Network attack identification method based on behavior modeling

Abstract

This application discloses a network attack identification method based on behavioral modeling. This method uses network traffic data, combined with system security logs and threat intelligence, to perform data fusion analysis. It then uses deep learning technology to mine attack behavior characteristics and construct a network attack behavior model. This method then matches the network behavior data to be detected with the network attack behavior model to achieve rapid detection and identification of network attack behaviors. This method can effectively improve the accuracy of network attack identification, reduce false positives and false negatives, and provide more reliable technical support for network security protection.

Description

Technical Field

[0001] The present application relates to the field of intelligent identification, and more specifically, to a network attack identification method based on behavior modeling. Background Art

[0002] With the rapid development of internet technology, cybersecurity issues have become increasingly prominent, and cyberattack methods are constantly evolving, posing a serious threat to the information security of individuals and businesses. In today's cybersecurity landscape, to combat intruders, it is often necessary to deploy a variety of network security protection devices, such as firewalls and intrusion detection and prevention systems, to safeguard information assets. These devices generate a large number of low-level network security alert logs during operation. Network attack modeling technology aims to analyze network security alert logs to identify the characteristics and patterns of network attacks, thereby improving the ability to respond to various sudden cyberattack incidents.

[0003] However, traditional network attack modeling techniques rely primarily on static rule bases and simple pattern matching methods. Simple rule matching or statistical analysis of network security logs often fails to effectively address complex and changing network attack scenarios, limiting the accuracy and efficiency of attack identification. Therefore, an optimized network attack identification method based on behavioral modeling is desired. Summary of the Invention

[0004] This application is proposed to address the above-mentioned technical issues. The embodiments of this application provide a network attack identification method based on behavioral modeling. This method uses network traffic data, combined with system security logs and threat intelligence, to perform data fusion analysis. It utilizes deep learning technology to mine attack behavior feature patterns, constructs a network attack behavior model, and then rapidly detects and identifies network attack behaviors based on query matching between the network behavior data to be detected and the network attack behavior model. This method can effectively improve the accuracy of network attack identification, reduce false alarm rates and missed alarm rates, and provide more reliable technical support for network security protection.

[0005] According to one aspect of the present application, a network attack identification method based on behavior modeling is provided, which includes:

[0006] Extracting a set of network behavior reference data marked as attack behaviors from a backend database, wherein the network behavior reference data includes a time series of network traffic values ​​for a predetermined time period, a system security log for the predetermined time period, and threat intelligence for the predetermined time period;

[0007] Modeling the network attack behavior based on the set of network behavior reference data marked as attack behavior to obtain a set of attack behavior multimodal encoding vectors;

[0008] Acquire network behavior data to be detected, wherein the network behavior data to be detected includes a time series of network traffic values ​​in a predetermined time period, a system security log in the predetermined time period, and threat intelligence in the predetermined time period;

[0009] Encoding the network behavior data to be detected to obtain a network behavior encoding vector to be detected;

[0010] Based on a feature query match between the network behavior encoding vector to be detected and the set of attack behavior multimodal encoding vectors, it is determined whether the network behavior to be detected is an attack behavior.

[0011] Compared to existing technologies, this application provides a network attack identification method based on behavioral modeling. This method uses network traffic data, combined with system security logs and threat intelligence, for data fusion analysis. It then uses deep learning technology to mine attack behavior patterns and construct a network attack behavior model. This method then matches the network behavior data to be detected with the network attack behavior model, enabling rapid detection and identification of network attack behaviors. This method effectively improves the accuracy of network attack identification, reduces false positives and false negatives, and provides more reliable technical support for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other purposes, features, and advantages of the present application will become more apparent through a more detailed description of the embodiments of the present application in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 Flowchart of a network attack identification method based on behavior modeling according to an embodiment of the present application;

[0014] Figure 2 A data flow diagram of a network attack identification method based on behavior modeling according to an embodiment of the present application;

[0015] Figure 3 Flowchart of the training phase of the network attack identification method based on behavior modeling according to an embodiment of the present application;

[0016] Figure 4 Flowchart of sub-step S2 of the network attack identification method based on behavior modeling according to an embodiment of the present application;

[0017] Figure 5 This is a flowchart of sub-step S5 of the network attack identification method based on behavior modeling according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0019] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0020] Although the present application makes various references to certain modules in the system according to embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are illustrative only, and different aspects of the system and method can use different modules.

