A real-time network security decision-making system based on large-scale model driving

Abstract

The present disclosure relates to a real-time network security decision-making system driven by a large-scale model. The system comprises: segmenting the acquired network traffic time series based on a predetermined time scale and performing data regularization according to the time dimension to obtain a sequence of local network traffic time series input vectors; performing network traffic time series encoding on the sequence of local network traffic time series input vectors, and then using an important pattern capturer based on a foreground-like attention mechanism to obtain a content-significant network traffic full-time domain aggregate representation matrix; and determining whether there is a network traffic anomaly based on the content-significant network traffic full-time domain aggregate representation matrix. In this way, real-time monitoring and decision-making responses for network security can be driven by a large-scale model, thereby quickly identifying and responding to potential threats in the network, improving the efficiency and accuracy of detecting network security incidents, and reducing losses caused by network attacks.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a network security real-time decision-making system driven by a large-scale model. Background Art

[0002] With the widespread use of the internet and the acceleration of informatization, cybersecurity issues have become increasingly prominent. Cybersecurity refers to the protection of computer networks from threats and attacks such as unauthorized access, destruction, modification, or disclosure of information. The importance of cybersecurity is growing as cyberattacks continue to evolve and become increasingly sophisticated, posing serious threats to the information assets and network infrastructure of individuals, organizations, and even nations.

[0003] However, traditional network security systems primarily operate based on predefined rule sets. These rules are often static and difficult to adjust and adapt to new threats. When faced with unknown attack forms or variants, rule-driven systems may be unable to effectively detect and defend against them. Furthermore, traditional security systems primarily rely on signature matching to identify known attack patterns, an approach that is easily circumvented and deceived by attackers. As attack techniques continue to evolve, relying solely on signature matching often fails to effectively address new threats.

[0004] Furthermore, traditional network security systems often suffer from significant latency, making them unable to monitor and respond to network security incidents in real time. When faced with rapidly spreading cyberattacks or large-scale cyber threats, traditional systems may be unable to detect and respond promptly, leading to security vulnerabilities being exploited. Furthermore, traditional network security systems often lack intelligent analysis and learning capabilities. Systems without intelligent analysis are vulnerable to complex attacks and are unable to make accurate security decisions.

[0005] Therefore, a large-scale model-driven real-time network security decision-making system is expected. Summary of the Invention

[0006] This summary is provided to briefly introduce concepts that will be described in detail in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0007] In a first aspect, the present disclosure provides a large-scale model-driven real-time network security decision-making system, the system comprising:

[0008] A network traffic data collection module is used to obtain the time series of network traffic collected by a network sniffer;

[0009] A network traffic time series data segmentation module is used to segment the time series of the network traffic based on a predetermined time scale to obtain a set of local time series of the network traffic;

[0010] A network traffic local time series data regularization module is used to regularize each local time series of network traffic in the set of local time series of network traffic according to the time dimension to obtain a sequence of network traffic local time series input vectors;

[0011] A network traffic local time series feature extraction module is used to perform network traffic time series encoding on the sequence of network traffic local time series input vectors to obtain a sequence of network traffic local time series associated implicit feature vectors;

[0012] A network traffic full-time domain feature aggregation and saliency representation module is used to arrange the sequence of the network traffic local temporal correlation implicit feature vectors into a network traffic full-time domain aggregation matrix and then obtain a content-saliency network traffic full-time domain aggregation representation matrix through an important pattern capturer based on a foreground-like attention mechanism;

[0013] The network traffic anomaly detection module is used to significantly determine whether there is a network traffic anomaly based on the content and the full-time domain aggregation representation matrix of the network traffic.

[0014] Optionally, the network traffic local time series feature extraction module is used to: pass the sequence of the network traffic local time series input vectors through a network traffic time series encoder based on a bidirectional LSTM model to obtain a sequence of the network traffic local time series associated implicit feature vectors.

[0015] Optionally, the network traffic full-time domain feature aggregation saliency representation module includes: a matrix arrangement unit, used to arrange the sequence of the network traffic local time series associated implicit feature vectors to obtain the network traffic full-time domain aggregation matrix; a foreground mask weight matrix calculation unit, used to calculate the foreground mask weight matrix of the network traffic full-time domain aggregation matrix to obtain the network traffic full-time domain aggregation mask support weight matrix; a position point multiplication calculation unit, used to perform position point multiplication on the network traffic full-time domain aggregation mask support weight matrix and the network traffic full-time domain aggregation matrix to obtain the content-saliency network traffic full-time domain aggregation representation matrix.

[0016] Optionally, the foreground mask weight matrix calculation unit includes: a first calculation subunit, used to use the negative number of the characteristic value of each position of the network traffic full time domain aggregation matrix as the exponent of the natural constant to calculate the exponential function value with the natural constant as the base according to the position to obtain the network traffic full time domain aggregation class support feature matrix; a second calculation subunit, used to calculate the reciprocal of the sum of the characteristic value of each position in the network traffic full time domain aggregation class support feature matrix and the constant one to obtain the network traffic full time domain aggregation class representation matrix; a masking processing subunit, used to mask the network traffic full time domain aggregation class representation matrix to obtain the network traffic full time domain aggregation mask support weight matrix.

[0017] Optionally, the masking processing subunit is used to: set the eigenvalues ​​of each position in the network traffic full time domain aggregation class characterization matrix whose eigenvalues ​​are less than the predetermined threshold to zero to obtain the network traffic full time domain aggregation mask support weight matrix.

