Intrusion detection method, device, electronic device and storage medium

Abstract

The present application discloses an intrusion detection method, device, electronic device and storage medium, which relates to the field of network security technology, including: obtaining a vulnerability attack simulation model and an intrusion detection model of a network to be detected; calling the vulnerability attack simulation model, predicting potential attack behaviors of the network to be detected according to a set of attack behaviors preset on the vulnerability attack simulation model, and obtaining potential attack information; updating the intrusion detection model according to the potential attack information to obtain a potential detection model; and detecting network data information corresponding to the network to be detected through the potential detection model to obtain an intrusion detection result. The present application improves the accuracy of intrusion detection of the network.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intrusion detection method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of the Internet and the continuous advancement of information technology, network security issues have become increasingly prominent. Frequent cyber attacks and data leaks have caused huge losses to companies and individuals. Therefore, the need to protect networks from unauthorized access and malicious attacks has become increasingly urgent.

[0003] Network attacks are based on the effective use of vulnerabilities, and the network security team is at a disadvantage because the security team must protect all possible entry points, while the attacker only needs to find and exploit a vulnerability to use it to attack the network. This means that when carrying out network security protection, it is not only necessary to block network attacks but also to repair vulnerabilities. However, various network security protections on the market still have various problems. For example, most of the current intrusion detection systems can only identify known attack behaviors, but it is difficult to detect new attack behaviors of attackers, so there is currently a technical problem of low accuracy of network intrusion detection.

[0004] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present application is to provide an intrusion detection method, device, electronic device and storage medium, aiming to solve the technical problem of low accuracy of network intrusion detection.

[0006] To achieve the above objectives, the present application provides an intrusion detection method, which includes:

[0007] Obtain vulnerability attack simulation model and intrusion detection model of the network to be detected;

[0008] Calling the vulnerability attack simulation model, predicting potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtaining potential attack information;

[0009] According to the potential attack information, the intrusion detection model is updated to obtain a potential detection model;

[0010] The network data information corresponding to the network to be detected is detected through the potential detection model to obtain an intrusion detection result.

[0011] In one embodiment, the step of calling the vulnerability attack simulation model, predicting potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtaining potential attack information includes:

[0012] Obtaining the network environment type of the network to be detected;

[0013] Finding a vulnerability attack set matching the network environment type in the attack behavior set;

[0014] Through the vulnerability attack simulation model, the vulnerability attack set is cross-mutated to predict potential attack behaviors of attacking the network to be detected, and potential attack information of the network to be detected is obtained.

[0015] In one embodiment, the vulnerability attack set includes vulnerability attack behaviors; the potential attack information includes potential alternating behaviors;

[0016] The step of performing cross-mutation on the vulnerability attack set through the vulnerability attack simulation model to predict potential attack behaviors against the network to be detected and obtaining potential attack information of the network to be detected comprises:

[0017] Obtaining the number of alternating iterations, the behavior crossover rate, and the behavior mutation rate of the vulnerability attack set, and obtaining network vulnerability environment information of the network to be detected;

[0018] According to the behavior crossover rate and the behavior mutation rate, cross-mutate each of the vulnerability attack behaviors to obtain a plurality of intermediate alternating behaviors, and accumulate the number of alternating iterations;

[0019] Calling the vulnerability attack simulation model, based on the network vulnerability environment information, screening out at least one potential alternating behavior that meets a preset successful attack condition from each of the intermediate alternating behaviors;

[0020] Determine whether the alternating iteration number is greater than a preset iteration number;

[0021] If so, each of the potential alternating behaviors is taken together as the potential attack information.

[0022] In one embodiment, the step of performing crossover mutation on each of the vulnerability attack behaviors according to the behavior crossover rate and the behavior mutation rate to obtain a plurality of intermediate alternating behaviors includes:

[0023] Obtaining vulnerability attack chromosomes corresponding to each of the vulnerability attack behaviors;

[0024] According to the behavior crossover rate and the behavior mutation rate, crossover and mutation are performed on each of the vulnerability attack chromosomes to obtain a plurality of intermediate alternating chromosomes;

[0025] Each of the intermediate alternation chromosomes is decoded respectively to obtain the intermediate alternation behaviors corresponding to each of the intermediate alternation chromosomes.

[0026] In one embodiment, after the step of determining whether the number of alternating iterations is greater than a preset number of iterations, the method further includes:

[0027] If the number of alternating iterations is less than or equal to the preset number of iterations, counting the number of potential behaviors of each of the potential alternating behaviors;

[0028] Calculating the attack success probability according to the number of potential behaviors and the total number of intermediate alternating behaviors;

[0029] Obtain the previous attack probability of the previous time step of the attack success probability, if the attack success probability is less than the previous success probability, obtain historical iterative variation data, and adjust the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data to obtain an adaptive crossover rate and an adaptive variation rate;

[0030] The behavior crossover rate is updated to the adaptive crossover rate, the behavior mutation rate is updated to the adaptive mutation rate, the vulnerability attack behavior is updated according to the intermediate alternating behavior, and the execution step is returned to: according to the behavior crossover rate and the behavior mutation rate, each vulnerability attack behavior is cross-mutated to obtain multiple intermediate alternating behaviors, and the alternating iteration number is accumulated.

[0031] In one embodiment, the step of obtaining historical iterative variation data, adjusting the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data, and obtaining the adaptive crossover rate and the adaptive variation rate comprises:

[0032] Sequentially concatenate the previous success probability and the attack success probability to obtain an attack change trend combination;

[0033] Searching for a target historical change trend combination that matches the attack change trend combination in the historical iterative variation data, and obtaining an iterative change trend combination of the target historical change trend combination at the next time step;

[0034] If the change trend of the iterative change trend combination is an increasing trend of success probability, then determining the front crossover rate and the front mutation rate corresponding to the front success rate, and the back crossover rate and the back mutation rate corresponding to the back success rate from the iterative change trend combination;

[0035] According to the crossover change trend from the front crossover rate to the rear crossover rate and the probability difference, the behavior crossover rate is adjusted to obtain the adaptive crossover rate, and according to the mutation change trend from the front mutation rate to the rear mutation rate and the probability difference, the behavior mutation rate is adjusted to obtain the adaptive mutation rate.

[0036] In one embodiment, the step of calling the vulnerability attack simulation model and selecting at least one potential alternating behavior that meets a preset successful attack condition from each of the intermediate alternating behaviors based on the network vulnerability environment information includes:

[0037] Inputting the network vulnerability environment information into the vulnerability attack simulation model, simulating the network vulnerability environment of the to-be-detected network through the network vulnerability environment information, and obtaining a simulated vulnerability environment;

[0038] For any of the intermediate alternating behaviors, in the simulated vulnerability environment, attack the network to be detected through the intermediate alternating behavior to obtain a vulnerability attack result;

[0039] The intermediate alternating behaviors whose vulnerability attack results meet the preset intrusion success conditions are taken as potential alternating behaviors.

