data, and set an abnormal threshold θ;

[0129] If the feature vector v deviates significantly from the historical pattern by more than θ within a certain time window, it is marked as an anomaly.

[0130] Specifically, S301 uses machine learning algorithms such as decision trees, support vector machines, or neural networks to train a classification model to distinguish between normal and abnormal traffic. Cross-validation and hyperparameter tuning techniques are used to optimize model parameters and improve the model's generalization ability.

[0131] S302. Deploy the trained model in the real-time monitoring system to apply feature extraction and anomaly detection models to the real-time captured network traffic data in order to quickly respond to potential threats.

[0132] S303, design dynamic adaptability indicators; among which, the success rate component This measures the model's ability to detect novel attacks. Ideally, this ratio should approach 1, indicating that all novel attacks have been successfully detected. The reaction time component... This reflects the model's reaction speed to attacks. A larger value indicates a faster model response. Improvement rate component ΔR improvement This indicates the model's ability to adapt and improve to new attacks over time. This is an important metric because it reflects the model's learning and progress, especially when dealing with evolving threats.

[0133] Specifically, in implementing the anomaly detection mechanism, this invention employs a Dynamic Adaptive Indicator (DAI) to continuously evaluate and optimize the system's response capability to new types of network attacks. The DAI comprehensively considers the following three key factors: the detection rate of new attack types... Average time from attack occurrence to detection and the rate of improvement in detection capability over time ΔR improvement These indicators are expressed through formulas. The calculation is performed using a weighted summation, where α, β, and γ are weighting coefficients that are adjusted according to security requirements.

[0134] When using dynamic adaptive metrics for evaluation, the system monitors and records each newly identified attack type in real time, along with its corresponding detection time and success rate. This allows system administrators to see not only the current performance level but also how the system's ability to adapt to new threats changes over time. By periodically analyzing this data, the system can automatically adjust its detection algorithms and parameters to ensure it continues to provide efficient and accurate protection against evolving cyber threats.

[0135] When using Dynamic Adaptive Indicators (DAI), thresholds can be set. For example, if historical data indicates an average DAI of 0.75 (within a range of 0 to 1, where 1 represents optimal performance), the threshold can be set to 0.65. Any performance below this value should trigger review and improvement actions. For any performance metric below the threshold, further analysis should be conducted to determine which component (detection rate, response time, improvement rate) contributed less, allowing for targeted optimization.

[0136] S4. Design a dynamically adjustable federated learning framework to optimize the performance of each node, automatically adjust model parameters based on data from each node, monitor and provide real-time data feedback, and achieve cross-node performance comparison and model sharing through adaptive adjustment of the learning rate, including:

[0137] S401. Perform an initial evaluation of each node in the network, scoring it based on its historical security event processing efficiency, data quality, and computing power, as shown below:

[0138] S i =α·E i +β·DQ i +γ·C i

[0139] Among them, S i E represents the node score of node i. i DQ represents efficiency. i Indicating data quality, C i α represents computational power, and β and γ represent weighting coefficients.

[0140] S402. Based on node scores, nodes are dynamically divided into high-performance nodes and low-performance nodes. High-performance nodes update the model and share parameters more frequently, while low-performance nodes receive more guidance from high-performance nodes.

[0141] S403. Each node monitors network traffic in real time and adjusts the frequency of information exchange and data processing strategies between nodes through reinforcement learning algorithms, as shown below:

[0142]

[0143] Where Q(s,a) represents the quality function of taking action a in state s, R(s,a) represents the reward function, η represents the learning rate, and λ represents the discount factor;

[0144] Specifically, each node monitors network traffic in real time and uses local detection algorithms to initially identify potential threats. A data synchronization strategy ensures efficient transmission of critical information even with large data volumes. Reinforcement learning algorithms are used to adjust the frequency of information exchange and data processing strategies between nodes.

[0145] S404. Based on the data and feedback collected from each node, automatically adjust the parameters of the global model and deploy it to all nodes; among them, implement a rapid model update mechanism to deal with new threat types or attack patterns. The newly updated model is quickly deployed to all nodes through a secure distributed system, optimizing data encryption and transmission security during the deployment process to ensure that the overall security of the system is not affected.

