A method, apparatus, device, and storage medium for predicting network attack traffic.

Abstract

The application discloses a network attack flow prediction method and device, equipment and a storage medium, and relates to the technical field of deep learning, which comprises the following steps: in the encoding stage, the preset spatial attention mechanism is used to encode the to-be-processed data stream to obtain a spatial weighted input vector, and the spatial weighted input vector and the initial hidden state of the to-be-processed data stream are used to obtain a first hidden state; in the encoding stage, the preset parameter attention mechanism is used to process the parameters corresponding to the spatial weighted input vector to obtain a parameter weighted input vector, and the parameter weighted input vector and the first hidden state are processed to obtain a second hidden state; in the decoding stage, the preset time attention mechanism is used to process the time steps to obtain a time attention weight, and the time attention weight and the second hidden state are used to decode to obtain a predicted time sequence of the target parameter. In this way, the spatial correlation, the parameter dependency and the time correlation are utilized, and the prediction accuracy can be improved.

Description

Technical Field

[0001] This invention relates to the field of deep learning technology, and in particular to a method, apparatus, device, and storage medium for predicting network attack traffic. Background Technology

[0002] Malicious cyberattacks have become a significant issue in the field of cybersecurity. Traditional defense measures often only passively address known threats and are ineffective against unknown attacks. Currently, most predictive models used in this field fail to fully extract relevant information from real-world scenarios, resulting in low prediction accuracy, which no longer meets current security requirements.

[0003] Therefore, how to fully extract effective information and obtain more reliable network attack traffic prediction results is a problem that needs to be solved in this field. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for predicting network attack traffic, which can utilize spatial correlation, parameter dependence, and temporal correlation to improve prediction accuracy. The specific solution is as follows:

[0005] Firstly, this application provides a method for predicting network attack traffic, including:

[0006] During the encoding phase, a spatially weighted input vector for each variable type at a corresponding time step is obtained by encoding the data stream to be processed based on a preset spatial attention mechanism. The data stream to be processed is then processed based on the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed to obtain a first hidden state for several observation points. The data stream to be processed includes observation points, time steps, and multi-source variable measurement values ​​composed of parameters corresponding to different variable types for each observation point. The data stream to be processed is a time series of historical network attack traffic.

[0007] During the encoding stage, each parameter of the single variable type corresponding to the spatial weighted input vector is processed based on the preset parameter attention mechanism to obtain the parameter weighted input vector of each parameter at the corresponding time step, and the parameter weighted input vector and the first hidden state are processed to obtain the second hidden state for several parameters.

[0008] During the decoding stage, the time step is processed based on a preset time attention mechanism to obtain time attention weights that characterize the hidden states corresponding to each parameter, so as to decode the predicted time series of the target parameters based on the time attention weights and the second hidden state.

[0009] Optionally, the step of encoding the data stream to be processed based on a preset spatial attention mechanism to obtain a spatially weighted input vector of a single variable type at the corresponding time step includes:

[0010] By using a multilayer perceptron to encode the time series of historical network attack traffic corresponding to a single variable type in the data stream to be processed, the spatial correlation of a single variable type at the corresponding time step is obtained.

[0011] The spatial correlation is converted into a probabilistic form by a normalized exponential function to obtain the spatial attention weights that characterize the observation points when making predictions at the time step. The spatial attention weights and the corresponding variable types are then combined to obtain the spatially weighted input vector of a single variable type at the corresponding time step.

[0012] Optionally, the step of processing the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed to obtain the first hidden state for several observation points includes:

[0013] Determine the initial hidden state corresponding to the data stream to be processed;

[0014] For the first spatially weighted input vector, a long short-term memory network is used to process the spatially weighted input vector and the initial hidden state to obtain the corresponding processed hidden state;

[0015] For non-first spatially weighted input vectors, a long short-term memory network is used to process the spatially weighted input vector and the processed hidden state corresponding to the previous observation point to obtain the first hidden state for several observation points.