[0021] Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, the various steps may be processed in reverse order or simultaneously, as needed. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described herein.

[0023] Traditional network attack modeling techniques rely primarily on static rule bases and simple pattern matching methods. These simple rule matching or statistical analysis of network security logs often fails to effectively address complex and ever-changing network attack scenarios, limiting the accuracy and efficiency of attack identification. Therefore, an optimized network attack identification method based on behavioral modeling is desired.

[0024] In the technical solution of the present application, a network attack identification method based on behavior modeling is proposed. Figure 1 The figure is a flowchart of a network attack identification method based on behavior modeling according to an embodiment of the present application. Figure 2 Figure 1 is a data flow diagram of a network attack identification method based on behavior modeling according to an embodiment of the present application. Figure 1 and Figure 2As shown, the network attack identification method based on behavior modeling according to the embodiment of the present application includes the following steps: S1, extracting a set of network behavior reference data marked as attack behaviors from a background database, wherein the network behavior reference data includes a time series of network traffic values ​​in a predetermined time period, a system security log in the predetermined time period, and threat intelligence in the predetermined time period; S2, based on the set of network behavior reference data marked as attack behaviors, modeling the network attack behavior to obtain a set of attack behavior multimodal coding vectors; S3, acquiring the network behavior data to be detected, wherein the network behavior data to be detected includes a time series of network traffic values ​​in a predetermined time period, a system security log in the predetermined time period, and threat intelligence in the predetermined time period; S4, encoding the network behavior data to be detected to obtain a coding vector of the network behavior to be detected; S5, determining whether the network behavior to be detected is an attack behavior based on feature query matching of the coding vector of the network behavior to be detected relative to the set of attack behavior multimodal coding vectors.

[0025] Specifically, S1 extracts a collection of network behavior reference data labeled as attack behaviors from a backend database, wherein the network behavior reference data includes a time series of network traffic values ​​for a predetermined time period, system security logs for the predetermined time period, and threat intelligence for the predetermined time period. It should be understood that by combining information from multiple sources, the characteristic patterns of attack behaviors can be more comprehensively characterized, thereby improving the comprehensiveness and depth of attack behavior identification.

[0026] In particular, the S2, based on the set of network behavior reference data marked as attack behavior, models the network attack behavior to obtain a set of attack behavior multimodal encoding vectors. In particular, in a specific example of the present application, as Figure 4 As shown, the S2 includes: S21, for each network behavior reference data in the set of network behavior reference data marked as attack behavior, feature extraction is performed on the time series of network traffic values ​​in the predetermined time period, the system security log of the predetermined time period and the threat intelligence of the predetermined time period to obtain a network traffic time series associated implicit feature vector, a system security log semantic coding vector and a threat intelligence semantic coding vector; S22, the system security log semantic coding vector and the threat intelligence semantic coding vector are input into a feature vector dynamic interactive fusion module based on gated response to obtain a system security log-threat intelligence semantic fusion representation vector; S23, the system security log-threat intelligence semantic fusion representation vector and the network traffic time series associated implicit feature vector are input into a feature interactive response module based on an adaptive distinguishable mechanism to obtain the attack behavior multimodal coding vector.