[0018] Optionally, the network traffic anomaly detection module is used to: pass the content-salient network traffic full-time domain aggregation representation matrix through a real-time decision maker based on a classifier to obtain a decision result, and the decision result is used to indicate whether there is a network traffic anomaly.

[0019] The above technical solution is used to segment the acquired network traffic time series based on a predetermined time scale and perform data normalization according to the time dimension to obtain a sequence of network traffic local time series input vectors; the sequence of network traffic local time series input vectors is subjected to network traffic time series encoding, and then an important pattern capturer based on a foreground-like attention mechanism is used to obtain a content-salient network traffic full-time domain aggregate representation matrix; based on the content-salient network traffic full-time domain aggregate representation matrix, it is determined whether there are network traffic anomalies. In this way, it is possible to drive real-time monitoring and decision-making responses for network security based on large-scale models, thereby quickly identifying and responding to potential threats in the network, improving the efficiency and accuracy of detecting network security incidents, and reducing the losses caused by network attacks.

[0020] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other features, advantages and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that the originals and elements are not necessarily drawn to scale. In the drawings:

[0022] Figure 1The present invention is a block diagram showing a large-scale model-driven real-time network security decision-making system according to an exemplary embodiment.

[0023] Figure 2 The present invention is a flowchart showing a real-time network security decision-making method based on large-scale model driving according to an exemplary embodiment.

[0024] Figure 3 It is a block diagram of an electronic device according to an exemplary embodiment.

[0025] Figure 4 This is a diagram showing an application scenario of a large-scale model-driven real-time network security decision-making system according to an exemplary embodiment. DETAILED DESCRIPTION

[0026] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0027] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0028] As used herein, the term "including" and its variations are open-ended, i.e., "including but not limited to." The term "based on" means "based, at least in part, on." The term "one embodiment" means "at least one embodiment," the term "another embodiment" means "at least one additional embodiment," and the term "some embodiments" means "at least some embodiments." Other terms are defined in the following description.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0030] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] In recent years, with the widespread use of web applications, the scope of network attacks has continued to expand, posing a significant challenge in the field of network security. Defending against web attacks is crucial for protecting user data and maintaining the reliability of web applications. Traditional defense methods often only passively address known attack behaviors and are unable to effectively counter new web attack techniques. Against this backdrop, dynamic active defense has emerged as an innovative research direction. Dynamic active defense is a proactive defense strategy against network attacks. Traditional network security defenses often passively wait for attackers to launch attacks and then defend and respond. Dynamic active defense, on the other hand, proactively prevents attacks before potential threats are discovered and takes appropriate measures to precisely target intruders. Dynamic active defense proactively prevents attacks and takes appropriate defensive measures before web applications are compromised. The emergence of this defense strategy is closely related to the characteristics and trends of web attacks. First, web attacks are diverse and rapidly evolving. Traditional signature and feature matching methods often fail to promptly identify and respond to newly generated attacks. For example, attackers can circumvent traditional defenses against common web attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF) through techniques like deformation and obfuscation. Furthermore, the threat posed by web attacks continues to grow. As web applications grow in complexity and functional diversity, attackers can exploit software vulnerabilities, misuse APIs, and employ social engineering to launch more sophisticated and covert attacks. This advanced attack behavior places higher demands on traditional defenses. Furthermore, web attacks often employ long-term penetration and persistence, posing a potential threat to systems. Attackers can exploit weaknesses in passive defenses and system vulnerabilities to remain lurking within attacked web applications for extended periods, stealing data, tampering with it, and gaining control. These persistent attacks have a significant impact on the security and reputation of businesses and organizations. Against this backdrop, research on dynamic active defense has garnered widespread attention. Dynamic active defense proactively interacts with attackers and simulates attack behavior, revealing their identities and technical characteristics and enabling timely implementation of appropriate defensive measures. Furthermore, dynamic active defense can proactively collect and analyze attacker behavioral data, providing additional information for security analysis and prediction. In the research of dynamic active defense, new technical means and methods have been introduced and explored. For example, attack graph generation technology can simulate attacker behavior paths and attack methods to create attack graphs for specific web applications, guiding the selection and optimization of defense measures. Fuzz testing and vulnerability mining techniques can proactively discover and exploit vulnerabilities in web applications and improve their security through repairs or patches. Furthermore, methods based on machine learning and deep learning are also widely used in dynamic active defense research.These methods can identify and predict web attacks by analyzing large amounts of real-time data, while also implementing dynamic defense strategies by tracking and responding to attacker behavior. With the continuous evolution of network attacks and the increasing popularity of network applications, dynamic active defense, as an innovative defense strategy, offers new insights and approaches for protecting web applications. Through continuous exploration and innovation, dynamic active defense is expected to become a key research direction in web security defense and provide reliable solutions for protecting web applications.

[0033] In order to solve the above problems, the present disclosure provides a network security real-time decision-making system driven by a large-scale model. The system divides the acquired network traffic time series into sequences based on a predetermined time scale and normalizes the data according to the time dimension to obtain a sequence of network traffic local time series input vectors; after performing network traffic time series encoding on the sequence of network traffic local time series input vectors, an important pattern capturer based on a foreground-like attention mechanism is used to obtain a content-significant network traffic full-time domain aggregate representation matrix; based on the content-significant network traffic full-time domain aggregate representation matrix, it is determined whether there is a network traffic anomaly. In this way, real-time monitoring and decision-making responses for network security can be driven based on a large-scale model, so that potential threats in the network can be quickly identified and responded to, the detection efficiency and accuracy of network security incidents can be improved, and the losses caused by network attacks can be reduced.