[0016] Optionally, the step of processing each parameter of a single variable type corresponding to the spatially weighted input vector based on a preset parameter attention mechanism to obtain a parameter-weighted input vector of each parameter at the corresponding time step includes:

[0017] The parameters of each variable type corresponding to the spatially weighted input vector are processed using a multilayer perceptron to obtain the parameter correlation degree of each parameter at the corresponding time step;

[0018] The correlation between the parameters is converted into a probabilistic form by using a normalized exponential function to obtain the parameter attention weights that characterize the prediction of the relevant parameters at the time step. The parameter attention weights and the corresponding parameters are then combined to obtain the parameter weighted input vector of each parameter at the corresponding time step.

[0019] Optionally, the step of processing the parameter-weighted input vector and the first hidden state to obtain a second hidden state for several parameters includes:

[0020] For the first parameter-weighted input vector, a long short-term memory network is used to process the parameter-weighted input vector to obtain the corresponding processed hidden state;

[0021] For non-first parameter-weighted input vectors, a long short-term memory network is used to process the processed hidden states corresponding to the parameter-weighted input vector and the previous parameter-weighted input vector to obtain a second hidden state for several parameters.

[0022] Optionally, the step of processing the time step based on a preset temporal attention mechanism to obtain temporal attention weights representing the hidden states corresponding to each parameter includes:

[0023] For the first hidden state in the second hidden state, processing is performed based on the first hidden state, the historical time series of the preset target parameters, and the time step to obtain the time attention weight representing the first hidden state at the time step;

[0024] For non-first hidden states in the second hidden state, the predicted time series of the hidden state and corresponding parameters corresponding to the previous hidden state after processing by the time attention weights are processed in conjunction with the time step to obtain the time attention weights that characterize the hidden state corresponding to each parameter at the relevant time step.

[0025] Optionally, obtaining the predicted time series of target parameters based on the temporal attention weights and the second hidden state decoding includes:

[0026] Determine the target parameters to be decoded and the corresponding target time step;

[0027] The second hidden state is weighted and calculated based on the target time step and the time attention weight to obtain the expected value representing the second hidden state at the target time step.

[0028] A linear transformation is performed on the predicted time series corresponding to the previous time step of the target time step and the expected value to obtain the current predicted time series for the target parameter.

[0029] Secondly, this application provides a method for predicting network attack traffic, including:

[0030] The spatial attention processing module is used in the encoding stage to encode the data stream to be processed based on a preset spatial attention mechanism to obtain a spatially weighted input vector of a single variable type at a corresponding time step, and to process the data stream to be processed based on the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed to obtain a first hidden state for several observation points; the data stream to be processed includes observation points, time steps, and multi-source variable measurement values ​​composed of parameters corresponding to different variable types for a single observation point; the data stream to be processed is a time series of historical network attack traffic;

[0031] The parameter attention processing module is used to process each parameter of a single variable type corresponding to the spatially weighted input vector based on a preset parameter attention mechanism during the encoding stage, to obtain the parameter weighted input vector of each parameter at the corresponding time step, and to process the parameter weighted input vector and the first hidden state to obtain the second hidden state for several parameters.

[0032] The time attention processing module is used to process the time step based on a preset time attention mechanism during the decoding stage to obtain time attention weights that characterize the hidden states corresponding to each parameter, so as to decode the predicted time series of the target parameter based on the time attention weights and the second hidden state.

[0033] Thirdly, this application provides an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor for executing the computer program to implement the network attack traffic prediction method described above.

[0036] Fourthly, this application provides a computer-readable storage medium for storing a computer program that, when executed by a processor, implements the network attack traffic prediction method described above.

[0037] Therefore, in the encoding stage, this application can encode the data stream to be processed based on a preset spatial attention mechanism to obtain a spatially weighted input vector of a single variable type at a corresponding time step, and process the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed to obtain a first hidden state for several observation points; the data stream to be processed includes observation points, time steps, and multi-source variable measurements composed of parameters corresponding to different variable types for a single observation point; the data stream to be processed is a time series of historical network attack traffic; and in the encoding stage, the parameters of each single variable type corresponding to the spatially weighted input vector can be processed based on a preset parameter attention mechanism to obtain a parameter-weighted input vector of each parameter at a corresponding time step, and the parameter-weighted input vector and the first hidden state can be processed to obtain a second hidden state for several parameters; then in the decoding stage, this application processes the time step based on a preset time attention mechanism to obtain time attention weights representing the hidden states corresponding to each parameter, and decodes the predicted time series of the target parameters based on the time attention weights and the second hidden state. In this way, during the prediction of network attack traffic, this application can mine the correlation between different observation points through spatial attention and the parameter dependence between multi-source variables through parameter attention during the encoding stage; then, in the decoding stage, it can mine the temporal correlation between data from different observation points through temporal attention. This can fully extract the effective information of historical network attack traffic and improve the accuracy of the final attack traffic prediction. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a flowchart of a network attack traffic prediction method disclosed in this application;

