Network security protection method and system based on deep learning

Abstract

The present invention discloses a network security protection method and system based on deep learning, which relates to the field of network security protection technology. The method includes: obtaining the interconnection structure of network devices; constructing multiple exception catchers for the target network; performing joint data monitoring on the target network through the exception catcher, identifying abnormal network devices, and extracting abnormal communication information of abnormal network devices; taking the abnormal network device as the center, determining the associated device network, and extracting the associated communication information of network devices in the associated device network; performing collaborative analysis on the abnormal communication information and the associated communication information, generating a security protection strategy, and performing security protection on the network based on the security protection strategy. The present invention solves the technical problem that all security intrusions in the prior art are protected as a whole and lack targeted protection. By performing collaborative analysis on the abnormal communication information and the associated communication information, and generating a targeted security protection strategy, the technical effect of improving the pertinence and effectiveness of security protection is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a network security protection method and system based on deep learning. Background Art

[0002] With the rapid development of the Internet, the network has become an indispensable part of people's lives and work. However, network security issues have also arisen. Traditional network security protection methods such as firewalls and intrusion detection systems can no longer fully cope with increasingly complex and intelligent network attacks.

[0003] Deep learning is a new technology in machine learning that has powerful pattern recognition and automated feature learning capabilities, and has demonstrated excellent performance in computer vision, natural language processing, and other fields. In recent years, deep learning technology has received widespread attention and preliminary applications in the field of network security, showing good prospects. However, the network security protection methods currently explored based on deep learning still have shortcomings, and overall protection is provided for all security intrusions, lacking targeted protection. Summary of the invention

[0004] The present application provides a network security protection method and system based on deep learning, which is used to solve the technical problem that the existing technology provides overall protection for all security intrusions and lacks targeted protection.

[0005] In view of the above problems, the present application provides a network security protection method and system based on deep learning.

[0006] In a first aspect of the present application, a network security protection method based on deep learning is provided, the method comprising:

[0007] Acquire a network device interconnection structure, wherein the network device interconnection structure is acquired by identifying the communication environment of a target network, and the network device interconnection structure includes a plurality of network devices; construct a plurality of exception catchers for the target network based on the network device interconnection structure, wherein the plurality of exception catchers correspond one-to-one to a plurality of network devices; perform joint data monitoring on the target network through the plurality of exception catchers, identify abnormal network devices, and extract abnormal communication information of the abnormal network devices; determine an associated device network with the abnormal network device as the center, and extract associated communication information of network devices in the associated device network; perform collaborative analysis on the abnormal communication information and associated communication information, generate a security protection strategy, and perform security protection on the target network based on the security protection strategy.

[0008] A second aspect of the present application provides a network security protection system based on deep learning, the system comprising:

[0009] A network device interconnection structure acquisition unit, wherein the network device interconnection structure acquisition unit acquires a network device interconnection structure, wherein the network device interconnection structure is acquired by identifying the communication environment of the target network, and the network device interconnection structure includes multiple network devices; an exception catcher construction unit, wherein the exception catcher construction unit constructs multiple exception catchers for the target network based on the network device interconnection structure, wherein the multiple exception catchers correspond one-to-one to multiple network devices; an abnormal network device identification unit, wherein the abnormal network device identification unit performs joint data monitoring on the target network through the multiple exception catchers, identifies abnormal network devices, and extracts abnormal communication information of the abnormal network devices; an associated device network determination unit, wherein the associated device network determination unit determines the associated device network with the abnormal network device as the center, and extracts associated communication information of network devices in the associated device network; a network security protection unit, wherein the network security protection unit performs collaborative analysis on the abnormal communication information and associated communication information, generates a security protection strategy, and performs security protection on the target network based on the security protection strategy.

[0010] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0011] The present application obtains the interconnection structure of network devices; constructs multiple exception catchers for the target network based on the interconnection structure of network devices; performs joint data monitoring on the target network through multiple exception catchers, identifies abnormal network devices, and extracts abnormal communication information of abnormal network devices; determines the associated device network with the abnormal network device as the center, and extracts the associated communication information of network devices in the associated device network; performs collaborative analysis on the abnormal communication information and the associated communication information, generates a security protection strategy, and performs security protection on the target network based on the security protection strategy. The present invention solves the technical problem that all security intrusions in the prior art are protected as a whole and lack targeted protection. By performing collaborative analysis on the abnormal communication information and the associated communication information, a targeted security protection strategy is generated, and the technical effect of improving the pertinence and effectiveness of security protection is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A schematic diagram of a deep learning-based network security protection method flow chart provided in an embodiment of the present application;

[0014] Figure 2 A schematic diagram of the structure of a deep learning-based network security protection system provided in an embodiment of the present application.