[0034] The specific embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0035] Figure 1 FIG is a block diagram of a network security real-time decision-making system based on large-scale model driving according to an exemplary embodiment. Figure 1 As shown, the network security real-time decision-making system 100 includes:

[0036] The network traffic data collection module 101 is used to obtain the time series of network traffic collected by the network sniffer;

[0037] The network traffic time series data segmentation module 102 is configured to segment the network traffic time series based on a predetermined time scale to obtain a set of local time series of the network traffic;

[0038] The network traffic local time series data regularization module 103 is used to regularize each local time series of network traffic in the set of local time series of network traffic according to the time dimension to obtain a sequence of network traffic local time series input vectors;

[0039] The network traffic local time series feature extraction module 104 is configured to perform network traffic time series encoding on the sequence of network traffic local time series input vectors to obtain a sequence of network traffic local time series associated implicit feature vectors;

[0040] The network traffic full-time domain feature aggregation and saliency representation module 105 is used to arrange the sequence of the network traffic local temporal correlation implicit feature vectors into a network traffic full-time domain aggregation matrix and then obtain a content-saliency network traffic full-time domain aggregation representation matrix through an important pattern capturer based on a foreground-like attention mechanism;

[0041] The network traffic anomaly detection module 106 is configured to determine whether there is a network traffic anomaly based on the content-signaled network traffic full-time domain aggregation representation matrix.

[0042] In response to the above technical problems, the technical solution of this application proposes a real-time network security decision-making system based on large-scale model driving. The system can monitor and collect network traffic data in real time through a network sniffer, and introduce deep learning technology at the back end to analyze and correlate these network traffic time series data, so as to more accurately identify abnormal traffic and potential attacks in the network, thereby realizing real-time monitoring and response to network security. In this way, it is possible to drive real-time monitoring and decision-making response of network security based on large-scale models, so as to quickly identify and respond to potential threats in the network, improve the detection efficiency and accuracy of network security incidents, and reduce the losses caused by network attacks.

[0043] Specifically, in the technical solution of the present application, first, a time series of network traffic collected by a network sniffer is obtained. Next, considering that network traffic monitoring requires collecting a large amount of network traffic data, analyzing the network traffic over the entire time series may make it difficult to capture the time series patterns and anomalies related to the network traffic. Therefore, in order to better understand and analyze the time series characteristics of network traffic, thereby improving the network security system's ability to detect and identify abnormal traffic, the technical solution of the present application requires segmenting the network traffic time series based on a predetermined time scale to obtain a set of local time series of network traffic. Segmenting the network traffic time series into a set of local time series helps the system analyze the local characteristics and time series correlations of the network traffic data in more detail. This allows for a better understanding of traffic variation patterns within different time periods, facilitating the detection of abnormal behavior and potential attacks. That is, since network traffic data typically has distinct time series characteristics, including periodicity, trend, and seasonality, segmenting the network traffic time series can better capture these time series characteristics, helping the system identify normal and abnormal traffic patterns.

[0044] It should be understood that since the network traffic data in each local time period after segmentation have dynamic time series change rules and time series correlation relationships, in order to capture the time series characteristics of these local time series of network traffic, it is necessary to standardize the local time series data of each network traffic and convert it into an input form suitable for processing. Based on this, in the technical solution of the present application, the local time series of each network traffic in the set of local time series of network traffic is further regularized according to the time dimension to obtain a sequence of local time series input vectors of network traffic. By regularizing the local time series of each network traffic according to the time dimension, the time series distribution information of the network traffic in each local time period can be retained, which is helpful for the subsequent analysis of the time series characteristics and change patterns of network traffic, thereby identifying abnormal network traffic and potential network threats.

[0045] The sequence of network traffic local time series input vectors is then encoded through a network traffic time series encoder based on a bidirectional LSTM model to extract the implicit feature information associated with the network traffic time series in each local time period, thereby obtaining a sequence of implicit feature vectors associated with the network traffic local time series. It should be understood that since the bidirectional long short-term memory network can effectively capture long-term dependencies in time series data, the application of the bidirectional LSTM model can learn the complex time series features of the network traffic data in each local time period, including periodicity, trend, and seasonality. This helps the system better understand the patterns and regularities of traffic time series changes within different local time periods, thereby facilitating more accurate identification of abnormal traffic and potential attacks.

[0046] In one embodiment of the present disclosure, the network traffic local time series feature extraction module is used to: pass the sequence of the network traffic local time series input vectors through a network traffic time series encoder based on a bidirectional LSTM model to obtain a sequence of the network traffic local time series associated implicit feature vectors.