[0040] In addition, to achieve the above objectives, the present application provides an intrusion detection device, the intrusion detection device comprising:

[0041] An acquisition module, used to acquire a network to be detected, network vulnerability environment information of the network to be detected, a vulnerability attack simulation model and an intrusion detection model;

[0042] A calling module, used to call the vulnerability attack simulation model, predict potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtain potential attack information;

[0043] An updating module, used for updating the intrusion detection model according to the potential attack information to obtain a potential detection model;

[0044] The intrusion monitoring module is used to detect the network data information corresponding to the network to be detected through the potential detection model to obtain the intrusion detection result.

[0045] In addition, to achieve the above-mentioned purpose, the present application also provides an electronic device, which includes: a memory, a processor, and a program of the intrusion detection method stored in the memory and executable on the processor. When the program of the intrusion detection method is executed by the processor, the steps of the intrusion detection method as described above can be implemented.

[0046] In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which is stored a program for implementing the intrusion detection method, and when the program of the intrusion detection method is executed by a processor, the steps of the intrusion detection method as described above are implemented.

[0047] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the intrusion detection method as described above are implemented.

[0048] One or more technical solutions proposed in this application have at least the following technical effects: This application obtains the vulnerability attack simulation model and the intrusion detection model of the network to be detected, so that the vulnerability attack simulation model can be called, and based on the attack behavior set preset on the vulnerability attack simulation model, the potential intrusion behavior corresponding to the network to be detected is predicted, and potential attack information is obtained. Since the attack behavior set can be a known feature that can successfully invade the network to be detected, this application uses the known features that can successfully invade the network to be detected and the vulnerability attack simulation model to predict the behavior of future attackers to attack the network to be detected, and obtain potential attack information, thereby increasing the probability of predicting new behaviors that can successfully attack the network to be detected, so as to facilitate the subsequent identification of more attack behaviors. Further, this application also updates the intrusion detection model through the potential attack information to obtain a potential detection model, so that the potential detection model can identify more attacks, so this application monitors the network data behavior corresponding to the network to be detected through the potential detection model to obtain the intrusion detection result, and realizes the use of the potential detection model to identify more behaviors that attack the network to be detected, thereby reducing the probability of not detecting new attack behaviors, and further improving the accuracy of network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the description, are used to explain the principles of the present application.

[0050] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0051] Figure 1 This is a flow chart of the first embodiment of the intrusion detection method of the present application;

[0052] Figure 2 This is a flow chart of the second embodiment of the intrusion detection method of the present application;

[0053] Figure 3 This is a flow chart of the third embodiment of the intrusion detection method of the present application;

[0054] Figure 4 This is a schematic diagram of the module structure of the intrusion detection device according to an embodiment of the present application;

[0055] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the intrusion detection method in the embodiment of the present application.

[0056] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0058] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0059] The main solution of the embodiment of the present application is: using the known attack behaviors and vulnerability attack simulation models that have successfully invaded the network to be detected to predict new attack behaviors that may successfully invade the network to be detected in the future, and using the new attack behaviors to update the intrusion detection system to obtain a generalized detection system, so that the generalized detection system can identify more attack behaviors, and it is also convenient to improve the accuracy of the generalized detection system.

[0060] The present application provides a solution. The present application obtains the vulnerability attack simulation model and the intrusion detection model of the network to be detected, so that the vulnerability attack simulation model can be called, and based on the attack behavior set preset on the vulnerability attack simulation model, the potential intrusion behavior corresponding to the network to be detected is predicted to obtain potential attack information. Since the attack behavior set can be a known feature that can successfully invade the network to be detected, the present application uses the known features that can successfully invade the network to be detected and the vulnerability attack simulation model to predict the behavior of future attackers to attack the network to be detected, and obtain potential attack information, thereby increasing the probability of predicting new behaviors that can successfully attack the network to be detected, so as to facilitate the subsequent identification of more attack behaviors. Further, the present application also updates the intrusion detection model through the potential attack information to obtain the potential detection model, so that the potential detection model can identify more attacks, so the present application monitors the network data behavior corresponding to the network to be detected through the potential detection model to obtain the intrusion detection result, and realizes the use of the potential detection model to identify more behaviors that attack the network to be detected, thereby reducing the probability of not detecting new attack behaviors, and further improving the accuracy of intrusion detection.

[0061] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device that can realize the above functions.

[0062] Based on this, the present application embodiment provides an intrusion detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the intrusion detection method of the present application.

[0063] In this embodiment, the intrusion detection method includes steps S10 to S40:

[0064] Step S10, obtaining a vulnerability attack simulation model and an intrusion detection model of the network to be detected;

[0065] It should be noted that the network to be detected can be an internal network of an enterprise, the Internet of Things, or a network corresponding to a home. The vulnerability attack simulation model can simulate the network environment corresponding to the network to be detected, and then it is easy to simulate new attack behaviors that can successfully attack the network to be detected. The intrusion detection model can be used to identify attack behaviors on the network, and the intrusion detection model can be obtained by training a neural network.

[0066] Exemplarily, a vulnerability attack simulation model and an intrusion detection model of a network to be detected are obtained, wherein the step of obtaining an intrusion detection model may also include obtaining an intrusion model to be trained, which may be a neural network model, obtaining intrusion training samples, which are attack behavior samples and intrusion result labels, wherein the attack behavior samples are known attack behaviors, which may be behaviors that can successfully attack the network, or may be attack behaviors that fail to attack the network. The attack behavior samples are input into the intrusion model to be trained, and the intrusion result features are obtained. The label distance between the intrusion result features and the intrusion result labels is calculated to obtain the intrusion model loss. If the intrusion model loss is less than or equal to the preset loss value, the training of the intrusion model to be trained is completed, and the intrusion detection model is obtained. If the intrusion model loss is greater than the preset loss value, the intrusion training samples are re-obtained to train the intrusion model to be trained until the intrusion model loss is less than or equal to the preset loss value. The preset loss value may be determined based on actual conditions.

[0067] Step S20, calling the vulnerability attack simulation model, predicting potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtaining potential attack information;

[0068] It should be noted that the attack behavior set is a known attack behavior that can successfully attack a network. For example, the attack behavior set may include attack behaviors that can successfully attack the Internet of Things. Potential attack behaviors refer to currently unknown attack behaviors that may exist in the future to attack the network to be detected. Potential attack information is characterized by potential attack behaviors that can successfully attack the network to be detected. Among them, compared with the attack behavior set, the potential attack information is a new attack behavior, and the attack behavior set is an old attack behavior. Potential attack information includes potential alternating behaviors. Attack behavior refers to any type of offensive action against a computer information system, infrastructure, computer network or personal computer device.

[0069] Exemplarily, a vulnerability attack simulation model is called, and a set of attack behaviors is used to simulate potential attack behaviors of a network to be detected, so as to obtain potential attack information.