[0015] Explanation of the reference numerals: network device interconnection structure acquisition unit 11, abnormality catcher construction unit 12, abnormal network device identification unit 13, associated device network determination unit 14, network security protection unit 15. DETAILED DESCRIPTION

[0016] This application provides a network security protection method and system based on deep learning, aiming to solve the technical problem that all security intrusions in the prior art are protected as a whole and lack targeted protection. By collaboratively analyzing abnormal communication information and related communication information, targeted security protection strategies are generated, thereby achieving the technical effect of improving the pertinence and effectiveness of security protection.

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0018] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] Embodiment 1

[0020] like Figure 1 As shown, the present application provides a network security protection method based on deep learning, the method comprising:

[0021] Step S100: obtaining a network device interconnection structure, wherein the network device interconnection structure is obtained by identifying a communication environment of a target network, and the network device interconnection structure includes a plurality of network devices;

[0022] In the embodiment of the present application, the target network is firstly scanned and detected comprehensively using existing network scanning tools to collect information of various devices in the network, such as IP address, MAC address, port status, etc. Next, based on the collected device information, a preliminary model of the network device interconnection structure is constructed, which includes all known devices in the network and preliminarily depicts the connection relationship between the devices. At this stage, a network topology discovery algorithm, such as a link layer discovery protocol or a network topology mapping technology, is used to automatically identify and draw the connection relationship between devices.

[0023] Relying solely on device information and topology discovery algorithms is not enough to build a completely accurate network device interconnection structure. Therefore, in-depth analysis of the communication traffic in the network is performed. By monitoring and analyzing the communication traffic between network devices, the connection relationship between devices can be further confirmed, and possible hidden devices or communication links can be discovered.

[0024] Finally, through the above series of steps, an accurate and complete network device interconnection structure is obtained.

[0025] Step S200: constructing a plurality of exception catchers for the target network based on the network device interconnection structure, wherein the plurality of exception catchers correspond one-to-one to a plurality of network devices;

[0026] In an embodiment of the present application, all network devices included in the target network are determined based on the information in the network device interconnection structure. These network devices include routers, servers, terminals, etc. For each network device, a corresponding exception catcher is constructed. The construction of the exception catcher is based on deep learning technology, and the normal behavior pattern of the network device is identified by training the deep learning model. During the training process, the historical operation data or simulation data of the network device is used as a training sample to allow the model to learn and understand the network traffic, communication protocol, device status and other characteristics under normal circumstances. Once the model training is completed, it is deployed as an exception catcher on the corresponding network device.

[0027] Step S300: performing joint data monitoring on the target network through the multiple anomaly catchers, identifying abnormal network devices, and extracting abnormal communication information of the abnormal network devices;

[0028] In the embodiment of the present application, multiple anomaly catchers simultaneously monitor data of each device in the target network. Each anomaly catcher is responsible for monitoring the communication data of the network device corresponding to it, including key information such as network traffic, data packet content, and communication protocol.

[0029] During the monitoring process, the anomaly catcher uses a pre-trained deep learning model to analyze the collected data in real time, identifying and distinguishing the normal communication mode and abnormal communication mode of network devices. When the monitored data is significantly different from the normal mode, the anomaly catcher preliminarily determines that the device may be abnormal.

[0030] In order to more accurately identify abnormal network devices, multiple anomaly catchers conduct joint data monitoring. They share the monitored data and conduct collaborative analysis. By comparing the communication data between different devices, the catcher discovers the correlation and abnormal patterns hidden in the data. For example, if multiple devices have abnormal communication traffic or similar communication behaviors at the same time, it means that they have been attacked by the same attack or infected with the same malware.

[0031] Once abnormal network devices are identified, the anomaly catcher further extracts abnormal communication information of these devices, including the time, frequency, source and destination addresses, communication protocols, and data packet contents of abnormal communications.