[0040] Figure 2 This is a schematic diagram of a specific multivariate time series relationship disclosed in this application;

[0041] Figure 3 This is a schematic diagram of an encoder-decoder model framework disclosed in this application;

[0042] Figure 4 This application discloses a specific method for predicting network attack traffic.

[0043] Figure 5 This is a schematic diagram of the structure of a network attack traffic prediction device disclosed in this application;

[0044] Figure 6 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] See Figure 1 As shown in the figure, an embodiment of the present invention discloses a method for predicting network attack traffic, including:

[0047] Step S11: In the encoding stage, the data stream to be processed is encoded based on a preset spatial attention mechanism to obtain a spatially weighted input vector of a single variable type at the corresponding time step. Based on the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed, a first hidden state for several observation points is obtained. The data stream to be processed includes observation points, time steps, and multi-source variable measurement values ​​composed of parameters corresponding to different variable types for a single observation point. The data stream to be processed is a time series of historical network attack traffic.

[0048] In this embodiment, a spatial, temporal, and parameter-based attention mechanism is embedded in the encoder-decoder structure model to extract deep feature information from the data stream at each observation point, which can improve the accuracy of network attack traffic prediction. For example... Figure 2 The figure shows the perceived data streams of each cloud center regarding geographical location, time step, and measurement parameters, as well as the observation of parameter n at observation location m at time step t, indicated by asterisks. The figure illustrates the relationships between the three categories, demonstrating the sequential interactions between multivariate time series data. This application fully mines useful information from multivariate time series data based on an encoder-decoder structure; specifically, it employs an attention-based RNN (Recurrent Neural Network) encoder-decoder model, which implements a sequence-to-sequence learning architecture. Its high-level framework is as follows: Figure 3As shown, in the encoder-decoder architecture, the encoder adaptively extracts hidden driving features by constructing a spatial and parameterized attention mechanism, while simultaneously using the weighted input as input to a recursive function. The decoder interprets the relevant hidden states from the encoder through a temporal attention mechanism to produce a predictive output. These three attention mechanisms are hierarchically integrated into the developed model, fully utilizing useful information in multivariate time series data. Furthermore, in the encoder, the embedded spatial attention mechanism can determine the more important observation points for prediction based on the network attack traffic time series of different input observation points.

[0049] In a specific embodiment, the step of encoding the data stream to be processed based on a preset spatial attention mechanism to obtain a spatially weighted input vector of a single variable type at a corresponding time step may include: encoding the historical network attack traffic time series corresponding to a single variable type in the data stream to be processed using a multilayer perceptron to obtain the spatial correlation degree of the single variable type at the corresponding time step; converting the spatial correlation degree into a probabilistic form through a normalized exponential function to obtain the spatial attention weight characterizing the prediction of the observation point at the time step, and combining the spatial attention weight and the corresponding variable type to obtain the spatially weighted input vector of the single variable type at the corresponding time step. Specifically, the time series of parameters of several variable types corresponding to a single observation point in the data stream to be processed can be obtained by using a multilayer perceptron in this embodiment. variables in To perform spatial dependency modeling, i.e.:

[0050] ;

[0051] in, , , , , , These are the parameters that the network needs to learn, and tanh is the hyperbolic tangent function. Spatial relevance (unstandardized attention) The probability form is transformed using the Softmax function (an activation function used to normalize a numerical vector into a probability distribution vector). The transformation process can be described as follows:

[0052] ;

[0053] Where probability It is used to measure the spatial attention weight when making a prediction at observation point m at time step t;