[0070] Step S30, updating the intrusion detection model according to the potential attack information to obtain a potential detection model;

[0071] It should be noted that the intrusion detection model can be used to identify attack behaviors, but the intrusion detection model can only identify known attack behaviors, that is, it can identify attack behaviors in the attack behavior set. The potential detection model can be used to identify behaviors in the attack behavior set and can also be used for the corresponding potential alternating behaviors in the potential attack information. The potential detection model can identify more types of attack behaviors than the intrusion detection model.

[0072] Exemplarily, based on the potential attack information, a potential attack behavior sample is generated, the potential attack behavior sample includes a potential behavior sample and a potential detection result label, and the intrusion detection model is trained using the potential attack behavior sample, so that the trained potential detection model can identify the potential alternating behavior in the potential attack information, thereby facilitating the improvement of the accuracy of the intrusion detection behavior. For example, the potential behavior sample is input into the intrusion detection model to obtain the potential detection result feature, the label distance between the potential detection result feature and the potential detection result label is calculated, and the potential model loss is obtained. If the potential model loss is less than or equal to the preset potential loss threshold, the training of the intrusion model is completed to obtain the intrusion detection model. If the potential model loss is greater than the preset potential loss threshold, the attack potential behavior sample is re-acquired to train the intrusion detection model until the potential model loss is less than or equal to the preset potential loss threshold. The preset potential loss threshold can be determined based on actual conditions.

[0073] Step S40: Detect network data information corresponding to the network to be detected by using the potential detection model to obtain an intrusion detection result.

[0074] It should be noted that the network data information is the network data corresponding to the network to be detected. The network data information may be traffic data, system logs, and the like. There may or may not be abnormal data corresponding to the attack behavior in the network data information. When there is abnormal data corresponding to the attack behavior in the network data information, and the abnormal data corresponding to the attack behavior in the network data information can be identified by the potential detection model, then the intrusion detection result is that there is currently an attack behavior. If the abnormal data corresponding to the attack behavior in the network data information cannot be identified by the potential detection model, or there is no abnormal data corresponding to the attack behavior in the network data information, then the intrusion detection result is that there is currently no attack behavior.

[0075] The intrusion detection result is characterized as the result of the potential detection model detecting network data information. The intrusion detection result can be the detection of the current existence of attack behavior, or the detection of the current non-existence of attack behavior.

[0076] Exemplarily, network data information corresponding to the network to be detected is obtained, and the network data information is input into a potential detection model to obtain an intrusion detection result, thereby detecting whether there is an attack behavior currently on the vulnerability to be detected.

[0077] Further, refer to Figure 2 Based on the above embodiment of the present application, in another embodiment of the present application, the same or similar contents as the above embodiment can be referred to the above introduction, and will not be repeated in the following. Figure 2 , step S20 also includes steps S21 to S23:

[0078] Step S21, obtaining the network environment type of the network to be detected;

[0079] Step S22, searching the attack behavior set for a vulnerability attack set that matches the network environment type;

[0080] It should be noted that the network environment type can be used to describe the complexity of the network environment of the network to be detected. The network environment type can be divided into large enterprise networks, small enterprise networks, cloud environment networks or home networks, etc. The differences between large enterprise networks, small enterprise networks and home networks are generally network scale, topology structure, etc. The complexity of large enterprise networks is greater than that of small enterprise networks and greater than that of home networks. Different network environment types may result in different attacks. For example, large enterprise networks may face complex internal threats and advanced persistent threats, while small enterprise or home networks may be more concerned with common phishing and malware attacks. Cloud environment networks may face unique security challenges such as virtualization attacks and cross-tenant attacks. Therefore, the set of attack behaviors that are often attacked on the network to be detected can be determined by the network environment type. The attack behavior set includes multiple historical attack behaviors, and the vulnerability attack set includes multiple vulnerability attack behaviors. Since each historical attack behavior in the attack behavior set has its own associated network environment type, the vulnerability attack set that matches the network environment type can be determined from the attack behavior set according to the network environment type of the network to be detected.

[0081] The vulnerability attack set is characterized as a set of common attack behaviors against the network to be detected. Due to different types of network environments, the behaviors of possible attacks are different. Therefore, in order to improve the accuracy of predicting potential attack behaviors against the network to be detected, the vulnerability attack set of the network to be detected can be determined first, which will facilitate the subsequent prediction of more potential attack behaviors based on the vulnerability attack set, so as to improve the accuracy of intrusion.

[0082] Step S23, cross-mutating the vulnerability attack set through the vulnerability attack simulation model to predict potential attack behaviors of attacking the network to be detected, and obtaining potential attack information of the network to be detected.

[0083] It should be noted that the vulnerability attack set includes multiple vulnerability attack behaviors, and the vulnerability attack simulation model can be used to simulate the potential attack behaviors of attacking the network to be detected through the vulnerability attack set to obtain potential attack information. Iterative crossover mutation of the vulnerability attack set refers to iterative crossover mutation of each vulnerability attack behavior in the vulnerability attack set.

[0084] Exemplarily, steps S21 to S23 include: obtaining the network environment type of the network to be detected; searching for target historical attack behaviors that match the network environment type in each historical attack behavior in the attack behavior set, and using the target historical attack behaviors as vulnerability attack behaviors, so as to determine a vulnerability attack set consisting of multiple vulnerability attack behaviors; through the vulnerability attack simulation model, iteratively cross-mutating the vulnerability attack set to predict potential attack behaviors that attack the network to be detected, and obtaining potential attack information of the network to be detected.

[0085] In a feasible embodiment, step S23 further includes:

[0086] Step S231, obtaining the number of alternating iterations, the behavior crossover rate and the behavior mutation rate of the vulnerability attack set, and obtaining the network vulnerability environment information of the network to be detected;

[0087] It should be noted that the alternating iteration number is used to describe the number of iterations of the vulnerability attack set for cross-mutation. When the alternating iteration number of the vulnerability attack set is obtained, the alternating iteration number needs to be initialized.

[0088] The vulnerability attack set includes multiple vulnerability attack behaviors, and the vulnerability attack behaviors are characterized as attack behaviors that can successfully attack the network to be detected. The behavior crossover rate is characterized by the probability of each vulnerability attack behavior crossing, and the behavior mutation rate is the probability of each vulnerability attack behavior mutation. The network vulnerability environment information is used to describe part of the network area on the network to be detected. The network vulnerability environment information can be the environment of the network area on the network to be detected that is attacked too frequently, or the environment of the network area where the vulnerability is discovered but has not been repaired yet, or the entire network where the network to be detected is located.

[0089] Step S232, performing crossover mutation on each of the vulnerability attack behaviors according to the behavior crossover rate and the behavior mutation rate, obtaining a plurality of intermediate alternating behaviors, and accumulating the number of alternating iterations;

[0090] It should be noted that the multiple intermediate alternating behaviors are attack behaviors obtained by cross-mutating each vulnerability attack behavior. Each vulnerability attack behavior is randomly cross-mutated. Among the multiple intermediate alternating behaviors, there may be attack behaviors that cannot successfully attack the network to be detected, and there may also be attack behaviors that can successfully attack the network to be detected. Each time each vulnerability attack behavior is cross-mutated in sequence, the number of alternating iterations will be accumulated, for example, the number of alternating iterations can be increased by 1.