[0146] S405. Set and monitor key performance indicators, collect indicator data for analysis, automatically adjust learning parameters and data synchronization strategies, and then adaptively adjust the learning rate to optimize the federated learning process based on the model's performance on different nodes. Regularly compare the performance of models submitted by different nodes, identify the best-performing model, and push its parameters or strategies to other nodes.

[0147] Specifically, key performance indicators (KPIs) are set and monitored, such as detection rate. False alarm rate And system response time (RT). These metrics reflect the system's real-time performance and security efficiency;

[0148] By analyzing these metrics, the system automatically adjusts learning parameters and data synchronization strategies. For example, if the detection rate decreases, the system may automatically increase the frequency of data collection or adjust model parameters.

[0149] The learning rate is adaptively adjusted based on the model's performance at different nodes to optimize the federated learning process. The learning rate adjustment function is defined as λ(n,t)=λ0·exp(-κ·E(n,t)), where λ0 is the initial learning rate, κ is the adjustment intensity coefficient, and E(n,t) is the error rate of the nth node at time t. This function allows the weights of the model update to be increased when a node performs poorly, thereby quickly adapting and improving its performance.

[0150] By leveraging the diversity of nodes in a federated learning environment, best practices and models can be identified and shared through performance comparison. The best-performing model can be identified and its parameters or strategies can be pushed to other nodes to improve the overall system performance.

[0151] The system automatically identifies system performance anomalies and potential security threats, and responds quickly to maintain system stability and security. When anomalies are detected, the system can automatically execute preset corrective measures, such as adjusting parameters and reallocating resources.

[0152] S5. Establish a periodic update mechanism to periodically obtain model updates from the central server, specifically including:

[0153] S501. Preprocess the network traffic data collected periodically.

[0154] Specifically, each node collects network traffic data periodically, at a frequency set to once per hour. This frequency can be adjusted based on network traffic and actual needs.

[0155] Each node preprocesses the collected data, including data cleaning and feature extraction. Data cleaning includes removing duplicate data and repairing missing values. Feature extraction may involve extracting information such as traffic volume, connection duration, and port usage.

[0156] S502, Each node updates the detection model M based on the local data collected in S501. i , means as follows:

[0157]

[0158] Wherein, the model parameter is θ i Local data is D i η represents the learning rate, and L represents the loss function, which measures the deviation between the model's predictions and the actual data.

[0159] S503, All nodes update their model parameters The data is sent to the central server, which aggregates the parameters using a weighted average method, as shown below:

[0160]

[0161] Among them, w i It is the weight, Θ (t+1) Represents global model parameters;

[0162] S504, Set the global model parameter Θ (t+1) The system sends updates to the local model back to each node, while each node monitors and records the performance of its model. This performance data is fed back to the central server for adjusting model parameters and weights in future training cycles.

[0163] S6. Deploy sensors at key network nodes to monitor network traffic data in real time, analyze the data, and detect anomalies. Issue alerts promptly when anomalies are detected, including:

[0164] S601. Deploy sensors at key network nodes to process and store large amounts of network data;

[0165] Specifically, hardware: Deploy necessary hardware facilities at key network nodes, including servers, routers, and other network devices. The hardware configuration should support high-speed data processing and sufficient storage space to handle and store large amounts of network data. Software: Install network monitoring and anomaly detection software on all key devices, and configure the software to ensure it can receive and analyze data streams from the network.

[0166] S602. Capture real-time network traffic data and preprocess and extract features from the data;

[0167] Specifically, network packet capture tools (such as Wireshark) or custom data acquisition modules are used to capture real-time network traffic. The data capture formula can be expressed as D(t) = f(N(t)), where D(t) is the data captured at time t, N(t) is the network traffic, and f is the data capture function.

[0168] S603. Identify abnormal patterns in the data and determine whether an alarm needs to be issued;

[0169] Specifically, data cleaning removes redundancy and errors; data normalization ensures the data is within a reasonable range; for example, traffic data may need to be converted to traffic rate.

[0170] Extract key features from the cleaned data, such as packet size, protocol type, and port number; the feature vector can be represented as v = [v1, v2, ..., v n ], each v i This represents a feature extracted from the data;

[0171] Statistical analysis and pattern recognition techniques are used to identify abnormal patterns in data. Anomaly detection can be represented by a function a(v), where a is the detection algorithm. If v matches the abnormal pattern, a(v) = 1; otherwise, it is 0.