[0027] Specifically, the S21, for each network behavior reference data in the set of network behavior reference data marked as attack behavior, performs feature extraction on the time series of network traffic values ​​in the predetermined time period, the system security log of the predetermined time period, and the threat intelligence of the predetermined time period to obtain a network traffic time series associated implicit feature vector, a system security log semantic coding vector, and a threat intelligence semantic coding vector. In an embodiment of the present application, first, the time series of network traffic values ​​in the predetermined time period is input into a sequence encoder based on a Bi-LSTM model to obtain the network traffic time series associated implicit feature vector. Considering that network attacks often lead to abnormal patterns of network traffic data, such as sudden increases in traffic, abnormal data packet sizes, atypical time distributions, etc. Therefore, in order to fully understand the temporal correlation change characteristics of network traffic data, for each network behavior reference data in the set of network behavior reference data marked as attack behavior, a sequence encoder based on the Bi-LSTM model is further used to temporally encode the time series of network traffic values ​​in the predetermined time period. Through the bidirectional memory characteristics of the Bi-LSTM model, the temporal dependency and contextual association in the data are effectively captured, thereby obtaining the network traffic temporal correlation implicit feature vector corresponding to each network behavior reference data, thereby characterizing the potential attack behavior pattern in the traffic data. It is worth mentioning that the bidirectional long short-term memory network (Bi-LSTM) is a commonly used recurrent neural network (RNN) variant for processing sequence data, especially in the field of natural language processing. Bi-LSTM combines LSTM layers in both forward and reverse directions, which can better capture long-distance dependencies in sequence data. At the same time, since system security logs and threat intelligence play a key complementary role in identifying network attack behaviors, in the technical solution of the present application, these unstructured or semi-structured data are further embedded and encoded and contextually understood through a semantic encoder containing a word embedding layer. In a specific embodiment of the present application, a pre-trained word vector model (such as Word2Vec, GloVe, etc.) can be used to initialize the word embedding layer to enhance the semantic understanding of key words in logs and intelligence. Subsequently, the Transformer model is used to perform deep semantic encoding on the vector sequence after word embedding to fully capture the contextual information and semantic dependencies in system security logs and threat intelligence, and generate system security log semantic encoding vectors and threat intelligence semantic encoding vectors.

[0028] Specifically, the S22 inputs the system security log semantic coding vector and the threat intelligence semantic coding vector into a feature vector dynamic interactive fusion module based on gated response to obtain a system security log-threat intelligence semantic fusion representation vector. Considering that the system security log and the threat intelligence respectively record the internal operation status and abnormal events of the system as well as the external security threats and attack modes, the two have different focuses when describing network attack behaviors, and there is often a complementary relationship between the two. Therefore, in the technical solution of the present application, the system security log semantic coding vector and the threat intelligence semantic coding vector are further fused by a feature vector dynamic interactive fusion module based on gated response to achieve a comprehensive understanding of network attack behaviors. Among them, the feature vector dynamic interactive fusion module introduces a gating mechanism to adaptively adjust the feature fusion weights of the system security log and threat intelligence to achieve deep integration and complementary enhancement of information, so as to more accurately reflect the essential characteristics of network attack behaviors and generate a system security log-threat intelligence semantic fusion representation vector.

[0029] In an embodiment of the present application, the system security log semantic coding vector and the threat intelligence semantic coding vector are input into a gated response-based feature vector dynamic interactive fusion module to obtain a system security log-threat intelligence semantic fusion representation vector, including: cascading the system security log semantic coding vector and the threat intelligence semantic coding vector row features to obtain a system security log-threat intelligence semantic joint feature vector; inputting the system security log-threat intelligence semantic joint feature vector into a gated response function to obtain an information fusion response gate; calculating a difference with the information fusion response gate, and using the information fusion response gate and the difference as weights to calculate the position-weighted sum of the system security log semantic coding vector and the threat intelligence semantic coding vector to obtain the system security log-threat intelligence semantic fusion representation vector.

[0030] Among them, the process of inputting the system security log-threat intelligence semantic joint feature vector into the gated response function to obtain the response gate of information fusion includes: using a predetermined weight vector to multiply the system security log-threat intelligence semantic joint feature vector to obtain an information interaction fusion correlation coefficient; adding the information interaction fusion correlation coefficient and a predetermined bias parameter and then activating it through a sigmoid function to obtain the response gate of the information fusion.

[0031] In summary, in the above embodiment, the system security log semantic encoding vector and the threat intelligence semantic encoding vector are input into the gated response-based feature vector dynamic interactive fusion module to obtain the system security log-threat intelligence semantic fusion representation vector, including: fusing the system security log semantic encoding vector and the threat intelligence semantic encoding vector using the following interactive fusion formula to obtain the system security log-threat intelligence semantic fusion representation vector, wherein the interactive fusion formula is;

[0032]

[0033] Wherein, x1 is the semantic encoding vector of the system security log, x2 is the semantic encoding vector of the threat intelligence, [·,·] represents a cascade operation, σ is a sigmoid function, w1 is a predetermined weight vector, b1 is a predetermined bias parameter, is the response gate of information fusion, x a It is the system security log-threat intelligence semantic fusion representation vector.