[0091] Exemplarily, steps S231 to S232 include: obtaining the number of alternating iterations of the vulnerability attack set, initializing the number of alternating iterations, obtaining the behavior crossover rate and the behavior mutation rate, and obtaining the network vulnerability environment information of the network to be detected; cross-mutating each vulnerability attack behavior according to the behavior crossover rate and the behavior mutation rate to obtain an intermediate alternating behavior, and self-increasing the number of alternating iterations.

[0092] In a feasible embodiment, step S232 further includes steps S2321 to S2323:

[0093] Step S2321, obtaining vulnerability attack chromosomes corresponding to each vulnerability attack behavior;

[0094] Step S2322, performing crossover mutation on each of the vulnerability attack chromosomes according to the behavior crossover rate and the behavior mutation rate to obtain a plurality of intermediate alternating chromosomes;

[0095] Step S2323, decoding each of the intermediate alternation chromosomes respectively to obtain the intermediate alternation behaviors corresponding to each of the intermediate alternation chromosomes respectively.

[0096] It should be noted that each vulnerability attack behavior has its own corresponding vulnerability attack chromosome. For each vulnerability attack behavior, the vulnerability attack behavior can be encoded to obtain the vulnerability attack chromosome. The encoding method of the vulnerability attack behavior can be customized, such as binary encoding processing or hexadecimal encoding processing. Since there can be multiple attack features in the vulnerability attack behavior, each attack feature is spliced ​​to obtain the vulnerability attack behavior. When encoding the vulnerability attack behavior, the attack features in the vulnerability attack behavior can be encoded separately to obtain the sub-coding features corresponding to each attack feature, and the sub-coding features are spliced ​​to obtain the vulnerability attack chromosome. And when the vulnerability attack chromosome is subsequently mutated, the order of each sub-coding feature in the vulnerability attack chromosome can be adjusted, or the sub-coding features can be mutated. When the vulnerability attack chromosomes are crossed, the sub-coding features in each vulnerability attack chromosome can be exchanged.

[0097] The intermediate alternating chromosomes are obtained by crossover mutation of each vulnerability attack chromosome. The intermediate alternating behaviors corresponding to each intermediate alternating chromosome are obtained by decoding the intermediate alternating chromosomes. When decoding the intermediate alternating chromosomes, the intermediate alternating chromosomes can be decoded according to the decoding method corresponding to the method of encoding the vulnerability attack behavior. The method of crossover mutation of each vulnerability attack chromosome in this embodiment to obtain the intermediate alternating chromosome can be considered to be the use of the method of crossover mutation of chromosomes in the genetic algorithm to achieve cross-compilation of each vulnerability attack chromosome, so that new chromosomes can be obtained, which is convenient for new attack behaviors, that is, intermediate alternating behaviors.

[0098] Exemplarily, steps S2321 to S2323 include: obtaining the vulnerability attack chromosome corresponding to each of the vulnerability attack behaviors; encoding each vulnerability attack behavior in a predefined encoding manner to obtain the vulnerability attack chromosome corresponding to each of the vulnerability attack behaviors; performing crossover mutation on each of the vulnerability attack chromosomes according to the behavior crossover rate and the behavior mutation rate to obtain a plurality of intermediate alternating chromosomes; respectively decoding each of the intermediate alternating chromosomes to obtain the intermediate alternating behaviors corresponding to each of the intermediate alternating chromosomes. This embodiment uses a genetic algorithm to assist in generating intermediate alternating chromosomes, and then determines the intermediate alternating behaviors, thereby facilitating the subsequent determination of new attack behaviors that can successfully attack the network to be detected. By performing crossover mutation on each of the vulnerability attack chromosomes, multiple intermediate alternating chromosomes can be randomly obtained, thereby improving the success rate of predicting potential attack behaviors that attack the network to be detected.

[0099] Step S233, calling the vulnerability attack simulation model, and based on the network vulnerability environment information, screening out at least one potential alternating behavior that meets a preset successful attack condition from each of the intermediate alternating behaviors;

[0100] It should be noted that the vulnerability attack simulation model can simulate the network environment corresponding to the network to be detected, and then it is convenient to use various intermediate alternating behaviors to simulate the attack on the network to be detected in the network environment, so as to determine the attack behavior that can successfully attack the network to be detected. The preset successful attack condition includes that the intermediate alternating behavior can successfully invade the network to be detected. The potential alternating behavior is characterized by the intermediate alternating behavior that can successfully invade the network to be detected.

[0101] Step S234, determining whether the alternating iteration number is greater than a preset iteration number;

[0102] Step S235: If yes, then all the potential alternating behaviors are taken together as the potential attack information.

[0103] It should be noted that the preset number of iterations is the number of iterations of the predefined vulnerability attack machine and the maximum cross-mutation. The potential attack information includes multiple potential alternating behaviors.

[0104] Exemplarily, steps S233 to S235 include: inputting each intermediate alternating behavior and network vulnerability environment information into a vulnerability attack simulation model, so that the vulnerability attack simulation model simulates the simulated vulnerability environment corresponding to the network to be detected through the network vulnerability environment information; in the simulated vulnerability environment, each intermediate alternating behavior is used to attack the network to be detected respectively, and the intermediate alternating behavior that can successfully attack the network to be detected is used as a potential alternating behavior.

[0105] This embodiment cross-mutates each vulnerability attack behavior, thereby generating a large number of intermediate alternating behaviors, thereby improving the success rate of determining attack behaviors that can successfully attack the network to be detected, and then screening out potential attack behaviors that can successfully attack the network to be detected through the vulnerability attack simulation model, thereby facilitating the subsequent detection of new attack behaviors of the network to be detected and improving the accuracy of detecting intrusions in the network to be detected.

[0106] In a feasible embodiment, after step S234, steps A10 to A40 are also included:

[0107] Step A10, if the number of alternating iterations is less than or equal to the preset number of iterations, counting the number of potential behaviors of each of the potential alternating behaviors;

[0108] Step A20, calculating the attack success probability according to the number of potential behaviors and the total number of behaviors of each of the intermediate alternating behaviors;

[0109] It should be noted that the number of potential behaviors is the number of potential alternating behaviors corresponding to the number of iterations corresponding to the number of alternating iterations, and the total number of behaviors is the total number of intermediate alternating behaviors corresponding to the number of iterations corresponding to the number of alternating iterations; the value of the number of alternating iterations is generally initialized to 0. The number of iterations is characterized by the number of crossover mutations. For example, when the number of alternating iterations is 2, the corresponding number of iterations is 2, then the number of potential behaviors is the number of potential alternating behaviors generated during the second iteration of crossover mutation, and the total number of behaviors is the number of intermediate alternating behaviors generated during the second iteration of crossover mutation. The probability of attack success is the ratio of the number of potential behaviors to the total number of behaviors. The higher the probability of attack success, the greater the proportion of potential alternating behaviors in the generated intermediate alternating behaviors.