[0054] After obtaining the spatial attention weights, an LSTM (Long Short-Term Memory) model can be used as the encoder activation function f. This model can not only extract long-term dependencies at time steps but also effectively capture short-term information distributions through a sliding window approach. In a specific embodiment, the process of obtaining a first hidden state for several observation points based on the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed can include: determining the initial hidden state corresponding to the data stream to be processed; for the first spatially weighted input vector, processing the spatially weighted input vector and the initial hidden state using the LSTM network to obtain the corresponding processed hidden state; for non-first spatially weighted input vectors, processing the spatially weighted input vector and the processed hidden state corresponding to the previous observation point using the LSTM network to obtain the first hidden state for several observation points. Specifically, an initial hidden state h1 is preset, and the recursive function for capturing the internal hidden state generated at each time step t at the target observation point m during subsequent processing is updated as follows:

[0055] ;

[0056] Where t is a positive integer starting from 2, and f represents a recursive function. and This represents the internal hidden state (p represents the size of the hidden layer). Representation with input vector Spatial attention at time step t (M usually represents the number of elements in the input vector sequence). The spatially weighted input vector at time step t is defined as follows:

[0057] ;

[0058] Furthermore, LSTM integrates three main gates to design its recursive function: input gate i, forget gate f, and output gate o. The recursive formula for LSTM at time step t is as follows:

[0059] ;

[0060] ;

[0061] ;

[0062] ;

[0063] ;

[0064] ;

[0065] in and tanh represent the logistic sigmoid function and the hyperbolic tangent function, respectively, and their previous hidden states. and the current weighted input vector It was integrated into the door. and These are parameters that need to be learned by the network.

[0066] Step S12: In the encoding stage, based on the preset parameter attention mechanism, each parameter of the single variable type corresponding to the spatial weighted input vector is processed to obtain the parameter weighted input vector of each parameter at the corresponding time step, and the parameter weighted input vector and the first hidden state are processed to obtain the second hidden state for several parameters.

[0067] In this embodiment, after encoding based on spatial attention using inter-site information, the spatially weighted input vector can be further refined to extract the interrelationships between different parameters. In a specific embodiment, processing each parameter of a single variable type corresponding to the spatially weighted input vector based on a preset parameter attention mechanism to obtain the parameter-weighted input vector of each parameter at the corresponding time step can include: processing each parameter of a single variable type corresponding to the spatially weighted input vector using a multilayer perceptron to obtain the parameter correlation degree of each parameter at the corresponding time step; converting the parameter correlation degree into a probabilistic form using a normalized exponential function to obtain the parameter attention weights characterizing the prediction of related parameters at the time step; and combining the parameter attention weights and the corresponding parameters to obtain the parameter-weighted input vector of each parameter at the corresponding time step. Specifically, the input vector... ,in , Additionally, the input vector of parameter n within the time window is... To better extract driving parameters, a parameter-guided attention mechanism can be built during the coding phase, and the recursive function is updated as follows:

[0068] ;

[0069] Where f represents a recursive function, which is also defined by a recursive LSTM network. and This indicates an internal hidden state, and Representation with input vector The corresponding parametric attention. Therefore, the parameterized input vector at time step t can be defined as:

[0070] ;

[0071] The attention for parameters is derived from each monitored parameter, and it is constructed by a multilayer perceptron (MLP) as follows:

[0072] ;

[0073] in, , , , , , For the parameters that need to be learned by the network, The parameter correlation (unstandardized attention) is converted into a probabilistic form by the Softmax function, i.e.:

[0074] ;

[0075] probability It is used to measure the relevant weight of the monitored parameter n when making predictions at time step t. It can be understood as a measure of parameter importance.

[0076] After obtaining the attention distribution for the parameters, the LSTM can be updated. In a specific embodiment, processing the parameter-weighted input vector and the first hidden state to obtain a second hidden state for several parameters can include: for the first parameter-weighted input vector, processing the parameter-weighted input vector using a Long Short-Term Memory (LSTM) network to obtain a corresponding processed hidden state; for non-first parameter-weighted input vectors, processing the parameter-weighted input vector and the processed hidden state corresponding to the previous parameter-weighted input vector using an LSTM network to obtain a second hidden state for several parameters. Specifically, the recursive network LSTM is updated as follows:

[0077] ;

[0078] ;

[0079] ;

[0080] ;

[0081] ;

[0082] ;

[0083] Previous internal hidden state and the current weighted input vector It was integrated into the door, among which and These are parameters that need to be learned by the network.