[0034] Specifically, the S23 inputs the system security log-threat intelligence semantic fusion representation vector and the network traffic time series correlation implicit feature vector into a feature interaction response module based on an adaptive distinguishable mechanism to obtain the attack behavior multimodal encoding vector. It should be understood that the system security log and threat intelligence provide behavioral records of network attacks, while the network traffic data directly reflects the real-time network activity status, and there is a close correlation and response relationship between the two. Based on this, in the technical solution of the present application, the system security log-threat intelligence semantic fusion representation vector and the network traffic time series correlation implicit feature vector are further responded and analyzed by a feature interaction response module based on an adaptive distinguishable mechanism to explore the deep correlation between the two.

[0035] In an embodiment of the present application, the process of inputting the system security log-threat intelligence semantic fusion representation vector and the network traffic time series associated implicit feature vector into a feature interaction response module based on an adaptive distinguishable mechanism to obtain the attack behavior multimodal encoding vector includes: first, calculating the position-by-position response between the system security log-threat intelligence semantic fusion representation vector and the network traffic time series associated implicit feature vector to obtain the attack behavior position-by-position response feature vector; and using a Softmax function to normalize the attack behavior position-by-position response feature vector to obtain a normalized attack behavior position-by-position response feature vector to balance the scale of the feature response; and then, the normalized attack behavior position-by-position response feature vector is converted into a position-by-position response feature vector. The feature vector is input into a learnable gating function to obtain an attack behavior response screening weight mask vector. Specifically, adaptive feature learning is performed on the normalized position-by-position response feature vector using the learnable gating function, and a response screening weight mask is output. The weight distribution is further refined through a masking operation to improve the distinguishability of feature selection. Finally, a position-by-position dot product is calculated between the attack behavior response screening weight mask vector and the normalized attack behavior position-by-position response feature vector to obtain an attack behavior position-by-position distinguishable weight mask vector. Furthermore, a position-by-position dot product is calculated between the attack behavior position-by-position distinguishable weight mask vector and the attack behavior position-by-position response feature vector to obtain the attack behavior multimodal encoding vector. Specifically, through a dot product operation, the original position-by-position response feature vector is weighted position-by-position using the masked position-by-position response weights to obtain the attack behavior multimodal encoding vector, forming a multidimensional feature description of the network attack behavior. This position-by-position weight refinement effectively improves the information screening capability during feature association response analysis, making the multimodal feature representation of the attack behavior more targeted.

[0036] In summary, in the above embodiment, the system security log-threat intelligence semantic fusion representation vector and the network traffic time series correlation implicit feature vector are input into a feature interaction response module based on an adaptive distinguishable mechanism to obtain the attack behavior multimodal encoding vector, including: processing the system security log-threat intelligence semantic fusion representation vector and the network traffic time series correlation implicit feature vector using the following feature interaction response formula to obtain the attack behavior multimodal encoding vector, wherein the feature interaction response formula is:

[0037] x r =x b / x a

[0038] x n =softmax(x r )

[0039]

[0040] x=x r ⊙(v a ⊙x n )

[0041] Among them, x a represents the system security log-threat intelligence semantic fusion representation vector, x b represents the implicit feature vector associated with the network traffic time series, x r represents the position-by-position response feature vector of the attack behavior, softmax is the normalized exponential function, x n represents the normalized attack behavior position-by-position response feature vector, v a represents the attack behavior response screening weight mask vector, exp(·) represents the exponential function operation with e as the base, ⊙ represents the position point multiplication, and x represents the attack behavior multimodal encoding vector.

[0042] It is worth mentioning that in other specific examples of the present application, network attack behaviors can also be modeled based on the set of network behavior reference data labeled as attack behaviors in other ways to obtain a set of multimodal encoding vectors of attack behaviors, for example: inputting the set of network behavior reference data labeled as attack behaviors; extracting features, which may include statistical features, spectral features, time domain features, etc., to capture key information; using deep learning methods such as autoencoders, convolutional neural networks, recurrent neural networks, etc. to learn abstract representations of data; fusing features from different data sources (such as text, images, audio) to construct a multimodal feature vector; to obtain the set of multimodal encoding vectors of attack behaviors.