[0110] Step A30, obtaining the previous attack probability of the previous time step of the attack success probability, if the attack success probability is less than the previous success probability, obtaining historical iterative variation data, and adjusting the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data to obtain an adaptive crossover rate and an adaptive variation rate;

[0111] It should be noted that the previous attack probability is the attack success probability corresponding to the iteration number of the previous time step of the iteration number of the attack success probability. When the iteration number of the attack success probability is 0, the previous attack probability is the preset attack probability, which can be set based on the actual situation. The historical iterative mutation data is the data of the historical iterative process of cross-mutation of the vulnerability attack set. The historical iterative mutation data may include iterative process data corresponding to multiple vulnerability attack sets. The iterative process data of each vulnerability attack set may include the crossover rate, mutation rate and attack success rate corresponding to each iteration number in the iterative process.

[0112] The adaptive crossover rate is the adjusted behavior crossover rate, and the adaptive mutation rate is the adjusted behavior mutation rate. If the probability of attack success is less than the previous success probability, it means that the proportion of generated potential attack behaviors has decreased. Then it is necessary to adjust the behavior crossover rate and behavior mutation rate so as to increase the attack success probability corresponding to the next iteration number to a certain extent. The historical iteration mutation data can be the test data of crossover and mutation of vulnerability attack behaviors in advance according to different behavior mutation rates and behavior crossover rates. The probability difference is the difference between the probability of attack success and the previous success probability.

[0113] Step A40, updates the behavior crossover rate to the adaptive crossover rate, updates the behavior mutation rate to the adaptive mutation rate, updates the vulnerability attack behavior according to the intermediate alternating behavior, and returns to the execution step: cross-mutates each of the vulnerability attack behaviors according to the behavior crossover rate and the behavior mutation rate, obtains multiple intermediate alternating behaviors, and accumulates the number of alternating iterations.

[0114] It should be noted that each intermediate alternating behavior is used as each vulnerability attack behavior to obtain a new vulnerability attack behavior, so that the new vulnerability attack behavior can be cross-mutated to generate a new intermediate alternating behavior. Since the probability of attack success is less than the probability of the previous attack, it is necessary to update the behavior crossover rate and behavior mutation rate to use the adaptive crossover rate and adaptive mutation rate to mutate and cross multiple new vulnerability attack behaviors.

[0115] Exemplarily, steps A10 to A40 include: if the number of alternating iterations is less than or equal to the preset number of iterations, then counting the number of potential behaviors of each potential alternating behavior; taking the ratio of the number of potential behaviors to the total number of behaviors of the intermediate alternating behaviors in the intermediate alternating set as the probability of attack success; obtaining the previous attack probability in the previous time step of the attack success probability, and if the attack success probability is greater than or equal to the previous success probability, then updating the vulnerability attack behavior according to the intermediate alternating behavior, and returning to the execution step: cross-mutating each of the vulnerability attack behaviors according to the behavior crossover rate and the behavior mutation rate to obtain multiple intermediate alternating behaviors, and accumulating the number of alternating iterations.

[0116] Since the number of alternating iterations is less than the preset number of iterations, it is necessary to perform cross-mutation again to generate more potential alternating behaviors. Since the intermediate alternating behaviors are generated, the vulnerability attack behaviors can be updated to the intermediate alternating behaviors, and then the updated vulnerability attack behaviors are cross-compiled. Since the probability of successful attack is greater than or equal to the previous success probability, it means that the proportion of potential alternating behaviors has increased. Therefore, it is not necessary to adjust the behavior cross-rate and behavior mutation rate. The original behavior cross-rate and the original behavior mutation rate are continued to be used to cross-compile the updated vulnerability attack behaviors, and new intermediate alternating behaviors are obtained. Because the purpose of generating multiple intermediate alternating behaviors in this embodiment is to screen out multiple potential alternating behaviors, and the number of intermediate alternating behaviors is generally greater than the number of potential alternating behaviors, and the intermediate alternating behaviors that cannot successfully attack the network to be detected may also generate potential alternating behaviors that can successfully attack the network to be detected after cross-mutation, so the vulnerability attack behaviors can be directly updated according to each intermediate alternating behavior to iteratively generate more intermediate alternating behaviors and screen out more potential alternating behaviors.

[0117] If the probability of successful attack is less than the probability of successful last time, historical iterative mutation data is obtained, and the behavior crossover rate and the behavior mutation rate are adjusted according to the historical iterative mutation data and the difference between the probability of successful attack and the probability of successful last time, to obtain an adaptive crossover rate and an adaptive mutation rate; the behavior crossover rate is updated to the adaptive crossover rate, and the behavior mutation rate is updated to the adaptive mutation rate, and the vulnerability attack behavior is updated according to the intermediate alternating behavior, and the execution step is returned to: according to the behavior crossover rate and the behavior mutation rate, each of the vulnerability attack behaviors is cross-mutated to obtain multiple intermediate alternating behaviors, and the number of alternating iterations is accumulated.

[0118] This embodiment performs iterative cross-mutation on vulnerability attack behaviors, thereby generating multiple potential alternating behaviors, so that the potential detection model can identify attack behaviors that may attack the network to be detected in the future, thereby improving the accuracy of intrusion detection. And because potential alternating behaviors can be simulated, it can also assist Weiyun personnel in repairing corresponding vulnerabilities based on potential alternating behaviors, thereby improving the network's ability to resist external intrusions.

[0119] In a feasible embodiment, step A30 further includes steps A31 to A35:

[0120] Step A31, sequentially joining the previous success probability and the attack success probability to obtain an attack change trend combination;

[0121] Step A32, searching the historical iterative variation data for a target historical variation trend combination that matches the attack variation trend combination, and obtaining an iterative variation trend combination of the target historical variation trend combination at the next time step;

[0122] It should be noted that the attack change trend combination is used to describe the combination of short-term change trends of the ratio of the potential alternating number of potential alternating behaviors to the total number of behaviors. The short-term refers to the period from the number of iterations corresponding to the previous success probability to the number of iterations corresponding to the attack success probability. The change trend of the attack change trend combination can be described by the value between the previous success rate probability and the attack success probability. If the probability difference is greater than 0, it means that the change trend of the attack change trend combination is an increasing trend of the success probability. If the probability difference is less than 0, it means that the success probability is decreasing. If the probability difference is equal to 0, it means that the change trend of the attack change trend combination is unchanged.