[0172] When a(v) = 1, the alarm system is triggered to issue an alarm. The alarm system is designed to quickly notify the network administrator and relevant security personnel for further processing.

[0173] Through this approach, the present invention can ensure every step from infrastructure deployment to real-time data monitoring and anomaly detection. These processes are systematically executed, ensuring the effectiveness and responsiveness of the network security system. This invention not only covers the technical details but also provides a flexible and efficient method to address network security challenges, meeting the needs of modern network environments for rapid and accurate security early warning systems.

[0174] In a second aspect, the present invention provides a deep learning-based network security early warning system, comprising a computer-readable storage medium and a processor, wherein the computer-readable storage medium is used to store an executable program; and the processor is used to read the executable program stored in the computer-readable storage medium and execute the aforementioned deep learning-based network security early warning method.

[0175] In summary, the deep learning-based network security early warning method and system of this invention can achieve efficient and dynamic network security protection at all levels. From basic attack detection to complex data analysis and intelligent cross-node collaboration, each step is designed to solve real-world network security challenges, together forming a powerful, intelligent and responsive network security defense system.

[0176] The above description discloses only some preferred embodiments of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art can understand that implementing all or part of the above embodiments and making equivalent changes in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A network security early warning method based on deep learning, characterized in that, The method includes: S1. Obtain network traffic data from network traffic. For network traffic data Preprocessing is performed to construct a dynamic adaptive model based on reinforcement learning to dynamically adjust the real-time data; S2. Construct generative adversarial network attack data, train and optimize the discriminator, including: S201, Input random noise vector To generator Output synthetic network attack data samples Then input real data samples or generator Output synthetic samples To the discriminator Output a single scalar; S202, Introducing an edge loss update generator loss function and discriminator loss function and the generator and discriminator Training is performed as follows: ； in, This indicates the preset boundary distance. Hyperparameters representing the importance of the control boundary loss This represents the Euclidean distance between the generated sample and the real sample. ； in, This indicates a penalty term used to adjust for overconfidence in real samples; S203. Collect traffic data from different network layers, extract and label features from each network traffic data, preprocess the network traffic data to form a dataset, divide the dataset into training set, validation set and test set, set evaluation indicators to evaluate the network, and periodically integrate the attack samples generated by the generative adversarial network into the training data of the existing security system to improve the system's ability to identify unknown attacks. Regularly update the integrated generative adversarial network model to include newly emerging attack patterns and strategies, and ensure that the generated attack samples always reflect the latest threats. The feature extraction and annotation for each data packet or stream are as follows: Feature extraction is performed on each network traffic data point, and the feature vector is represented as follows: Each of them This represents a feature in the data; Datasets can be labeled manually or using automated tools. Indicate whether the data packet represents malicious behavior. , where 1 represents malicious intent and 0 represents normal intent; S3. Construct a time series model and set anomaly detection rules based on the characteristics of network traffic data. Use machine learning to enhance the detection rules. Deploy the time series model in a real-time monitoring system to acquire network traffic data in real time to detect potential threats. Simultaneously, set dynamic adaptive indicators to test the performance of the current time series model; wherein, the dynamic adaptive indicators... It is expressed as follows: ； in, This indicates the number of new attack types that were correctly detected during the test; This indicates the total number of new attack types that appeared during the test; This represents the average time from when an attack occurs to when it is detected. Indicates the weighting coefficient; S4. Design a dynamically adjustable federated learning framework to optimize the performance of each node that monitors network traffic, automatically adjust model parameters based on data from each node, monitor and provide feedback data in real time, and achieve cross-node performance comparison and model sharing by adaptively adjusting the learning rate. S5. Establish a periodic update mechanism to periodically obtain model updates from the central server; S6. Deploy sensors at key network nodes to monitor network traffic data in real time, analyze the data and detect anomalies, and issue alarms in a timely manner when anomalies are detected. S1 specifically includes: S101. Collect network traffic data from network traffic. Network traffic data Processing network traffic data in batches according to time windows, using an autoencoder as a feature extractor. Transform into a low-dimensional feature vector ,Right now ,in, The parameters representing the encoder are then used to enhance the model's robustness to noise using a denoising autoencoder. S102. Construct the reinforcement learning-based dynamic adaptive model as follows: Design a neural network classifier. With feature vectors Input: Threat assessment probability ,in, It is the Sigmoid activation function, used for binary classification; An online learning strategy is adopted, allowing the model to be updated in real time. When new data arrives, the network parameters are updated in real time using the mini-batch gradient descent method. and ; Implement adaptive learning rate , used to adjust the parameter update rate; S103. Define a dynamic threshold. If the threat assessment probability >Dynamic threshold This identifies potential threats; S104. Implement an automated response strategy, and adjust the response strategy automatically according to the threat level and type. S105. By regularly reviewing the model's performance and error analysis, adjust the model structure and parameters, and use feedback data to retrain the model. S4 specifically includes: S401. Perform an initial evaluation of each node in the network, as shown below: ； in, Represents a node Node rating, Indicates efficiency. Indicates data quality, Indicates computing power. Indicates the weighting coefficient; S402. Based on node scores, dynamically classify nodes into high-performance nodes and low-performance nodes; S403. Each node monitors network traffic in real time and adjusts the frequency of information exchange and data processing strategies between nodes through reinforcement learning algorithms, as shown below: ； in, Indicates the state Take action The mass function, Represents the reward function, Indicates the learning rate. Indicates the discount factor; S404. Based on the data and feedback collected from each node, automatically adjust the parameters of the global model and deploy it to all nodes; S405. Set and monitor key performance indicators, collect indicator data for analysis, automatically adjust learning parameters and data synchronization strategies, and then adaptively adjust the learning rate to optimize the federated learning process based on the model's performance on different nodes. Regularly compare the performance of models submitted by different nodes, identify the best-performing model, and push its parameters or strategies to other nodes. The federated learning process is then optimized by adaptively adjusting the learning rate based on the model's performance at different nodes. The learning rate adjustment function is expressed as follows: ； in, This represents the initial learning rate. This indicates an adjustment to the strength coefficient. Indicates the first Each node in time The error rate.