[0047] Furthermore, since each network traffic local time series association implicit feature vector in the sequence of the network traffic local time series association implicit feature vector contains the local time series features of the network traffic in each local time period, and the network traffic time series features in different local time periods have a global correlation relationship based on the time domain. In addition, it is also taken into account that when performing actual network traffic anomaly detection, some network traffic time series features in local time periods have a higher contribution to the detection, while some are network traffic local time series patterns with a lower contribution. Based on this, in order to further extract important time series features and patterns in network traffic data, highlight the key time domain features and correlation information in these network traffic local time series features, so as to better describe and understand the full time domain features of network traffic, in order to improve the accuracy of network traffic anomaly detection, in the technical solution of the present application, the sequence of the network traffic local time series association implicit feature vector is further arranged into a network traffic full time domain aggregation matrix, and then an important pattern capturer based on a foreground-like attention mechanism is used to obtain a content-salient network traffic full time domain aggregation representation matrix. It should be understood that by arranging the sequence of local temporal correlation implicit feature vectors into a full-time domain aggregation matrix, it is helpful to integrate the sequence of local temporal correlation implicit feature vectors of the network traffic into global features, which can provide a more comprehensive temporal feature representation of the network traffic data, which is conducive to better capturing the changes and patterns of the network traffic data in the entire time range, so as to facilitate the identification of abnormal temporal patterns and abnormal changes in network traffic. In addition, through the processing of the important pattern capturer based on the foreground-like attention mechanism, the content of the full-time domain aggregation representation matrix of the network traffic can be significantly processed to help the system identify important patterns and feature information in the full-time domain temporal features of the network traffic, improve the system's attention to these key temporal features of the network traffic, and thus better discover the potential laws in the data. This helps the system to more accurately identify abnormal traffic, detect potential attacks and strengthen network security defenses.

[0048] In one embodiment of the present disclosure, the network traffic full-time domain feature aggregation saliency representation module includes: a matrix arrangement unit, used to arrange the sequence of the network traffic local time-series associated implicit feature vectors to obtain the network traffic full-time domain aggregation matrix; a foreground mask weight matrix calculation unit, used to calculate the foreground mask weight matrix of the network traffic full-time domain aggregation matrix to obtain the network traffic full-time domain aggregation mask support weight matrix; a position point multiplication calculation unit, used to perform position point multiplication on the network traffic full-time domain aggregation mask support weight matrix and the network traffic full-time domain aggregation matrix to obtain the content-saliency network traffic full-time domain aggregation representation matrix.

[0049] Furthermore, in one embodiment of the present disclosure, the foreground mask weight matrix calculation unit includes: a first calculation subunit, used to use the negative number of the characteristic value of each position of the network traffic full-time domain aggregation matrix as the exponent of the natural constant to calculate the exponential function value with the natural constant as the base according to the position to obtain the network traffic full-time domain aggregation class support feature matrix; a second calculation subunit, used to calculate the reciprocal of the sum of the characteristic value of each position in the network traffic full-time domain aggregation class support feature matrix and the constant one to obtain the network traffic full-time domain aggregation class representation matrix; a masking processing subunit, used to mask the network traffic full-time domain aggregation class representation matrix to obtain the network traffic full-time domain aggregation mask support weight matrix.

[0050] Furthermore, in one embodiment of the present disclosure, the masking processing subunit is used to: set the eigenvalues ​​of each position in the network traffic full time domain aggregation class characterization matrix whose eigenvalues ​​are less than the predetermined threshold to zero to obtain the network traffic full time domain aggregation mask support weight matrix.

[0051] After arranging the sequence of the local temporal correlation implicit feature vectors of the network traffic into a full-time-domain aggregation matrix of the network traffic, the matrix is ​​processed by the important pattern capturer based on the foreground attention mechanism using the following foreground content highlighting formula to obtain the full-time-domain aggregation representation matrix of the content-salient network traffic; wherein the foreground content highlighting formula is:

[0052]

[0053] M c =A⊙M

[0054] Wherein, M(i,j) is the eigenvalue of the (i,j)th position of the network traffic full-time domain aggregation matrix, exp(·) is the exponential operation, mask(·) is the mask function, A(i,j) is the eigenvalue of the (i,j)th position of the network traffic full-time domain aggregation mask support weight matrix, ε is a hyperparameter, M is the network traffic full-time domain aggregation matrix, A is the network traffic full-time domain aggregation mask support weight matrix, ⊙ is the positional point multiplication, M c A full-time aggregate representation matrix of network traffic is salient for the content.

[0055] The content-salienced network traffic full-time aggregate representation matrix is ​​then passed through a classifier-based real-time decision maker to obtain a decision result, which is used to indicate whether there is a network traffic anomaly. In other words, the content-salienced feature representation information of the full-time aggregate features of network traffic is used for classification processing to identify abnormal traffic and potential attacks in the network, thereby achieving real-time monitoring and response to network security. In this way, it is possible to drive real-time monitoring and decision-making responses for network security based on large-scale models, thereby quickly identifying and responding to potential threats in the network, improving the efficiency and accuracy of detecting network security incidents, and reducing the losses caused by network attacks.

[0056] In one embodiment of the present disclosure, the network traffic anomaly detection module is used to: pass the content-salient network traffic full-time domain aggregation representation matrix through a real-time decision maker based on a classifier to obtain a decision result, and the decision result is used to indicate whether there is a network traffic anomaly.