[0084] Step S13: In the decoding stage, the time step is processed based on a preset time attention mechanism to obtain time attention weights that characterize the hidden states corresponding to each parameter, so as to decode the predicted time series of the target parameters based on the time attention weights and the second hidden state.

[0085] In this embodiment, the decoding stage is used to generate multi-step leading time series predictions, and the final prediction result depends on historical time series and previous prediction results. During the decoding stage, the following methods can be used: As a time step exponent, to distinguish it from the time step exponent t in the encoding phase, it is used As an index for the sliding window in the decoding stage (the time step index and time step have the same meaning). In a specific embodiment, the time attention weights representing the hidden states corresponding to each parameter, processed based on a preset time attention mechanism, can include: for the first hidden state in the second hidden state, processing is performed based on the first hidden state, the historical time series of the preset target parameters, and the time step to obtain the time attention weights representing the first hidden state at that time step; for non-first hidden states in the second hidden state, processing is performed based on the hidden state corresponding to the previous hidden state after processing with the time attention weights and the predicted time series of the corresponding parameters, combined with the time step, to obtain the time attention weights representing the hidden states corresponding to each parameter at the relevant time steps. Specifically, the time attention mechanism is first integrated into the decoder, which can autonomously select the driving hidden states generated by the encoder in all time steps. Similar to the attention mechanism structure in the encoding stage, the time step... Temporal attention at a given point is achieved by utilizing the hidden state from the previous decoder. Unit status and the internal hidden state during the encoding phase This was calculated. Therefore, the temporal relevance (unstandardized attention) and temporal attention weights are modeled as follows:

[0086] ;

[0087] ;

[0088] in, , , , , (p represents the size of the hidden layer, q represents the dimension of the input) are the network weights and biases to be trained, and the temporal attention weights. Used to evaluate the t-th internal hidden state of the encoder in predicting the t-th... The importance of each output.

[0089] Understandably, the decoding operation is repeated, and the information integrated by each decoder can include: the internal hidden state of the encoding stage, the output hidden state of the previous decoder, and the data item of the previous observation or prediction output. The recursive function of the decoder at time τ is:

[0090] ;

[0091] in, This represents the internal hidden state after being weighted in the time dimension during the encoding phase. This indicates the output hidden state of the previous decoder. This represents previous historical observations. This represents the previous predicted output value, and f represents the recursive function. The derivation of the variables mentioned in the recursive function will be introduced next.

[0092] Furthermore, the decoder can combine the temporal attention layer with LSTM to generate a prediction output. The step of decoding the target parameter's prediction time series based on the temporal attention weights and the second hidden state can include: determining the target parameter to be decoded and its corresponding target time step; performing a weighted calculation on the second hidden state based on the target time step and the temporal attention weights to obtain an expected value representing the second hidden state at the target time step; and performing a linear transformation on the prediction time series corresponding to the previous time step of the target time step and the expected value to obtain the current prediction time series for the target parameter. Specifically, the decoder can predict the target parameter based on the historical time series of the input target parameter, combined with the hidden states during the encoder processing, to obtain the current prediction time series. In a specific embodiment, the decoder can process the internal hidden states from the encoding stage. Weighting is applied over time for a given time step. The weighted sum is calculated as follows:

[0093] ;

[0094] Weighted sum Represents all internal hidden states Time step during the coding phase The expected value corresponding to the location. It is understandable that the decoding operation is repeated, and the information integrated by each decoder can include: the internal hidden state of the encoding stage, the output hidden state of the previous decoder, and the data item of the previous observation or predicted output. Furthermore, by combining the feature data obtained from the encoder and decoder, the previous predicted output can be obtained through a linear transformation. , :

[0095] ;

[0096] in, , , , , These are network parameters that can be used for learning, and through linear transformation, they ultimately produce the predicted output. .

[0097] Thus, the recursive function f in the LSTM of the decoder is:

[0098] ;

[0099] ;

[0100] ;

[0101] ;

[0102] ;

[0103] ;

[0104] ;

[0105] Among them, the current time-weighted sum And previous input It is integrated into the LSTM gate. and These are network parameters that can be used for learning.