[0123] The historical iteration mutation data may include the iteration process data corresponding to multiple vulnerability attack sets, and the iteration process data of each vulnerability attack set may include the crossover rate, mutation rate and attack success rate corresponding to each iteration number in the iteration process, and may also include the iteration data corresponding to each of the two adjacent iteration numbers in the iteration process can be combined into a historical change trend combination, and the iteration data includes the behavior crossover rate, behavior mutation rate and attack success rate corresponding to the iteration number, etc. The target historical change trend combination is a historical change trend combination that matches the attack change trend combination, and there is overlapping data between the iteration change trend combination and the target historical change trend combination. For example, the target change historical trend combination is a combination of the iteration data corresponding to iteration number A and the iteration data corresponding to iteration number B. If the target change historical trend combination is AB, then the iteration change trend is BC, that is, the iteration change trend is a combination of the iteration data corresponding to iteration number B and the iteration data corresponding to iteration number C, and iteration number C is adjacent to iteration number B.

[0124] A plurality of target historical change trend combinations can be determined in the historical iterative variation data, and each target historical change trend combination has a corresponding iterative change trend combination.

[0125] Exemplary steps A31 to A32 include: sequentially concatenating the previous success probability and the attack success probability to obtain an attack change trend combination; searching for at least one target historical change trend combination that matches the attack change trend combination in the historical iterative variation data, and for any target historical change trend combination, obtaining the iterative change trend combination of the target historical change trend combination at the next time step. Exemplarily, the trend difference range of the attack change trend combination can be determined based on the difference between the previous success probability and the attack success probability, and searching for a target historical change trend combination whose historical trend difference with the historical defense trend combination is within the trend search range in the historical iterative variation data.

[0126] The trend difference range can be determined based on the difference between the previous success probability and the attack success probability, and a preset floating range, which can be determined based on actual conditions. For example, if the difference between the previous success probability and the attack success probability is X, and the preset floating range is n, then the trend difference range is X±n.

[0127] Step A33, if the change trend of the iterative change trend combination is an upward trend of success probability, then determining the front crossover rate and the front mutation rate corresponding to the front success rate, and the rear crossover rate and the rear mutation rate corresponding to the rear success rate from the iterative change trend combination;

[0128] It should be noted that the iterative change trend combination includes the previous success rate and the subsequent success rate. The previous success rate is the attack success rate corresponding to the previous iteration number in the iterative change trend combination, and the subsequent success rate is the attack success rate corresponding to the subsequent iteration number in the iterative change trend combination. The previous crossover rate is the behavior crossover rate corresponding to the previous success rate, the previous mutation rate is the behavior mutation rate corresponding to the previous success rate, the subsequent crossover rate is the behavior crossover rate corresponding to the subsequent success rate, and the subsequent mutation rate is the behavior mutation rate corresponding to the subsequent success rate.

[0129] When the difference between the previous success rate and the subsequent success rate in the iterative change trend combination is greater than 0, it means that the change trend of the iterative change trend combination is an increasing trend of success probability; when the difference between the previous success rate and the subsequent success rate in the iterative change trend combination is less than 0, it means that the change trend of the iterative change trend combination is a decreasing trend of success probability; when the difference between the previous success rate and the subsequent success rate in the iterative change trend combination is equal to 0, it means that the change trend of the iterative change trend combination is unchanged.

[0130] In another example, if there are multiple iterative change trend combinations whose change trends are an upward trend in success probability, then the front crossover rate and front mutation rate, as well as the back crossover rate and back mutation rate corresponding to any change trend that is an upward trend in success probability can be determined. If the change trend of the iterative change trend combination is a downward trend in success probability or remains unchanged, a constant adjustment scheme is determined, and the constant adjustment scheme is to keep the behavior mutation rate and the behavior crossover rate unchanged, at which time the behavior mutation rate is used as the adaptive mutation rate, and the behavior crossover rate is used as the adaptive crossover rate.

[0131] Step A34, according to the crossover change trend from the front crossover rate to the rear crossover rate and the probability difference, adjust the behavior crossover rate to obtain the adaptive crossover rate, and according to the mutation change trend from the front mutation rate to the rear mutation rate and the probability difference, adjust the behavior mutation rate to obtain the adaptive mutation rate.

[0132] It should be noted that the crossover change trend is used to describe the change of the crossover rate, and the mutation adjustment trend is used to describe the change of the mutation rate. The crossover change trend can be rising, falling or unchanged, and the mutation change trend can be rising, falling or unchanged, etc.

[0133] As an example, when the cross-change trend is rising, it means that the behavior cross-rate can be increased, and the product of the probability difference and the behavior cross-rate can be calculated to obtain the cross-product, and the sum of the cross-product and the behavior cross-rate is used as the adaptive cross-rate. When the cross-change trend is falling, it means that the behavior cross-rate can be reduced, and the product of the probability difference and the behavior cross-rate can be calculated to obtain the cross-product, and the difference between the cross-product and the behavior cross-rate is used as the adaptive cross-rate. When the cross-change trend is unchanged, it means that there is no need to increase or decrease the behavior cross-rate, and the behavior cross-rate can be used as the adaptive cross-rate. Calculating the cross-product and adjusting the behavior cross-rate based on the cross-product can not only adjust the behavior cross-rate, but also prevent the behavior cross-rate from suddenly becoming too large or too small. This is convenient for ensuring the stability of the variation and for generating more potential alternating behaviors.

[0134] When the variation trend is rising, it means that the behavior variation rate can be increased, and the product of the probability difference and the behavior variation rate can be calculated to obtain the variation product, and the sum of the variation product and the behavior variation rate is used as the adaptive variation rate. When the variation trend is falling, it means that the behavior variation rate can be reduced, and the product of the probability difference and the behavior variation rate can be calculated to obtain the variation product, and the difference between the variation product and the behavior variation rate is used as the adaptive variation rate. When the variation trend is unchanged, it means that the behavior variation rate does not need to be increased or decreased, and the behavior variation rate can be used as the adaptive variation rate. Calculating the variation product and adjusting the behavior variation rate based on the variation product can not only adjust the behavior variation rate, but also prevent the behavior variation rate from being suddenly too large or too small. This is convenient for ensuring the stability of the variation and for generating more potential alternating behaviors.

[0135] This embodiment adaptively adjusts the behavior cross rate and the behavior transaction rate to facilitate the generation of more potential alternating behaviors, so that the potential detection model can identify more new attack behaviors.

[0136] Further, refer to Figure 3 Based on the above embodiment of the present application, in another embodiment of the present application, the same or similar contents as the above embodiment can be referred to the above introduction, and will not be repeated in the following. Figure 3 , step S233 also includes steps B10 to B30:

[0137] Step B10, inputting the network vulnerability environment information into the vulnerability attack simulation model, simulating the network vulnerability environment of the to-be-detected network through the network vulnerability environment information, and obtaining a simulated vulnerability environment;

[0138] Step B20, for any of the intermediate alternating behaviors, in the simulated vulnerability environment, attack the network to be detected through the intermediate alternating behavior to obtain a vulnerability attack result;

[0139] Step B30: taking the intermediate alternating behaviors whose vulnerability attack results satisfy the preset invasion success conditions as potential alternating behaviors.