[0057] In the technical solution of the present application, the sequence of the local temporal association implicit feature vectors of the network traffic represents the time series of the network traffic based on the long-range-remote temporal contextual association features of the network traffic between local time domains determined by sequence segmentation. After the sequence of the local temporal association implicit feature vectors of the network traffic is arranged into a full-time-domain aggregation matrix of the network traffic and passed through an important pattern capturer based on a class-foreground attention mechanism, the obtained full-time-domain aggregation representation matrix of the content-salient network traffic has a feature expression effect of a significant representation of the semantic interaction features based on feature integration of the local time domain and the global time domain under the action of a class-foreground attention mechanism on the complex feature representation dimension, which will cause the overall feature distribution of the full-time-domain aggregation representation matrix of the content-salient network traffic to be insufficiently constrained relative to the classification regression domain of the real-time decision maker based on the classifier, affecting the accuracy of the decision result.

[0058] In the technical solution of the present application, preferably, the content-significant network traffic full-time domain aggregation representation matrix is ​​passed through a real-time decision maker based on a classifier to obtain a decision result, specifically including: performing a dot addition operation on the content-significant network traffic full-time domain aggregation representation matrix and the square root of the scale of the content-significant network traffic full-time domain aggregation representation matrix and the inverse of the square root of the F-norm of the content-significant network traffic full-time domain aggregation representation matrix to obtain a first content-significant network traffic full-time domain aggregation intermediate feature matrix, wherein the scale of the content-significant network traffic full-time domain aggregation representation matrix is ​​the product of the width and height of the content-significant network traffic full-time domain aggregation representation matrix; calculating the first content-significant network traffic full-time domain aggregation intermediate feature matrix based on An exponential function with a natural constant as the base is used to obtain a second content-significant network traffic full-time domain aggregated intermediate feature matrix; a dot product operation is performed on the absolute value of the sum of all eigenvalues ​​of the content-significant network traffic full-time domain aggregated representation matrix and the content-significant network traffic full-time domain aggregated representation matrix and a weight hyperparameter to obtain a third content-significant network traffic full-time domain aggregated intermediate feature matrix; a dot addition operation is performed on the second content-significant network traffic full-time domain aggregated intermediate feature matrix and the third content-significant network traffic full-time domain aggregated intermediate feature matrix to obtain an optimized content-significant network traffic full-time domain aggregated representation matrix; the optimized content-significant network traffic full-time domain aggregated representation matrix is ​​passed through the classifier-based real-time decision maker to obtain the decision result.

[0059] In the above example embodiment, the structured norm representation of the content-significant network traffic full-time aggregate representation matrix is ​​used as the local canonical coordinate for each eigenvalue of the content-significant network traffic full-time aggregate representation matrix to determine the rotational offset of the vector overall distribution representation of the content-significant network traffic full-time aggregate representation matrix relative to the eigenvalue for the content-significant network traffic full-time aggregate representation matrix as the center, and the eigenvalue constraint is performed using the bounding box of the vector eigenvalue distribution of the content-significant network traffic full-time aggregate representation matrix to improve the constraint of the content-significant network traffic full-time aggregate representation matrix under the overall classification regression distribution, thereby improving the training speed of the model and the accuracy of the decision results obtained by the classifier-based real-time decision maker of the content-significant network traffic full-time aggregate representation matrix. In this way, abnormal traffic and potential attacks in the network can be more accurately identified, thereby achieving real-time monitoring and response to network security and reducing the losses caused by network attacks.

[0060] Currently, open internet applications include web systems, apps, and mini-programs. Faced with increasingly frequent cyberattacks and numerous incidents, security issues pose a significant risk. Effective security technologies are urgently needed to enhance both application and business security. Currently, open web systems rely primarily on traditional security equipment, which identifies vulnerabilities through the maintenance and updating of vulnerability signature libraries. This presents significant security risks and creates protection gaps. These devices are also ineffective against zero-day vulnerabilities, scanning attacks, malicious crawlers, and man-in-the-middle attacks. Furthermore, with the growing cybersecurity landscape, attackers are increasingly leveraging and upgrading their attack methods through automated tools, AI, big data, and other new technologies. Traditional business security measures are no longer able to meet these increasingly stringent security demands. For example, IPS and WAFs struggle to effectively protect against emerging attack vectors. With the acceleration of 5G and the development of mobile phones, more and more businesses are migrating from PCs to mobile devices. Mobile application services face threats beyond traditional vulnerability scanning, injection attacks, cross-site scripting, app client reverse engineering, and debugging. These threats also include illegal third-party app requests, man-in-the-middle attacks, API abuse, database manipulation, bulk registration, and scraping. Existing protections primarily focus on application-side security, and both client-side app hardening and server-side web application firewalls address only a limited range of issues. Other remaining threats, such as illegal third-party apps, crafted data packets simulating legitimate user requests, and batch API calls to obtain data, require new security solutions. These new business threats cannot be effectively addressed through attack signature identification and request rate limiting. Based on the above considerations, it is necessary to introduce more effective application security and business security protection methods to uniformly and proactively protect the application forms open to the Internet. Through the dynamic application security protection system, without relying on the traditional rule library and feature library, the application system can be dynamically protected. The difficulty of analysis, debugging and cracking by attackers can be increased through dynamic change technology. Ultimately, through precise human-machine recognition capabilities, it can accurately identify whether the visiting terminal is a normal and legitimate browser, and accurately identify whether there is normal human interaction behavior. Through a variety of dynamic behavior association analysis models, the attack behavior of various automation tools can be effectively identified and blocked at the business front end, alleviating the risks of application systems in terms of vulnerability management, account security, data security, business security, etc., and improving the security prevention capabilities of application systems.