[0032] Step S400: taking the abnormal network device as the center, determining the associated device network, and extracting the associated communication information of the network devices in the associated device network;

[0033] In the embodiment of the present application, the abnormal network device is used as the core node to start building an associated device network. The associated device network is a collection of devices that have direct or indirect communication relationships with the abnormal network device. In order to accurately identify these devices, the information of the interconnection structure of the network devices is used to trace the connection path and communication relationship of the abnormal network device in the network. By querying the connection records, routing tables, ARP caches and other information of the network device, the device network associated with the abnormal network device is gradually constructed.

[0034] After determining the associated device network, extract the associated communication information of the network devices in the associated device network. The associated communication information refers to various data generated during the communication process with abnormal network devices, including communication protocols, communication frequencies, data packet contents, etc. By collecting and analyzing communication data, the communication mode and interaction behavior between abnormal network devices and associated devices are revealed.

[0035] When extracting relevant communication information, we use a variety of technical means, such as traffic analysis, protocol parsing, and packet capture. These technical means are used to obtain the specific content of the communication data, such as the files transmitted, the commands executed, the resources accessed, etc. At the same time, we combine network security knowledge and experience to filter and screen the communication data, exclude irrelevant information and noise, and extract key information related to abnormal behavior.

[0036] Step S500: collaboratively analyzing the abnormal communication information and the associated communication information, generating a security protection strategy, and performing security protection on the target network based on the security protection strategy.

[0037] In the embodiment of the present application, the abnormal communication information and the associated communication information are analyzed collaboratively, and by comparing and associating these information, potential risk points and attack patterns hidden in the data are discovered. For example, it is found that the abnormal communication information contains the propagation path of the malware, and the associated communication information reveals how the malware is propagated through the communication between network devices.

[0038] Next, based on the results of the collaborative analysis, a security protection strategy is generated. The security protection strategy considers multiple factors including attack type, attack source, attack path, and network topology. Based on these factors, determine which devices need to be focused on, which communication behaviors need to be restricted or monitored, and what specific protective measures need to be taken. When generating a security protection strategy, use existing network security technologies and tools, such as firewalls, intrusion detection systems, and security event management, to implement access control, traffic filtering, threat detection, and other functions, thereby effectively resisting network attacks.

[0039] Furthermore, step S200 in the method provided in the application embodiment also includes:

[0040] Locking a first network device in the network device interconnection structure;

[0041] Collecting first historical operation data of the first network device, classifying the first historical operation data according to the global operation identifier, obtaining multiple first historical operation data groups, and binding corresponding global operation identifiers to the multiple first historical operation data groups respectively;

[0042] Performing equipment operation identification on the first historical operation data in the plurality of first historical operation data groups respectively, obtaining an equipment operation data sample set and an equipment operation status sample set, wherein the equipment operation identification includes a normal operation identification and an abnormal operation identification;

[0043] Based on the global operation identifier, the device operation data sample set and the device operation status sample set, construct a first exception catcher, and deploy the first exception catcher in the first network device;

[0044] Exception catchers are constructed for the remaining network devices in the network device interconnection structure in turn to obtain multiple exception catchers.

[0045] In the embodiment of the present application, the first network device in the target network is locked according to the description and mapping relationship of the network device structure. The device is selected according to the location in the network topology, device type or other specific conditions.

[0046] After locking the first network device, start collecting historical operation data related to the first network device, namely the first historical operation data. The first historical operation data contains information such as the operation status, communication records, performance parameters, etc. of the network device over a period of time. Next, the collected first historical operation data is classified according to the global operation identifier. The global operation identifier is used to identify the label of the state or stage of the network device under different operating environments. By classifying the historical operation data, the first historical operation data is divided into multiple first historical operation data groups, and each data group corresponds to a global operation identifier.

[0047] Then, the data in each first historical operation data group is marked with equipment operation. The equipment operation identification includes a normal operation identification and an abnormal operation identification, which is used to distinguish the operation status of the equipment at different time points. By marking the equipment operation of the historical operation data, a device operation data sample set and a device operation status sample set are obtained. The device operation data sample set contains various data instances of normal operation and abnormal operation, and the device operation status sample set records the operation status corresponding to each data instance.