[0106] In one specific embodiment, such as Figure 4As shown, the overall architecture of the hierarchical attention RNN encoder-decoder model extracts driving variables from multivariate time series at spatial, parametric, and temporal scales, replacing the method of averaging all data in the input time series. Specifically, the neural network can be used to learn basic time series features and then to predict multi-step leading time series of target parameters. The encoder is built from a multi-layer structure consisting of attention layers and an LSTM stack. Layer-to-layer encoders learn features in the hidden states by integrating weighted input vectors to obtain representative hidden states. Then, the decoder combines the temporal attention layers with the LSTM stack to generate the predicted output.

[0107] Therefore, this application, in the process of predicting network attack traffic, introduces an encoder-decoder structure into the recurrent neural network model to achieve sequence-to-sequence learning, improving the model's flexibility and scalability. During the encoding stage, spatial attention can be used to mine the correlations between different observation points, extracting potential driving sites from all observation sites. By inputting time series data into the model, the observation points that are more important for prediction can be identified. Parametric attention is used to mine the parameter dependencies between multi-source variables, extracting driving parameters and further refining the spatially weighted input vector to extract the relationships between different parameters. Then, in the decoding stage, temporal attention can be used to mine the temporal correlations between data from different observation points, and the driving hidden states generated by the decoder can be autonomously selected across all time steps. Thus, by introducing an encoder-decoder structure into the recurrent neural network, the model achieves sequence-to-sequence learning. By utilizing the correlations and differences between different sites, the model integrates spatial, temporal, and parametric attention, thereby improving the accuracy of model prediction. In attack traffic prediction, it can more accurately predict attack traffic over a future period, enabling more effective preventative measures.

[0108] like Figure 5 As shown in the figure, this application discloses a method for predicting network attack traffic, including:

[0109] The spatial attention processing module 11 is used to encode the data stream to be processed based on a preset spatial attention mechanism during the encoding stage to obtain a spatially weighted input vector of a single variable type at a corresponding time step, and to process the data stream to be processed based on the spatially weighted input vector and the initial hidden state corresponding to the data stream to be processed to obtain a first hidden state for several observation points; the data stream to be processed includes observation points, time steps, and multi-source variable measurement values ​​composed of parameters corresponding to different variable types for a single observation point; the data stream to be processed is a time series of historical network attack traffic;

[0110] The parameter attention processing module 12 is used to process each parameter of a single variable type corresponding to the spatial weighted input vector based on a preset parameter attention mechanism during the encoding stage, to obtain the parameter weighted input vector of each parameter at the corresponding time step, and to process the parameter weighted input vector and the first hidden state to obtain the second hidden state for several parameters.

[0111] The time attention processing module 13 is used to process the time step based on a preset time attention mechanism during the decoding stage to obtain time attention weights that characterize the hidden state corresponding to each parameter, so as to decode the predicted time series of the target parameter based on the time attention weights and the second hidden state.

[0112] Therefore, in the process of predicting network attack traffic, this application can mine the correlation between different observation points through spatial attention and the parameter dependence between multiple source variables through parameter attention during the encoding stage; then, in the decoding stage, it can mine the temporal correlation between data from different observation points through temporal attention; thus, it can fully extract the effective information of historical network attack traffic and improve the accuracy of the final attack traffic prediction.

[0113] In one specific embodiment, the spatial attention processing module 11 may include:

[0114] The spatial correlation processing unit is used to encode the historical network attack traffic time series corresponding to a single variable type in the data stream to be processed using a multilayer perceptron, and obtain the spatial correlation of the single variable type at the corresponding time step.

[0115] The spatially weighted input vector processing unit is used to convert the spatial correlation degree into a probabilistic form through a normalized exponential function to obtain the spatial attention weights that characterize the observation point when making predictions at the time step, so as to combine the spatial attention weights and the corresponding variable types to obtain the spatially weighted input vector of a single variable type at the corresponding time step.