[0061] Key dynamic defense technologies, characterized by dynamism, real-time nature, and proactive nature, represent a new approach to addressing unknown threats and intrusion attacks within network systems. Within a dynamic cybersecurity technology architecture, a dynamic defense model based on "continuous monitoring and intelligence early warning" can be constructed based on the overall cybersecurity status and operational security requirements. This combines optimal security perception elements to address known attacks and unknown threats, achieving operationally coordinated responses. The evolution and dynamic reconstruction of dynamic cybersecurity defense technologies must be considered based on an understanding of the system's security posture and potential security threats. Effectively perceiving the threat landscape of network systems, providing early insight into assessments, responses, and adjustments to dynamic defense strategies, are crucial tasks in the field of cybersecurity technology innovation during the current era of digital transformation.

[0062] Dynamic network security defense technology aims to continuously adjust threat detection strategies based on dynamic network environment changes. It leverages big data intelligence to efficiently and accurately detect unknown security threats and anomalous behaviors. Once a warning event is triggered, timely countermeasures are taken to ensure the continued operation of critical applications and services, minimizing the overall impact and losses of threat attacks and improving resilient security defense capabilities. Dynamic defense technology proactively deceives and distracts attackers by setting up false targets / decoys to lure attackers into launching attacks, thereby triggering attack alerts. Dynamic defense changes the passive nature of network defense, altering the "rules of the game" between attackers and defenders, and truly achieving "active" defense. A complete dynamic defense system should be built on a robust security defense architecture. It should also establish security assessments of system defense effectiveness and intelligent decision-making capabilities for dynamic feedback and adjustment based on the results of these assessments and analyses. This complete closed-loop control mechanism enables dynamic adjustment and optimization of strategies based on security dynamics.

[0063] The core technology of dynamic defense is based on a variety of dynamic technologies, each of which is aimed at protecting a certain entity in the information system. Generally speaking, entities in information systems mainly include software, network nodes, computing platforms, data, etc. Therefore, four categories of dynamic defense technologies can be summarized accordingly: software dynamic defense technology, network dynamic defense technology, platform dynamic defense technology, and data dynamic defense technology. (1) Software dynamic defense technology. Software dynamic defense technology mainly applies the idea of ​​randomization. Based on cryptography technology, compilation technology, dynamic runtime technology, etc., it processes program code in a random, diverse, and dynamic manner at multiple levels such as control structure, code layout, memory layout during execution, and organizational structure of execution files, eliminating the homogeneity of software, realizing software polymorphism, reducing or dynamically changing the system attack surface, increasing the difficulty for attackers to exploit vulnerabilities, and effectively resisting external code injection attacks, file tampering attacks, data leakage attacks, infection attacks, and other attack types targeting software defects. Related technologies mainly include: address space layout randomization technology, instruction set randomization technology, binary code randomization technology, software polymorphism technology, and multi-variant execution technology. (2) Network dynamic defense technology. Network dynamic defense technology refers to the implementation of dynamic defense at the network level. Specifically, it refers to breaking the static, deterministic and similar defects of network elements such as network topology, network configuration, network resources, network nodes and network services through dynamic, virtualized and randomized methods, resisting malicious attacks against the target network and increasing the difficulty of attackers in network detection and intranet node penetration. Related technologies mainly include: dynamic network address translation technology, network address space randomization allocation technology, terminal information jump protection technology network and related dynamic protection technologies based on overlay networks. (3) Platform dynamic defense technology. Traditional platform system design often adopts a single architecture and remains unchanged for a long time after delivery and use, which provides attackers with sufficient time to conduct reconnaissance and attack attempts. Once a system vulnerability is discovered and successfully exploited by a malicious attacker, the system will face serious hazards such as service anomalies, information theft, and data tampering. Platform dynamic defense technology is an effective way to solve this inherent defect of system isomorphism. Platform defense technology makes the system uncertain and dynamic by building a variety of operating platforms and dynamically changing the environment in which applications run, thereby shortening the time window in which applications are exposed on a certain platform. This creates a fog of reconnaissance for attackers, making it difficult for them to understand the specific structure of the system and thus launch effective attacks. Related technologies mainly include: platform dynamicization based on dynamic reconfiguration, application hot migration based on heterogeneous platforms, diversification of Web services, and platform dynamicization based on intrusion tolerance. (4) Data dynamic defense technology. Data dynamic defense technology mainly refers to the ability to dynamically change the format, syntax, encoding or representation of relevant data according to the system's defense requirements, thereby increasing the complexity of the attacker and achieving the effect of increasing the difficulty of the attack.Currently known research focuses on data dynamicization technologies, primarily randomizing and diversifying in-memory data. However, some studies also include diversification technologies for application protocol syntax and configuration data within the scope of data dynamicization. Related technologies include data randomization, N-variant data diversification, N-copy data diversification for fault tolerance, and data diversification for web application security.