[0043] Specifically, S3 and S4 acquire the network behavior data to be detected, wherein the network behavior data to be detected includes a time series of network traffic values ​​for a predetermined time period, system security logs for the predetermined time period, and threat intelligence for the predetermined time period. That is, the same processing flow as that for each of the aforementioned network behavior reference data is employed to perform feature extraction and correlation analysis on the time series of network traffic values, system security logs, and threat intelligence in the network behavior data to be detected, thereby generating a coding vector for the network behavior to be detected.

[0044] In particular, the S5 determines whether the network behavior to be detected is an attack behavior based on the feature query matching of the network behavior encoding vector to be detected relative to the set of attack behavior multimodal encoding vectors. In particular, in a specific example of the present application, if Figure 5As shown, the S5 includes: S51, using the coding vector of the network behavior to be detected as a query feature vector, calculating the one-way attention granular scanning interaction matching result of the query feature vector relative to the set of multimodal coding vectors of the attack behavior to obtain a one-way matching result representation vector; S52, inputting the one-way matching result representation vector into a classifier-based network behavior identifier to obtain a recognition result, and the recognition result is used to indicate whether the network behavior to be detected is an attack behavior.

[0045] Specifically, the S51 uses the network behavior coding vector to be detected as a query feature vector, and calculates the one-way attention granular scanning interactive matching result of the query feature vector relative to the set of attack behavior multimodal coding vectors to obtain a one-way matching result representation vector. That is, through the one-way attention granular scanning interactive matching mechanism, the fine-grained correlation between the network behavior coding vector to be detected and the set of attack behavior multimodal coding vectors is deeply analyzed. Specifically, first, based on the feature similarity between the network behavior feature to be detected and each attack behavior feature, an attention weight is generated, and the set of attack behavior multimodal coding vectors is weightedly fused to obtain the most relevant information comprehensive feature representation of the network behavior reference data marked as attack behavior and the network behavior data to be detected. Then, the granular feature difference between the query feature vector and the network behavior coding vector to be detected is calculated by feature difference to reveal the mismatch or difference between the network behavior data to be detected and the network behavior reference data, thereby obtaining a one-way matching result representation vector, which provides a strong basis for further anomaly detection.

[0046] In an embodiment of the present application, the network behavior coding vector to be detected is used as a query feature vector, and a one-way attention granular scanning interaction matching result of the query feature vector relative to the set of attack behavior multimodal coding vectors is calculated to obtain a one-way matching result representation vector, including: calculating the semantic measurement coefficient between the query feature vector and each attack behavior multimodal coding vector in the set of attack behavior multimodal coding vectors to obtain a sequence of one-way matching semantic measurement coefficients; normalizing the sequence of one-way matching semantic measurement coefficients through a softmax function to obtain a sequence of one-way matching semantic measurement weights; using the sequence of one-way matching semantic measurement weights as weights, calculating the weighted sum of the set of attack behavior multimodal coding vectors to obtain an attack behavior feature reshaping representation vector; and calculating the differential feature vector between the query feature vector and the attack behavior feature reshaping representation vector as the one-way matching result representation vector.

[0047] Among them, calculating the semantic metric coefficient between the query feature vector and each attack behavior multimodal coding vector in the set of attack behavior multimodal coding vectors to obtain a sequence of one-way matching semantic metric coefficients includes: calculating the square of each eigenvalue of each attack behavior multimodal coding vector in the set of attack behavior multimodal coding vectors to obtain a set of nonlinear transformation attack behavior multimodal coding vectors; cascading the query feature vector with each nonlinear transformation attack behavior multimodal coding vector in the set of nonlinear transformation attack behavior multimodal coding vectors to obtain a sequence of semantic association feature vectors; using a preset transformation vector to multiply each semantic association feature vector in the sequence of semantic association feature vectors to obtain a sequence of semantic similarities; adding a bias term to each semantic similarity in the sequence of semantic similarities and then passing the result through a sigmoid activation function to obtain a sequence of one-way matching semantic metric coefficients.