[0116] In one specific embodiment, the spatial attention processing module 11 may include:

[0117] An initial hidden state determination unit is used to determine the initial hidden state corresponding to the data stream to be processed;

[0118] The first spatial attention processing unit is used to process the first spatially weighted input vector and the initial hidden state using a long short-term memory network to obtain the corresponding processed hidden state.

[0119] The second spatial attention processing unit is used to process the spatially weighted input vector and the processed hidden state corresponding to the previous observation point using a long short-term memory network for non-first spatially weighted input vectors, so as to obtain the first hidden state for several observation points.

[0120] In one specific embodiment, the parameter attention processing module 12 may include:

[0121] The parameter correlation processing unit is used to process each parameter of the single variable type corresponding to the spatial weighted input vector using a multilayer perceptron to obtain the parameter correlation of each parameter at the corresponding time step.

[0122] The parameter weighted input vector processing unit is used to convert the parameter correlation degree into a probabilistic form through a normalized exponential function to obtain the parameter attention weights that characterize the relevant parameters when making predictions at the time step, so as to combine the parameter attention weights and the corresponding parameters to obtain the parameter weighted input vectors of each parameter at the corresponding time step.

[0123] In one specific embodiment, the parameter attention processing module 12 may include:

[0124] The first parameter attention processing unit is used to process the first parameter-weighted input vector using a long short-term memory network to obtain the corresponding processed hidden state.

[0125] The second parameter attention processing unit is used to process the processed hidden states corresponding to the parameter-weighted input vector and the previous parameter-weighted input vector using a long short-term memory network for non-first parameter-weighted input vectors, so as to obtain a second hidden state for several parameters.

[0126] In one specific embodiment, the time attention processing module 13 may include:

[0127] The first time attention processing unit is used to process the first hidden state in the second hidden state based on the first hidden state, the historical time series of preset target parameters, and the time step to obtain the time attention weight representing the first hidden state at the time step.

[0128] The second temporal attention processing unit is used to process, for non-first hidden states in the second hidden state, the predicted time series of the hidden state and corresponding parameters after processing by the temporal attention weights corresponding to the previous hidden state, and in combination with the time step, to obtain the temporal attention weights that characterize the hidden state corresponding to each parameter at the relevant time step.

[0129] In another specific embodiment, the time attention processing module 13 may include:

[0130] The target time step determination unit is used to determine the target parameters to be decoded and the corresponding target time step.

[0131] A weighted calculation unit is used to perform a weighted calculation on the second hidden state based on the target time step and the time attention weight to obtain the expected value representing the second hidden state at the target time step.

[0132] A linear transformation unit is used to perform a linear transformation on the predicted time series corresponding to the previous time step of the target time step and the expected value to obtain the current predicted time series for the target parameter.