[0064] Whether the entity's dynamic defense technology can achieve the expected effect and improve its defense capabilities requires a comprehensive analysis and evaluation. Defense and effectiveness evaluation can be described and quantified from the perspectives of qualitative analysis and quantitative evaluation, combined with formal analysis methods. The selection of evaluation criteria can consider comprehensive evaluation of multiple indicators or a single but intuitive evaluation standard such as vulnerability. To ensure the objectivity of the evaluation, it should refer to existing defense evaluation standards from multiple perspectives such as overall defense, system vulnerabilities, attack surface, and defense cost to achieve a dynamic empowerment effectiveness evaluation technology route. (1) Dynamic defense effectiveness evaluation is based on a hierarchical analysis method, which analyzes the elements and their relationships of the system, classifies each element into different levels, calculates the weight of each level and compares them. When dividing the system evaluation effectiveness level, it can be considered to use a fuzzy comprehensive evaluation method to construct a fuzzy relationship matrix generated by observing the system in multiple periods of dynamic changes, and then obtain a comprehensive evaluation result. When the system observation data reaches a certain scale, the accumulated data can be used to predict and evaluate the comprehensive rating level at the next moment. (2) Dynamic effectiveness evaluation based on vulnerability discovery can effectively improve the dynamic detection effect to a certain extent. Because the system remains static during the time interval of dynamic changes, the basic idea is to evaluate the system vulnerabilities in a graded manner, taking into account various factors such as attack path, attack complexity, authentication, confidentiality impact, availability impact, integrity impact, bias factor, exploitability of vulnerabilities, degree of repair and reporting, potential indirect harm, host distribution, etc., and then generate corresponding measurement values ​​through calculation and evaluation. (3) The evaluation of defense effectiveness based on attack surface measurement needs to be considered from two aspects. On the one hand, the attacker's attack characteristics are modeled, their attack capabilities are characterized, and they are combined with the randomly changing state of the defense system. Each system state corresponds to a different attack surface, and then a system state model from the attacker's perspective is generated. Security analysis and testing are carried out with the help of Petri network model. On the other hand, the understanding of the system attack surface by both the attacker and the defender should be considered, and the state transition of the system attack surface should be modeled. The understanding of the attack surface and the supplier strategy adopted by both the attacker and the defender should be predicted respectively, and then the next state of the attack surface should be predicted. In this way, the change of the system's defense capability can be quantitatively analyzed. The state transition of the attack surface can be modeled and measured with the help of Markov chain. (4) Dynamic defense system availability assessments must comprehensively consider costs and benefits. A more detailed modeling description of the attacker's attack strategy changes, the defender's response strategies, and the resulting returns is needed to provide a basis for defenders to select the best defense strategy. Furthermore, compared to traditional technologies, dynamic defense strategy deployment considers the impact on the system in terms of software development, operational performance, software deployment, and operation and maintenance management.

[0065] In recent years, data breaches have become increasingly frequent, and cyberattack techniques have become increasingly sophisticated and frequent, causing significant losses to citizens and businesses. Therefore, new technical approaches are needed to effectively prevent application and business security. Dynamic defense explores cybersecurity defense technologies and systems. It utilizes security capabilities as a standard attribute of enhanced system defense. Through dynamic defense, network system security defenses exhibit unpredictable dynamics, significantly increasing the difficulty and cost of attacker detection. To address the shortcomings of existing technologies, this study, from the perspective of website security protection, implements dynamic protection of the underlying code of website servers, employing dynamic encapsulation and dynamic obfuscation techniques to ensure the security of underlying website code. To address the shortcomings of current dynamic obfuscation algorithms in terms of dynamic path obfuscation and low execution efficiency, a dynamic obfuscation algorithm based on demand-driven symbolic execution is proposed. This algorithm creates new execution paths by inserting connections between jump nodes in the program, creating a path explosion effect to obfuscate the program. To improve the execution efficiency of dynamically obfuscated programs, the idea of ​​node summarization is employed to reduce the number of executions of program paths. To enhance the black-box nature of key nodes, the algorithm marks them as target nodes. This reduces the number of executions based on a demand-driven approach, effectively improving the security of obfuscated programs. Furthermore, this paper analyzes deception defense techniques based on network feature obfuscation, reviews recent obfuscation deception defense schemes for countering network reconnaissance techniques, and, based on existing descriptions, provides a formal definition of network obfuscation deception defense. Four network obfuscation schemes and their characteristics are analyzed. Furthermore, a website defense method based on dynamic code encapsulation is proposed. The agent selects portions of the original computer code from the server device and encapsulates them to hide or rearrange them within obfuscated computer code. Each encapsulation algorithm is unique, concealing the attack entry point and making it impossible for attackers to predict the server's behavior. In summary, the research presented in this chapter implements dynamic code encapsulation and dynamic obfuscation techniques, which can dynamically hide website attack entry points and improve the website's dynamic defense capabilities.

[0066] In summary, the above solution uses a network sniffer to monitor and collect network traffic data in real time. Deep learning-based back-end technology is then used to analyze and correlate this time-series data. This allows for more accurate identification of abnormal network traffic and potential attacks, enabling real-time monitoring and response to network security. This enables real-time monitoring and decision-making based on large-scale models, enabling rapid identification and response to potential threats, improving the efficiency and accuracy of detecting network security incidents and reducing the damage caused by network attacks.

[0067] Figure 2 FIG. 1 is a flowchart of a method for real-time network security decision-making based on large-scale model driving according to an exemplary embodiment. Figure 2 As shown, the method includes:

[0068] Step 201: Obtain a time series of network traffic collected by a network sniffer;

[0069] Step 202: Segment the time series of the network traffic based on a predetermined time scale to obtain a set of local time series of the network traffic;

[0070] Step 203: performing data regularization on each local time series of network traffic in the set of local time series of network traffic according to the time dimension to obtain a sequence of local time series input vectors of network traffic;

[0071] Step 204: Perform network traffic time series encoding on the sequence of network traffic local time series input vectors to obtain a sequence of network traffic local time series associated implicit feature vectors;

[0072] Step 205: Arrange the sequence of the network traffic local temporal correlation implicit feature vectors into a network traffic full-time domain aggregation matrix and then pass it through an important pattern capturer based on a foreground-like attention mechanism to obtain a content-saliency network traffic full-time domain aggregation representation matrix;

[0073] Step 206: Determine whether there is a network traffic anomaly based on the content-significant network traffic full-time domain aggregate representation matrix.