[0048] In summary, in the above embodiment, the network behavior encoding vector to be detected is used as a query feature vector, and the one-way attention granular scanning interaction matching result of the query feature vector relative to the set of the attack behavior multimodal encoding vector is calculated to obtain a one-way matching result representation vector, including: processing the query feature vector and the set of the attack behavior multimodal encoding vector using the following one-way interaction matching formula to obtain the one-way matching result representation vector, wherein the one-way interaction matching formula is:

[0049]

[0050] Wherein, c1 represents the query feature vector, x j represents the j-th attack behavior multimodal encoding vector in the set of attack behavior multimodal encoding vectors, [·,·] represents the cascade operation, w2 is the preset transformation vector, b2 is the bias parameter, σ represents the Sigmoid function, r 1j represents the one-way matching semantic metric coefficient between the query feature vector and the j-th attack behavior multimodal encoding vector, m is the number of attack behavior multimodal encoding vectors, exp(·) represents the exponential function operation with e as the base, e 1j represents the one-way matching semantic metric weight between the query feature vector and the j-th attack behavior multimodal encoding vector, x 1p Represents the attack behavior feature reshape representation vector, Indicates positional subtraction, x m The one-way matching result represents a vector.

[0051] Specifically, in S52, the one-way matching result representation vector is input into a classifier-based network behavior identifier to obtain a recognition result, which is used to indicate whether the network behavior to be detected is an attack. In other words, in the technical solution of this application, the powerful classification capabilities of the classifier are utilized to perform feature pattern recognition and classification judgment on the one-way matching result representation vector, thereby identifying whether the network behavior to be detected is a network attack, thereby quickly understanding the network security situation and taking timely countermeasures.

[0052] It is worth mentioning that in other specific examples of the present application, it is also possible to determine whether the network behavior to be detected is an attack behavior based on the feature query matching of the network behavior coding vector to be detected relative to the set of attack behavior multimodal coding vectors in other ways, for example: input the network behavior coding vector to be detected; use an appropriate similarity measurement method (such as cosine similarity, Euclidean distance, etc.) to calculate the similarity between the network behavior coding vector to be detected and each attack behavior multimodal coding vector; compare the network behavior coding vector to be detected with each coding vector in the set of attack behavior multimodal coding vectors; set a similarity threshold to determine whether the network behavior to be detected matches the attack behavior; if the similarity between the network behavior coding vector to be detected and any attack behavior multimodal coding vector exceeds the set threshold, it is determined to be an attack behavior; otherwise, it is determined to be a normal behavior.

[0053] It should be understood that before using the above-mentioned neural network model for inference, it is necessary to train the sequence encoder based on the Bi-LSTM model, the semantic encoder including the word embedding layer, the feature vector dynamic interaction fusion module based on the gated response, the feature interaction response module based on the adaptive distinguishable mechanism, and the network behavior identifier based on the classifier. That is to say, in the network attack identification method based on behavior modeling of the present application, it also includes a training phase for training the sequence encoder based on the Bi-LSTM model, the semantic encoder including the word embedding layer, the feature vector dynamic interaction fusion module based on the gated response, the feature interaction response module based on the adaptive distinguishable mechanism, and the network behavior identifier based on the classifier.