2. The network security early warning method based on deep learning according to claim 1, characterized in that, The established evaluation metrics are used to evaluate the network, specifically including accuracy, precision, recall, and F1 score, calculated as follows: Accuracy ; Precision ; The recall rate: ; The F1 score: ; Among them, TP, TN, FP and These represent the number of true positives, true negatives, false positives, and false negatives, respectively.

3. The network security early warning method based on deep learning according to claim 1, characterized in that, The construction of a time series model and the setting of anomaly detection rules based on the characteristics of network traffic data are as follows: Treat network traffic data as time series data ,in Indicates a time index; Applying time series analysis techniques to time series data Modeling; Determine the behavior patterns of normal traffic data based on historical data, and set anomaly thresholds. ; Determine the feature vector within a certain time window Does it exceed the abnormal threshold? .

4. The network security early warning method based on deep learning according to claim 1, characterized in that, S5 specifically includes: S501. Preprocess the network traffic data collected periodically. S502. Each node updates the detection model based on the local data collected in S501. , means as follows: ； Wherein, the model parameters are Local data is , Indicates the learning rate. This represents the loss function, used to measure the deviation between the model's predictions and the actual data; S503, All nodes update their model parameters The data is sent to the central server, which aggregates the parameters using a weighted average method, as shown below: ； in, It's weight. Represents global model parameters; S504, Set global model parameters The system sends updates to the local model back to each node, while each node monitors and records the performance of its model.

5. The network security early warning method based on deep learning according to claim 1, characterized in that, S6 specifically includes: S601. Deploy sensors at key network nodes to process and store large amounts of network data; S602. Capture real-time network traffic data and preprocess and extract features from the data; S603. Identify abnormal patterns in the data and determine whether an alarm needs to be issued.

6. A deep learning-based network security early warning system, comprising a computer-readable storage medium and a processor, characterized in that, The computer-readable storage medium is used to store an executable program; the processor is used to read the executable program stored in the computer-readable storage medium and execute the deep learning-based network security early warning method according to any one of claims 1-5.

Images