[0140] It should be noted that the simulated vulnerability environment is the network environment corresponding to the network to be detected simulated by the vulnerability attack simulation model, and attack behaviors can be implemented on the network to be detected in the simulated vulnerability environment. The network environment corresponding to the network to be detected can be simulated using network vulnerability environment information, and the network vulnerability environment information can be expressed in the form of files, codes, or network environment labels. Each intermediate alternating behavior can correspond to a vulnerability attack result, and the vulnerability attack result is used to describe the situation in which the intermediate alternating behavior attacks the network to be detected. The vulnerability attack result can be a successful attack or a failed attack, and the preset intrusion success condition includes the condition that the vulnerability attack result is a successful attack.

[0141] The vulnerability attack simulation model can be a neural network model, which is used to quickly simulate the network environment corresponding to the network to be detected. The steps of determining the vulnerability attack simulation model can be to obtain the simulation model to be trained and the simulation training samples, the simulation training samples include simulation samples and simulation result labels, input the simulation samples into the simulation model to be trained, obtain the simulation features, calculate the simulation loss distance between the simulation features and the simulation result labels, if the simulation loss distance is less than or equal to the preset simulation loss threshold, the training of the simulation model to be trained is completed, and the vulnerability attack simulation model is obtained, if the simulation loss distance is greater than the preset simulation loss threshold, then re-acquire the simulation samples, and continue to train the simulation model to be trained until the simulation loss distance is less than or equal to the preset simulation loss threshold.

[0142] Exemplarily, the network vulnerability environment information is input into the vulnerability attack simulation model, and the network vulnerability environment of the network to be detected is simulated through the network vulnerability environment information to obtain a simulated vulnerability environment; for any of the intermediate alternating behaviors, in the simulated vulnerability environment, the network to be detected is attacked through the intermediate alternating behavior to obtain a vulnerability attack result; the intermediate alternating behavior whose vulnerability attack result is a successful attack is taken as a potential alternating behavior.

[0143] This embodiment simulates a network vulnerability environment, thereby testing various intermediate alternating behaviors and screening out potential alternating behaviors that can successfully attack the network to be detected, thereby facilitating subsequent detection of new attack behaviors and improving the accuracy of intrusion detection.

[0144] This application also provides an intrusion detection device, please refer to Figure 4, the intrusion detection device comprises:

[0145] An acquisition module 10 is used to acquire a network to be detected, network vulnerability environment information of the network to be detected, a vulnerability attack simulation model and an intrusion detection model;

[0146] The calling module 20 is used to call the vulnerability attack simulation model, predict potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtain potential attack information;

[0147] An updating module 30, configured to update the intrusion detection model according to the potential attack information to obtain a potential detection model;

[0148] The intrusion monitoring module 40 is used to detect the network data information corresponding to the network to be detected through the potential detection model to obtain the intrusion detection result.

[0149] The intrusion detection device provided by the present application adopts the intrusion detection method in the above embodiment, aiming to solve the technical problem of low accuracy of intrusion detection of the network. Compared with the prior art, the beneficial effects of the intrusion detection method provided by the embodiment of the present application are the same as the beneficial effects of the intrusion detection method provided by the above embodiment, and other technical features in the intrusion detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0150] An embodiment of the present application provides an electronic device, which may be a playback device, and the electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the intrusion detection method in the above embodiment.

[0151] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0152] like Figure 5As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM) 1004. Various programs and data required for the operation of the electronic device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus.

[0153] Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0154] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0155] The electronic device provided by the present application adopts the intrusion detection method in the above-mentioned embodiment 1 to solve the technical problem of low accuracy of intrusion detection in the network. Compared with the prior art, the beneficial effect of product flow data distribution provided by the embodiment of the present application is the same as the beneficial effect of the intrusion detection method provided by the above-mentioned embodiment, and the other technical features in the intrusion detection device are the same as the features disclosed in the above-mentioned embodiment method, which will not be repeated here.

[0156] It should be understood that the various parts of the present disclosure can be implemented with hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0157] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0158] This embodiment provides a computer-readable storage medium having computer-readable program instructions stored thereon, and the computer-readable program instructions are used to execute the intrusion detection method in the above-mentioned embodiment 1.

[0159] The computer-readable storage medium provided in the embodiment of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, equipment or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable EPROM (Electric Programmable Read On ly Memory, read-only memory) or flash memory, an optical fiber, a portable compact disk CD-ROM (compact disk read-on ly memory, read-only memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution device, device or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency, radio frequency), etc., or any suitable combination of the above.

[0160] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0161] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: obtains a vulnerability attack simulation model and an intrusion detection model of the network to be detected; calls the vulnerability attack simulation model, and predicts potential attack behaviors of attacking the network to be detected based on a set of attack behaviors preset on the vulnerability attack simulation model, and obtains potential attack information; updates the intrusion detection model based on the potential attack information to obtain a potential detection model; and detects network data information corresponding to the network to be detected through the potential detection model to obtain an intrusion detection result.

[0162] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a LAN (local area network) or a WAN (wide area network), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0163] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the equipment, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based device that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0164] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of the module does not limit the unit itself in some cases.

[0165] The computer-readable storage medium provided by the present application stores computer-readable program instructions for executing the above-mentioned intrusion detection method, aiming to solve the technical problem of low accuracy of intrusion detection of the network. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the embodiment of the present application are the same as the beneficial effects of the intrusion detection method provided in the above-mentioned embodiment, and will not be described in detail here.

[0166] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned intrusion detection method when executed by a processor.

[0167] The computer program product provided in this application is intended to solve the technical problem of low accuracy of intrusion detection in the network. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiment of this application are the same as the beneficial effects of the intrusion detection method provided in the above embodiment, which will not be repeated here.