[0074] Reference below Figure 3 , which shows a schematic structural diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 3 The electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present disclosure.

[0075] like Figure 3 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0076] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0077] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0078] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0079] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0080] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0081] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including, but not limited to, object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0082] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0083] The modules described in the embodiments of the present disclosure may be implemented in software or hardware. In some cases, the name of a module does not necessarily limit the module itself. For example, a test parameter acquisition module may also be described as a "module for acquiring device test parameters corresponding to a target device."

[0084] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0085] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0086] Figure 4 FIG. 1 is an application scenario diagram of a large-scale model-driven real-time network security decision-making system according to an exemplary embodiment. Figure 4 As shown, in this application scenario, first, the time series of network traffic collected by the network sniffer is obtained (for example, Figure 4 Then, the acquired network traffic time series is input to a server that is deployed with a large-scale model-driven network security real-time decision-making algorithm (for example, Figure 4 In S) shown in , the server is capable of processing the time series of the network traffic based on a large-scale model-driven network security real-time decision-making algorithm to determine whether there is a network traffic anomaly.

[0087] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0088] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0089] Although the subject matter has been described using language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims. Regarding the apparatus in the above-described embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments related to the method and will not be elaborated upon here.

Claims

1. A large-scale model-driven real-time network security decision-making system, characterized by: include: A network traffic data collection module is used to obtain the time series of network traffic collected by a network sniffer; A network traffic time series data segmentation module is used to segment the time series of the network traffic based on a predetermined time scale to obtain a set of local time series of the network traffic; A network traffic local time series data regularization module is used to regularize each local time series of network traffic in the set of local time series of network traffic according to the time dimension to obtain a sequence of network traffic local time series input vectors; A network traffic local time series feature extraction module is used to perform network traffic time series encoding on the sequence of network traffic local time series input vectors to obtain a sequence of network traffic local time series associated implicit feature vectors; A network traffic full-time domain feature aggregation and saliency representation module is used to arrange the sequence of the network traffic local temporal correlation implicit feature vectors into a network traffic full-time domain aggregation matrix and then obtain a content-saliency network traffic full-time domain aggregation representation matrix through an important pattern capturer based on a foreground-like attention mechanism; The network traffic anomaly detection module is used to significantly determine whether there is a network traffic anomaly based on the content and the full-time domain aggregation representation matrix of the network traffic.

2. The large-scale model-driven real-time network security decision-making system according to claim 1 is characterized in that: The network traffic local time series feature extraction module is used to: pass the sequence of the network traffic local time series input vectors through a network traffic time series encoder based on a bidirectional LSTM model to obtain a sequence of the network traffic local time series associated implicit feature vectors.

3. The large-scale model-driven real-time network security decision-making system according to claim 2 is characterized in that: The network traffic full-time domain feature aggregation and saliency representation module includes: A matrix arrangement unit, configured to arrange the sequence of the network traffic local time series associated implicit feature vectors to obtain the network traffic full time domain aggregation matrix; a foreground mask weight matrix calculation unit, configured to calculate a foreground mask weight matrix of the network traffic full time domain aggregation matrix to obtain a network traffic full time domain aggregation mask support weight matrix; The position point multiplication calculation unit is used to perform position point multiplication on the network traffic full time domain aggregation mask support weight matrix and the network traffic full time domain aggregation matrix to obtain the content saliency network traffic full time domain aggregation representation matrix.

4. The large-scale model-driven real-time network security decision-making system according to claim 3 is characterized in that: The foreground mask weight matrix calculation unit includes: A first calculation subunit is configured to use the negative of each position characteristic value of the network traffic full time domain aggregation matrix as an exponent of a natural constant to calculate an exponential function value based on the position and the natural constant to obtain a network traffic full time domain aggregation class support characteristic matrix; A second calculation subunit is used to calculate the reciprocal of the sum of the eigenvalues ​​of each position in the network traffic full time domain aggregate class support feature matrix and a constant one to obtain a network traffic full time domain aggregate class representation matrix; The masking processing subunit is used to perform masking processing on the network traffic full time domain aggregation class characterization matrix to obtain the network traffic full time domain aggregation mask support weight matrix.

5. The large-scale model-driven real-time network security decision-making system according to claim 4 is characterized in that: The masking processing subunit is configured to: The eigenvalues ​​of each position in the network traffic full time domain aggregation class characterization matrix whose eigenvalues ​​are less than a predetermined threshold are set to zero to obtain the network traffic full time domain aggregation mask support weight matrix.

6. The large-scale model-driven real-time network security decision-making system according to claim 5 is characterized in that: The network traffic anomaly detection module is used to: pass the content-salient network traffic full-time domain aggregation representation matrix through a real-time decision maker based on a classifier to obtain a decision result, and the decision result is used to indicate whether there is a network traffic anomaly.

Images