[0054] Figure 3 FIG. 1 is a flow chart of the training phase of the network attack identification method based on behavior modeling according to an embodiment of the present application. Figure 3As shown, the network attack identification method based on behavior modeling according to the embodiment of the present application includes: a training stage, including: S110, obtaining training data, the training data including a set of training network behavior reference data marked as attack behavior, training network behavior data to be detected, and training a true value of whether the network behavior to be detected is an attack behavior, wherein the training network behavior reference data includes a time series of training network traffic values ​​in a predetermined time period, a training system security log in the predetermined time period, and training threat intelligence in the predetermined time period, the training network behavior data to be detected includes a time series of training network traffic values ​​in a predetermined time period, a training system security log in the predetermined time period, and training threat intelligence in the predetermined time period. threat intelligence; S120, for each training network behavior reference data in the set of training network behavior reference data marked as attack behavior, the time series of the training network traffic value of the predetermined time period is input into the sequence encoder based on the Bi-LSTM model to obtain the training network traffic time series associated implicit feature vector, the training system security log of the predetermined time period and the training threat intelligence of the predetermined time period are input into the semantic encoder including the word embedding layer to obtain the training system security log semantic encoding vector and the training threat intelligence semantic encoding vector; S130, the training system security log semantic encoding vector and the training threat intelligence semantic encoding vector are input into the feature vector dynamic interaction based on the gated response Fusion module to obtain the training system security log-threat intelligence semantic fusion representation vector; S140, respectively input the training system security log-threat intelligence semantic fusion representation vector of each training network behavior reference data and the training network traffic time series associated implicit feature vector into the feature interaction response module based on the adaptive distinguishable mechanism to obtain a set of training attack behavior multimodal encoding vectors; S150, encode the training network behavior data to be detected to obtain the training network behavior encoding vector to be detected; S160, use the training network behavior encoding vector to be detected as the training query feature vector, calculate the unidirectional attention granularity of the training query feature vector relative to the set of training attack behavior multimodal encoding vectors Scan the interactive matching results to obtain a training one-way matching result representation vector; S170, input the training one-way matching result representation vector into the classifier-based network behavior identifier to obtain a classification loss function value; S180, calculate the one-way matching result loss function value of the training one-way matching result representation vector; S190, use the weighted sum of the one-way matching result loss function value and the classification loss function value as the loss function value to train the sequence encoder based on the Bi-LSTM model, the semantic encoder including the word embedding layer, the feature vector dynamic interaction fusion module based on the gated response, the feature interaction response module based on the adaptive distinguishable mechanism and the classifier-based network behavior identifier.

[0055] In particular, in a preferred example, the set of the training network behavior coding vector to be detected and the set of the training attack behavior multimodal coding vector respectively express the encoded multimodal fusion semantic features of the training network behavior data to be detected and the set of network behavior reference data labeled as attack behavior. Thus, after using the training network behavior coding vector to be detected as the query feature vector and calculating the one-way attention granularity scanning interaction matching result of the query feature vector relative to the set of the training attack behavior multimodal coding vector, the obtained training one-way matching result representation vector will also lead to differences in the one-way attention weights of the interactive scanning matching due to the differences in the distribution of the encoded multimodal fusion semantic features based on the multimodal semantic differences of the source domain, thereby having classification regression recognition difficulties attributed to complex semantic interaction matching, thereby affecting the classification training efficiency.

[0056] Therefore, the applicant of the present application further introduces a predetermined loss function other than the classification loss function value during the model training process. That is, training the model through gradient back propagation based on the loss function includes the following steps:

[0057] Calculate a first one-way matching result weight matrix and a second one-way matching result weight matrix based on the training one-way matching result representation vector, wherein the eigenvalue at the (i, j)th position of the first one-way matching result weight matrix is ​​the average of the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result representation vector, and the eigenvalue at the (i, j)th position of the second one-way matching result weight matrix is ​​half of the absolute value of the difference between the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result representation vector;

[0058] Performing query matrix multiplication on the training one-way matching result representation vector with the first one-way matching result weight matrix and the second one-way matching result weight matrix respectively to obtain a first one-way matching result intermediate vector and a second one-way matching result intermediate vector;

[0059] Calculating the vector inner product of the first one-way matching result intermediate vector and the second one-way matching result intermediate vector to obtain a first one-way matching result loss term;

[0060] Performing matrix multiplication on the first one-way matching result weight matrix and the second one-way matching result weight matrix, and calculating the Frobenius norm of the result matrix to obtain a second one-way matching result loss term;

[0061] Subtracting the product of a predetermined weight hyperparameter and the second one-way matching result loss term from the first one-way matching result loss term to obtain a one-way matching result loss function value; and

[0062] Based on the weighted sum of the one-way matching result loss function value and the classification loss function value, the model parameters are optimized through gradient back propagation.

[0063] The one-way matching result loss function value is specifically expressed as:

[0064]

[0065] M μ (i,j)=v i +v j / 2

[0066] M σ (i,j)=|v i -v j | / 2

[0067] Wherein, V represents the training one-way matching result representation vector, v i Indicates the i-th eigenvalue of the training one-way matching result vector, v j Indicates the j-th eigenvalue of the training one-way matching result representation vector, M μ is the first one-way matching result weight matrix, M μ (i, j) represents the mean of the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result representation vector, M σ is the second one-way matching result weight matrix, M σ (i, j) represents half of the absolute value of the difference between the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result vector. represents the matrix multiplication operation, α is a predetermined weight hyperparameter, ||·|| F represents the Frobenius norm of the matrix, and Loss represents the loss function value of the one-way matching result.