[0168] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. An intrusion detection method, characterized in that: The method includes: Obtain vulnerability attack simulation model and intrusion detection model of the network to be detected; Calling the vulnerability attack simulation model, predicting potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtaining potential attack information; According to the potential attack information, the intrusion detection model is updated to obtain a potential detection model; Using the potential detection model, detecting network data information corresponding to the network to be detected, and obtaining an intrusion detection result; The step of calling the vulnerability attack simulation model, predicting potential attack behaviors against the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtaining potential attack information comprises: Acquire the network environment type of the network to be detected; and search the set of vulnerability attacks that matches the network environment type in the set of attack behaviors; Through the vulnerability attack simulation model, the vulnerability attack set is cross-mutated to predict potential attack behaviors of attacking the network to be detected, and potential attack information of the network to be detected is obtained; The vulnerability attack set includes vulnerability attack behaviors; the potential attack information includes potential alternating behaviors; the step of performing cross-mutation on the vulnerability attack set through the vulnerability attack simulation model to predict potential attack behaviors that attack the network to be detected, and obtaining the potential attack information of the network to be detected includes: Obtaining the number of alternating iterations, the behavior crossover rate, and the behavior mutation rate of the vulnerability attack set, and obtaining network vulnerability environment information of the network to be detected; According to the behavior crossover rate and the behavior mutation rate, cross-mutate each of the vulnerability attack behaviors to obtain a plurality of intermediate alternating behaviors, and accumulate the number of alternating iterations; Calling the vulnerability attack simulation model, based on the network vulnerability environment information, screening out at least one potential alternating behavior that meets a preset successful attack condition from each of the intermediate alternating behaviors; Determine whether the alternating iteration number is greater than a preset iteration number; if so, take all the potential alternating behaviors as the potential attack information; After the step of determining whether the number of alternating iterations is greater than the preset number of iterations, the method further includes: if the number of alternating iterations is less than or equal to the preset number of iterations, counting the number of potential behaviors of each of the potential alternating behaviors; and calculating the probability of attack success according to the number of potential behaviors and the total number of behaviors of each of the intermediate alternating behaviors; Obtain the previous attack probability of the previous time step of the attack success probability, if the attack success probability is less than the previous success probability, obtain historical iterative variation data, and adjust the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data to obtain an adaptive crossover rate and an adaptive variation rate; The behavior crossover rate is updated to the adaptive crossover rate, the behavior mutation rate is updated to the adaptive mutation rate, the vulnerability attack behavior is updated according to the intermediate alternating behavior, and the execution step is returned to: according to the behavior crossover rate and the behavior mutation rate, each vulnerability attack behavior is cross-mutated to obtain multiple intermediate alternating behaviors, and the alternating iteration number is accumulated.

2. The method according to claim 1, characterized in that The step of performing crossover mutation on each vulnerability attack behavior according to the behavior crossover rate and the behavior mutation rate to obtain a plurality of intermediate alternating behaviors comprises: Obtaining vulnerability attack chromosomes corresponding to each of the vulnerability attack behaviors; According to the behavior crossover rate and the behavior mutation rate, crossover and mutation are performed on each of the vulnerability attack chromosomes to obtain a plurality of intermediate alternating chromosomes; Each of the intermediate alternation chromosomes is decoded respectively to obtain the intermediate alternation behaviors corresponding to each of the intermediate alternation chromosomes.

3. The method according to claim 1, characterized in that The step of obtaining historical iterative variation data, and adjusting the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data to obtain the adaptive crossover rate and the adaptive variation rate comprises: Sequentially concatenate the previous success probability and the attack success probability to obtain an attack change trend combination; Searching for a target historical change trend combination that matches the attack change trend combination in the historical iterative variation data, and obtaining an iterative change trend combination of the target historical change trend combination at the next time step; If the change trend of the iterative change trend combination is an increasing trend of success probability, then determining the front crossover rate and the front mutation rate corresponding to the front success rate, and the back crossover rate and the back mutation rate corresponding to the back success rate from the iterative change trend combination; According to the crossover change trend from the front crossover rate to the rear crossover rate and the probability difference, the behavior crossover rate is adjusted to obtain the adaptive crossover rate, and according to the mutation change trend from the front mutation rate to the rear mutation rate and the probability difference, the behavior mutation rate is adjusted to obtain the adaptive mutation rate.

4. The method according to claim 1, characterized in that The step of calling the vulnerability attack simulation model and selecting at least one potential alternating behavior that meets a preset successful attack condition from each of the intermediate alternating behaviors based on the network vulnerability environment information includes: Inputting the network vulnerability environment information into the vulnerability attack simulation model, simulating the network vulnerability environment of the to-be-detected network through the network vulnerability environment information, and obtaining a simulated vulnerability environment; For any of the intermediate alternating behaviors, in the simulated vulnerability environment, attack the network to be detected through the intermediate alternating behavior to obtain a vulnerability attack result; The intermediate alternating behaviors whose vulnerability attack results meet the preset intrusion success conditions are taken as potential alternating behaviors.

5. An intrusion detection device, characterized in that: The device comprises: An acquisition module, used to acquire a network to be detected, network vulnerability environment information of the network to be detected, a vulnerability attack simulation model and an intrusion detection model; A calling module, used to call the vulnerability attack simulation model, predict potential attack behaviors of attacking the network to be detected according to the attack behavior set preset in the vulnerability attack simulation model, and obtain potential attack information; An updating module, used for updating the intrusion detection model according to the potential attack information to obtain a potential detection model; An intrusion monitoring module is used to detect network data information corresponding to the network to be detected through the potential detection model to obtain an intrusion detection result; The calling module is further used to obtain the network environment type of the network to be detected; find a vulnerability attack set matching the network environment type in the attack behavior set; perform cross-mutation on the vulnerability attack set through the vulnerability attack simulation model to predict potential attack behaviors that attack the network to be detected, and obtain potential attack information of the network to be detected; wherein the vulnerability attack set includes vulnerability attack behaviors; and the potential attack information includes potential alternating behaviors; The calling module is further used to obtain the number of alternating iterations, the behavior crossover rate and the behavior mutation rate of the vulnerability attack set, and obtain the network vulnerability environment information of the network to be detected; according to the behavior crossover rate and the behavior mutation rate, each of the vulnerability attack behaviors is cross-mutated to obtain multiple intermediate alternating behaviors, and the number of alternating iterations is accumulated; the vulnerability attack simulation model is called, and based on the network vulnerability environment information, at least one potential alternating behavior that meets the preset successful attack condition is screened out from each of the intermediate alternating behaviors; it is determined whether the number of alternating iterations is greater than the preset number of iterations; if so, each of the potential alternating behaviors is collectively used as the potential attack information; The calling module is further configured to count the number of potential behaviors of each of the potential alternating behaviors if the number of alternating iterations is less than or equal to the preset number of iterations; and calculate the probability of attack success according to the number of potential behaviors and the total number of behaviors of each of the intermediate alternating behaviors; The calling module is further used to obtain the previous attack probability at the previous time step of the attack success probability, and if the attack success probability is less than the previous success probability, obtain historical iterative variation data, and adjust the behavior crossover rate and the behavior variation rate according to the probability difference between the attack success probability and the previous success probability and the historical iterative variation data to obtain the adaptation crossover rate and the adaptation variation rate; The calling module is also used to update the behavior crossover rate to the adaptive crossover rate, update the behavior mutation rate to the adaptive mutation rate, update the vulnerability attack behavior according to the intermediate alternating behavior, and return to the execution step: according to the behavior crossover rate and the behavior mutation rate, cross-mutate each vulnerability attack behavior to obtain multiple intermediate alternating behaviors, and accumulate the number of alternating iterations.

6. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the intrusion detection method described in any one of claims 1 to 4.

7. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, on which is stored a program for implementing the intrusion detection method, and the program for implementing the intrusion detection method is executed by a processor to implement the steps of the intrusion detection method as described in any one of claims 1 to 4.

Images