[0048] Based on the acquired device operation data sample set and device operation status sample set, start to build the first exception catcher. This application uses an autoencoder to build a model. When training the model, the device operation data sample set and the global operation identifier are divided into parts of the training set for training the model. Then, the difference between the model prediction value and the true value is defined to guide the optimization process of the model. For the autoencoder, a common loss function is the reconstruction error, such as the mean square error. In each iteration, the model updates its parameters such as weights and biases according to the calculated gradient to minimize the loss function. Then, based on the change in the loss value, the accuracy rate, etc., the training effect of the model and whether there are problems such as overfitting are evaluated. Through multiple iterative training, the model gradually learns the ability to extract features from the input device operation data and accurately detect anomalies. After the training is completed, the first exception catcher is obtained. The first exception catcher is deployed in the first network device, the operation data of the device is received in real time, and anomaly detection is performed through the model.

[0049] Repeat the above steps for the remaining network devices in the network device interconnection structure in turn, build and deploy an exception catcher for each device, and achieve comprehensive monitoring and protection of the entire target network.

[0050] Furthermore, step S300 in the method provided in the application embodiment also includes:

[0051] Based on the multiple exception catchers, real-time device operation data of multiple network devices are respectively identified to obtain multiple capture results;

[0052] When there is an abnormality in the multiple capture results, locking the local abnormal device and determining it as an abnormal network device;

[0053] Extracting abnormal communication information of the local abnormal device, and sharing the abnormal communication information with multiple network devices through an emergency communication channel;

[0054] The abnormal communication information is specifically identified by using the multiple abnormality catchers, and the remaining network devices with abnormal communication information are determined as abnormal network devices.

[0055] In the embodiment of the present application, after receiving the real-time device operation data of the network device, the abnormality catcher performs in-depth analysis on the data, and identifies whether there are abnormal features in the operation data by comparing the normal operation mode and the potential abnormal mode. After completing the identification, the abnormality catcher generates a capture result, which is a binary classification label indicating whether the operation status of the network device is normal or abnormal.

[0056] Multiple exception catchers respectively and synchronously identify the real-time device operation data of multiple network devices. Each device has a corresponding exception catcher for identification and generates corresponding capture results.

[0057] When there is an exception in the capture result, that is, the capture result of one or more network devices is labeled as an exception, the system enters the exception handling process and locks the local abnormal devices, that is, those network devices identified as abnormal by the exception capturer.

[0058] The system then extracts the abnormal communication information of the local abnormal device. This information includes abnormal communication protocols, traffic patterns, data packet contents, etc. After the extraction is completed, the system broadcasts this abnormal communication information to multiple network devices through the emergency communication channel. The emergency communication channel is a reliable, high-priority communication mechanism used to quickly transmit critical information in emergency situations. Through this channel, abnormal communication information can quickly reach other network devices and trigger the abnormal catchers on them for targeted identification.

[0059] Finally, the anomaly catcher on each network device identifies the abnormal communication information received and analyzes whether the information matches or has a high similarity pattern with its own operation data. If so, these devices are identified as abnormal network devices.

[0060] Furthermore, step S400 in the method provided in the application embodiment also includes:

[0061] Determine an associated tracing window based on the abnormal communication information;

[0062] In the associated tracing window, query the network devices that interact with the abnormal network device to obtain an interaction device set;

[0063] According to the interactive device set and in combination with the network device interconnection structure, an associated device network is obtained.

[0064] In an embodiment of the present application, the abnormal communication information includes key information such as timestamp, source address, destination address, communication protocol, and traffic size. The system determines a time range based on this information, namely the associated tracing window, and the size of this window is set according to the nature of the anomaly and the characteristics of the network. When determining the associated tracing window, the approximate time when the anomaly occurred is determined based on the timestamp in the abnormal communication information. If the anomaly is an ongoing process rather than an instantaneous event, then the associated tracing window covers the entire time period during which the anomaly persists.

[0065] After the associated tracing window is determined, the network traffic data is analyzed, and other network devices with communication records in the associated tracing window are screened out from the abnormal network device based on the source address and target address information. These devices are called interactive devices and constitute an interactive device set.

[0066] After obtaining the interactive device set, the system further determines the associated device network based on the network device interconnection structure. The network device interconnection structure describes the connection relationship and communication path between each device in the network. By analyzing this structure, the system finds other devices that are directly or indirectly connected to the abnormal network device, as well as the communication paths between them. These devices and paths together constitute the associated device network.