[0133] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0134] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network attack traffic prediction method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0135] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0136] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0137] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the network attack traffic prediction method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0138] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned network attack traffic prediction method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0139] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0140] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0141] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0142] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0143] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A network attack traffic prediction method, characterized by, The method comprises the following steps: In the encoding stage, a preset spatial attention mechanism is used to encode a to-be-processed data stream to obtain a spatial weighted input vector of a single variable type at a corresponding time step, and a first hidden state of a plurality of observation points is obtained by processing the spatial weighted input vector and an initial hidden state corresponding to the to-be-processed data stream; the to-be-processed data stream comprises observation points, time steps and multi-source variable measurement values corresponding to a single observation point and composed of parameters corresponding to different variable types; the to-be-processed data stream is a historical network attack traffic time series; In the encoding stage, a preset parameter attention mechanism is used to process each parameter of the single variable type corresponding to the spatial weighted input vector to obtain a parameter weighted input vector of each parameter at a corresponding time step, and a second hidden state of a plurality of parameters is obtained by processing the parameter weighted input vector and the first hidden state; In the decoding stage, a preset time attention mechanism is used to process the time steps to obtain time attention weights representing the hidden states of each parameter, and a predicted time series of a target parameter is obtained by decoding based on the time attention weights and the second hidden state. 2.The network attack traffic prediction method of claim 1, wherein, The method comprises the following steps: A multilayer perceptron is used to encode a historical network attack traffic time series corresponding to a single variable type in the to-be-processed data stream to obtain a spatial correlation degree of the single variable type at a corresponding time step; A normalized exponential function is used to convert the spatial correlation degree into a probability form to obtain spatial attention weights representing the observation points when predicting at a time step, and a spatial weighted input vector of the single variable type at the corresponding time step is obtained by combining the spatial attention weights and the corresponding variable type. 3.The network attack traffic prediction method of claim 1, wherein, The method comprises the following steps: An initial hidden state corresponding to the to-be-processed data stream is determined; For the first spatial weighted input vector, a long short-term memory network is used to process the spatial weighted input vector and the initial hidden state to obtain a corresponding processed hidden state; For a spatial weighted input vector other than the first one, a long short-term memory network is used to process the spatial weighted input vector and a processed hidden state corresponding to a previous observation point to obtain the first hidden state of the plurality of observation points. 4.The network attack traffic prediction method of claim 1, wherein, The method comprises the following steps: A multilayer perceptron is used to process each parameter of the single variable type corresponding to the spatial weighted input vector to obtain a parameter correlation degree of each parameter at a corresponding time step. The parameter relevance degree is converted into a probability form by a normalized exponential function to obtain parameter attention weights of the relevant parameters at the time step for prediction, so as to combine the parameter attention weights and the corresponding parameters to obtain parameter weighted input vectors of each parameter at the corresponding time step. 5.The network attack traffic prediction method of claim 1, wherein, The parameter weighted input vectors and the first hidden state are processed to obtain second hidden states of the parameters, including: For the first parameter weighted input vector, the parameter weighted input vector is processed by using a long short-term memory network to obtain a corresponding processed hidden state; For the non-first parameter weighted input vector, the parameter weighted input vector and the processed hidden state corresponding to the previous parameter weighted input vector are processed by using a long short-term memory network to obtain the second hidden states of the parameters.

6. The network attack traffic prediction method of claim 1, wherein, The time attention weights of the hidden states of each parameter are obtained by processing the time steps based on the preset time attention mechanism, including: For the first hidden state in the second hidden state, the first hidden state, a preset target parameter historical time sequence, and the time step are processed to obtain the time attention weight of the first hidden state at the time step; For the non-first hidden state in the second hidden state, the hidden state processed by the time attention weight corresponding to the previous hidden state and the predicted time sequence of the corresponding parameter are processed in combination with the time step to obtain the time attention weight of the hidden state of each parameter at the relevant time step.

7. The network attack traffic prediction method of claim 1, wherein, The predicted time sequence of the target parameter is obtained by decoding based on the time attention weight and the second hidden state, including: determining the target parameter to be decoded and the corresponding target time step; weighting the second hidden state based on the target time step and the time attention weight to obtain an expected value representing the second hidden state at the target time step; performing linear transformation on the predicted time sequence corresponding to the previous time step of the target time step and the expected value to obtain the current predicted time sequence of the target parameter. 8.A network attack traffic prediction method, characterized by, including: The spatial attention processing module is configured to, in an encoding stage, encode a to-be-processed data stream based on a preset spatial attention mechanism to obtain spatial weighted input vectors of a single variable type at corresponding time steps, and process the spatial weighted input vectors and initial hidden states corresponding to the to-be-processed data stream to obtain first hidden states of a plurality of observation points; the to-be-processed data stream includes observation points, time steps, and multi-source variable measurement values of a single observation point composed of parameters corresponding to different variable types; and the to-be-processed data stream is a historical network attack traffic time sequence. a parameter attention processing module, configured to, in an encoding stage, process each parameter of a single variable type corresponding to the spatially weighted input vector based on a preset parameter attention mechanism to obtain a parameter weighted input vector of each parameter at a corresponding time step, and process the parameter weighted input vector and the first hidden state to obtain a second hidden state for a plurality of parameters; a time attention processing module, configured to, in a decoding stage, process the time steps based on a preset time attention mechanism to obtain time attention weights representing hidden states of each parameter, and decode to obtain a predicted time sequence of a target parameter based on the time attention weights and the second hidden state.

9. An electronic device, comprising: comprising: a memory for saving a computer program; a processor for executing the computer program to implement the network attack traffic prediction method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, a computer program for saving, which, when executed by a processor, implements the network attack traffic prediction method according to any one of claims 1 to 7.

Images