[0067] Furthermore, step S500 in the method provided in the application embodiment also includes:

[0068] Obtain a network attack solution sample set, and set a network protection solution sample set based on the network attack solution sample set;

[0069] The network attack scheme sample set includes a plurality of network attack scheme samples, each of which has sample abnormal communication information and sample associated communication information;

[0070] Generate a collaborative analyzer according to the network attack solution sample set and the network protection solution sample set;

[0071] The abnormal communication information and the associated communication information are input into the collaborative analyzer, and a network protection solution is output as a security protection strategy.

[0072] In an embodiment of the present application, obtaining a network attack scenario sample set is the first step in building a security protection strategy. The network attack scenario sample set includes a variety of network attack scenario samples. Each network attack scenario sample includes sample abnormal communication information and sample associated communication information. This information reflects the traces and attack paths left by the attacker in the network.

[0073] After obtaining the network attack scenario sample set, set the network protection scenario sample set based on these sample sets. The network protection scenario sample set is the corresponding protection strategy formulated for each network attack scenario sample, aiming to effectively defend and respond to potential attacks. These protection solutions include firewall rules, intrusion detection system configuration, security incident response process, etc.

[0074] With the network attack scenario sample set and the network protection scenario sample set, a collaborative analyzer is generated. The collaborative analyzer is a model that combines network attack and network protection knowledge. It can analyze potential attack behaviors based on the input abnormal communication information and related communication information, and recommend corresponding network protection solutions. When generating a collaborative analyzer, a support vector machine is used to build a model, and the network attack scenario sample set and the network protection scenario sample set are divided into a training set, a validation set, and a test set. The training set is used to train the model, the validation set is used to adjust the model parameters and prevent overfitting, and finally the test set is used to evaluate the trained model, and the model is tuned according to the evaluation results. Through the above process, a collaborative analyzer is generated.

[0075] After the collaborative analyzer is generated, the abnormal communication information and related communication information are input into the collaborative analyzer. This information may come from real-time monitored network traffic, log records, or security incident response systems. The collaborative analyzer analyzes this information, identifies potential attack behaviors, and outputs corresponding network protection solutions. The output network protection solutions are used as security protection strategies to protect network security.

[0076] When dealing with different levels of attacks, the network protection plan is also different. Specifically, a central device in the network has abnormal communication behavior, but other devices associated with it behave normally. In this case, the collaborative analyzer will determine that this is a relatively isolated attack incident with a low risk. Therefore, it recommends isolating and further investigating only the central device, without taking large-scale actions on the entire network. If the abnormal communication behavior occurs not only in the central device, but also spreads to multiple devices associated with it, the collaborative analyzer will determine that this is a widespread attack incident. To prevent the attack from spreading further throughout the network, the collaborative analyzer recommends isolating the entire associated network.

[0077] Furthermore, after extracting the abnormal communication information of the abnormal network device, the method further includes:

[0078] Performing familiarity recognition on the abnormal communication information to obtain abnormal familiarity;

[0079] When the abnormal familiarity is lower than a preset familiarity, sending an interaction restriction instruction to the plurality of network devices;

[0080] The data interaction of the plurality of network devices is controlled based on the interaction restriction instruction.

[0081] In the embodiment of the present application, familiarity recognition is a process of analyzing and evaluating abnormal communication information, performing familiarity recognition on abnormal communication information to determine whether the abnormal communication information belongs to a known, common attack pattern or behavior. The recognition process is to compare the abnormal communication information with a pre-stored attack pattern library and calculate the abnormal familiarity based on the degree of match. Abnormal familiarity is a quantitative indicator that reflects the similarity or match between abnormal communication information and a known attack pattern.

[0082] Next, the system compares the calculated abnormal familiarity with the preset familiarity. The preset familiarity is a threshold set according to network security policies and actual needs to determine the risk level of abnormal communication information. If the abnormal familiarity is lower than the preset familiarity, it means that these abnormal communication information does not match the known attack pattern well and is a new or unknown attack method. In this case, the system sends interaction restriction instructions to multiple network devices to limit or block data interaction between network devices to prevent potential attacks from spreading or further damaging the network.

[0083] Finally, based on the interaction restriction instructions, the system controls the data interaction of multiple network devices, including real-time monitoring and filtering of communications between network devices to ensure that only data packets that comply with security policies can pass. In this way, abnormal communications can be isolated and blocked to protect the security and stability of the network.

[0084] Furthermore, the method further comprises:

[0085] activating a plurality of emergency interaction device tables of the plurality of network devices respectively according to the interaction restriction instruction;

[0086] Eliminate the abnormal network device from the multiple emergency interaction device tables to obtain a trustworthy interaction device table;

[0087] The data interaction of the plurality of network devices is managed and controlled based on the credibility interaction device table.

[0088] In the embodiment of the present application, the emergency interaction device table is a pre-set list of a group of network devices, which have a high security protection level and are used to ensure the reliability and security of network communications in emergency situations. When the system receives an interaction restriction instruction, these emergency interaction device tables are immediately activated. The activation process includes unlocking the communication ports of these devices, adjusting firewall rules, or enabling specific security communication protocols.

[0089] After activating the emergency interactive device table, the system will screen the devices in these tables to identify and remove abnormal network devices. The identification and removal process is to compare the devices in the table with known abnormal communication information. If a device is associated with abnormal communication information, or its behavior pattern is similar to attack behavior, the device is considered an abnormal network device and removed from the emergency interactive device table. After removing abnormal network devices, the remaining devices constitute the trustworthy interactive device table. These devices are relatively safe and are used for network communication under restricted conditions.

[0090] After obtaining the trustworthy interactive device table, the system controls the data interaction of multiple network devices based on this table. Specifically, the system only allows devices in the trustworthy interactive device table to communicate, and rejects communication requests from other devices.

[0091] In the embodiments of the present application, in summary, the embodiments of the present application have at least the following technical effects:

[0092] The present application obtains the interconnection structure of network devices; constructs multiple exception catchers for the target network based on the interconnection structure of network devices; performs joint data monitoring on the target network through multiple exception catchers, identifies abnormal network devices, and extracts abnormal communication information of abnormal network devices; determines the associated device network with the abnormal network device as the center, and extracts the associated communication information of network devices in the associated device network; performs collaborative analysis on the abnormal communication information and the associated communication information, generates a security protection strategy, and performs security protection on the target network based on the security protection strategy. The present invention solves the technical problem that all security intrusions in the prior art are protected as a whole and lack targeted protection. By performing collaborative analysis on the abnormal communication information and the associated communication information, a targeted security protection strategy is generated, and the technical effect of improving the pertinence and effectiveness of security protection is achieved.

[0093] Embodiment 2

[0094] Based on the same inventive concept as the network security protection method based on deep learning in the aforementioned embodiment, Figure 2 As shown, the present application provides a network security protection system based on deep learning, and the system and method embodiments in the present application are based on the same inventive concept. The system includes:

[0095] A network device interconnection structure acquisition unit 11, wherein the network device interconnection structure acquisition unit 11 acquires a network device interconnection structure, wherein the network device interconnection structure is acquired by identifying a communication environment of a target network, and the network device interconnection structure includes a plurality of network devices;

[0096] An exception catcher construction unit 12, wherein the exception catcher construction unit 12 constructs a plurality of exception catchers for the target network based on the network device interconnection structure, wherein the plurality of exception catchers correspond one-to-one to a plurality of network devices;

[0097] An abnormal network device identification unit 13, wherein the abnormal network device identification unit 13 performs joint data monitoring on the target network through the multiple abnormality catchers, identifies abnormal network devices, and extracts abnormal communication information of the abnormal network devices;

[0098] An associated device network determining unit 14, wherein the associated device network determining unit 14 determines an associated device network with the abnormal network device as the center, and extracts associated communication information of network devices in the associated device network;

[0099] The network security protection unit 15 performs collaborative analysis on the abnormal communication information and the associated communication information, generates a security protection strategy, and performs security protection on the target network based on the security protection strategy.

[0100] Furthermore, the system also includes:

[0101] Locking a first network device in the network device interconnection structure;

[0102] Collecting first historical operation data of the first network device, classifying the first historical operation data according to the global operation identifier, obtaining multiple first historical operation data groups, and binding corresponding global operation identifiers to the multiple first historical operation data groups respectively;

[0103] Performing equipment operation identification on the first historical operation data in the plurality of first historical operation data groups respectively, obtaining an equipment operation data sample set and an equipment operation status sample set, wherein the equipment operation identification includes a normal operation identification and an abnormal operation identification;

[0104] Based on the global operation identifier, the device operation data sample set and the device operation status sample set, construct a first exception catcher, and deploy the first exception catcher in the first network device;

[0105] Exception catchers are constructed for the remaining network devices in the network device interconnection structure in turn to obtain multiple exception catchers.

[0106] Furthermore, the system also includes:

[0107] Based on the multiple exception catchers, real-time device operation data of multiple network devices are respectively identified to obtain multiple capture results;

[0108] When there is an abnormality in the multiple capture results, locking the local abnormal device and determining it as an abnormal network device;

[0109] Extracting abnormal communication information of the local abnormal device, and sharing the abnormal communication information with multiple network devices through an emergency communication channel;

[0110] The abnormal communication information is specifically identified by using the multiple abnormality catchers, and the remaining network devices with abnormal communication information are determined as abnormal network devices.

[0111] Furthermore, the system also includes:

[0112] Determine an associated tracing window based on the abnormal communication information;

[0113] In the associated tracing window, query the network devices that interact with the abnormal network device to obtain an interaction device set;

[0114] According to the interactive device set and in combination with the network device interconnection structure, an associated device network is obtained.

[0115] Furthermore, the system also includes:

[0116] Obtain a network attack solution sample set, and set a network protection solution sample set based on the network attack solution sample set;

[0117] The network attack scheme sample set includes a plurality of network attack scheme samples, each of which has sample abnormal communication information and sample associated communication information;

[0118] Generate a collaborative analyzer according to the network attack solution sample set and the network protection solution sample set;

[0119] The abnormal communication information and the associated communication information are input into the collaborative analyzer, and a network protection solution is output as a security protection strategy.

[0120] Furthermore, the system also includes:

[0121] Performing familiarity recognition on the abnormal communication information to obtain abnormal familiarity;

[0122] When the abnormal familiarity is lower than a preset familiarity, sending an interaction restriction instruction to the plurality of network devices;

[0123] The data interaction of the plurality of network devices is controlled based on the interaction restriction instruction.

[0124] Furthermore, the system also includes:

[0125] activating a plurality of emergency interaction device tables of the plurality of network devices respectively according to the interaction restriction instruction;

[0126] Eliminate the abnormal network device from the multiple emergency interaction device tables to obtain a trustworthy interaction device table;

[0127] The data interaction of the plurality of network devices is managed and controlled based on the credibility interaction device table.

[0128] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description and does not represent the advantages and disadvantages of the embodiments. And the above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0129] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

[0130] This specification and drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A network security protection method based on deep learning, characterized in that: The method comprises: Acquire a network device interconnection structure, wherein the network device interconnection structure is acquired by identifying a communication environment of a target network, and the network device interconnection structure includes a plurality of network devices; Building a plurality of exception catchers for the target network based on the network device interconnection structure, wherein the plurality of exception catchers correspond one-to-one to a plurality of network devices; Performing joint data monitoring on the target network through the multiple anomaly catchers, identifying abnormal network devices, and extracting abnormal communication information of the abnormal network devices; Taking the abnormal network device as the center, determining the associated device network, and extracting the associated communication information of the network devices in the associated device network; Collaboratively analyzing the abnormal communication information and the associated communication information, generating a security protection strategy, and performing security protection on the target network based on the security protection strategy; Constructing a plurality of exception catchers for the target network based on the network device interconnection structure, including: Locking a first network device in the network device interconnection structure; Collecting first historical operation data of the first network device, classifying the first historical operation data according to the global operation identifier, obtaining multiple first historical operation data groups, and binding corresponding global operation identifiers to the multiple first historical operation data groups respectively; Performing equipment operation identification on the first historical operation data in the plurality of first historical operation data groups respectively, obtaining an equipment operation data sample set and an equipment operation status sample set, wherein the equipment operation identification includes a normal operation identification and an abnormal operation identification; Based on the global operation identifier, the device operation data sample set and the device operation status sample set, construct a first exception catcher, and deploy the first exception catcher in the first network device; Exception catchers are constructed for the remaining network devices in the network device interconnection structure in turn to obtain multiple exception catchers.

2. The method according to claim 1, characterized in that Performing joint data monitoring on the target network through the multiple anomaly catchers to identify abnormal network devices includes: Based on the multiple exception catchers, real-time device operation data of multiple network devices are respectively identified to obtain multiple capture results; When there is an abnormality in the multiple capture results, locking the local abnormal device and determining it as an abnormal network device; Extracting abnormal communication information of the local abnormal device, and sharing the abnormal communication information with multiple network devices through an emergency communication channel; The abnormal communication information is specifically identified by using the multiple abnormality catchers, and the remaining network devices with abnormal communication information are determined as abnormal network devices.

3. The method according to claim 1, characterized in that Taking the abnormal network device as the center, determine the associated device network, including: Determine an associated tracing window based on the abnormal communication information; In the associated tracing window, query the network devices that interact with the abnormal network device to obtain an interaction device set; According to the interactive device set and in combination with the network device interconnection structure, an associated device network is obtained.

4. The method according to claim 1, characterized in that: The abnormal communication information and the associated communication information are collaboratively analyzed to generate a security protection strategy, including: Obtain a network attack solution sample set, and set a network protection solution sample set based on the network attack solution sample set; The network attack scheme sample set includes a plurality of network attack scheme samples, each of which has sample abnormal communication information and sample associated communication information; Generate a collaborative analyzer according to the network attack solution sample set and the network protection solution sample set; The abnormal communication information and the associated communication information are input into the collaborative analyzer, and a network protection solution is output as a security protection strategy.

5. The method according to claim 1, characterized in that After extracting the abnormal communication information of the abnormal network device, the method further includes: Performing familiarity recognition on the abnormal communication information to obtain abnormal familiarity; When the abnormal familiarity is lower than a preset familiarity, sending an interaction restriction instruction to the plurality of network devices; The data interaction of the plurality of network devices is controlled based on the interaction restriction instruction.

6. The method according to claim 5, characterized in that Controlling the data interaction of the plurality of network devices based on the interaction restriction instruction includes: activating a plurality of emergency interaction device tables of the plurality of network devices respectively according to the interaction restriction instruction; Eliminate the abnormal network device from the multiple emergency interaction device tables to obtain a trustworthy interaction device table; The data interaction of the plurality of network devices is managed and controlled based on the credibility interaction device table.

7. A network security protection system based on deep learning, characterized in that: The system comprises: A network device interconnection structure acquisition unit, wherein the network device interconnection structure acquisition unit acquires a network device interconnection structure, wherein the network device interconnection structure is acquired by identifying a communication environment of a target network, and the network device interconnection structure includes a plurality of network devices; An exception catcher construction unit, wherein the exception catcher construction unit constructs a plurality of exception catchers for the target network based on the network device interconnection structure, wherein the plurality of exception catchers correspond one-to-one to a plurality of network devices; an abnormal network device identification unit, wherein the abnormal network device identification unit performs joint data monitoring on the target network through the multiple abnormality catchers, identifies abnormal network devices, and extracts abnormal communication information of the abnormal network devices; An associated device network determining unit, wherein the associated device network determining unit determines an associated device network with the abnormal network device as the center, and extracts associated communication information of network devices in the associated device network; A network security protection unit, wherein the network security protection unit performs collaborative analysis on the abnormal communication information and the associated communication information, generates a security protection strategy, and performs security protection on the target network based on the security protection strategy; The system further comprises: Locking a first network device in the network device interconnection structure; Collecting first historical operation data of the first network device, classifying the first historical operation data according to the global operation identifier, obtaining multiple first historical operation data groups, and binding corresponding global operation identifiers to the multiple first historical operation data groups respectively; Performing equipment operation identification on the first historical operation data in the plurality of first historical operation data groups respectively, obtaining an equipment operation data sample set and an equipment operation status sample set, wherein the equipment operation identification includes a normal operation identification and an abnormal operation identification; Based on the global operation identifier, the device operation data sample set and the device operation status sample set, construct a first exception catcher, and deploy the first exception catcher in the first network device; Exception catchers are constructed for the remaining network devices in the network device interconnection structure in turn to obtain multiple exception catchers.

Images