[0068] That is, in the above preferred example, the one-way matching result loss function value is used to perform query composition of the detail inner product space within the training one-way matching result representation vector through the structured feature representation of the short-range-long-range cross-scale detail links of the training one-way matching result representation vector, so as to approximate the low-rank independent observable composition of the link detail composition provided by the structured detail interaction of the training one-way matching result representation vector. In this way, by training with the one-way matching result loss function value, the distributed detail group of the training one-way matching result representation vector can be used to perform detail group decomposition based on detail complexity, so as to promote the classification regression decomposition and recognition of the complex feature structure of the training one-way matching result representation vector, and improve the classification training efficiency.

[0069] In summary, the wind and solar power generation energy storage management method according to the embodiment of the present application is explained, which collects the energy storage parameters of the stored batteries during the energy storage process, and uses a deep neural network model as a feature extractor to capture various energy storage parameters and high-dimensional implicit features between various energy storage parameters, and performs decoding regression through a decoder to obtain a more accurate SOC measurement value.

[0070] While various embodiments of the present disclosure have been described above, the above descriptions are illustrative, non-exhaustive, and not intended to be limiting of the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to existing technologies, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A network attack identification method based on behavior modeling, characterized in that: include: Extracting a set of network behavior reference data marked as attack behaviors from a backend database, wherein the network behavior reference data includes a time series of network traffic values ​​for a predetermined time period, a system security log for the predetermined time period, and threat intelligence for the predetermined time period; Modeling the network attack behavior based on the set of network behavior reference data marked as attack behavior to obtain a set of attack behavior multimodal encoding vectors; Acquire network behavior data to be detected, wherein the network behavior data to be detected includes a time series of network traffic values ​​in a predetermined time period, a system security log in the predetermined time period, and threat intelligence in the predetermined time period; Encoding the network behavior data to be detected to obtain a network behavior encoding vector to be detected; Determining whether the network behavior to be detected is an attack behavior based on a feature query match between the network behavior encoding vector to be detected and the set of attack behavior multimodal encoding vectors; Based on the set of network behavior reference data marked as attack behaviors, modeling the network attack behaviors to obtain a set of attack behavior multimodal encoding vectors, including: For each network behavior reference data in the set of network behavior reference data marked as attack behavior, feature extraction is performed on the time series of network traffic values ​​in the predetermined time period, the system security log in the predetermined time period, and the threat intelligence in the predetermined time period to obtain a network traffic time series correlation implicit feature vector, a system security log semantic encoding vector, and a threat intelligence semantic encoding vector; Cascading the system security log semantic encoding vector and the threat intelligence semantic encoding vector to obtain a system security log-threat intelligence semantic joint feature vector; Inputting the system security log-threat intelligence semantic joint feature vector into a gated response function to obtain an information fusion response gate; Calculating a difference between the response gate and the information fusion, and using the response gate of the information fusion and the difference as weights to calculate a position-weighted sum of the system security log semantic encoding vector and the threat intelligence semantic encoding vector to obtain the system security log-threat intelligence semantic fusion representation vector; Calculating a position-by-position response between the system security log-threat intelligence semantic fusion representation vector and the network traffic time series correlation implicit feature vector to obtain an attack behavior position-by-position response feature vector; Normalizing the attack behavior position-by-position response feature vector using a Softmax function to obtain a normalized attack behavior position-by-position response feature vector; Inputting the normalized attack behavior position-by-position response feature vector into a learnable gating function to obtain an attack behavior response screening weight mask vector; Calculating the position-wise multiplication of the attack behavior response screening weight mask vector and the normalized attack behavior position-wise response feature vector to obtain an attack behavior position-wise response distinguishable weight mask vector; The position-by-position dot product between the distinguishable weight mask vector of the attack behavior position-by-position response and the attack behavior position-by-position response feature vector is calculated to obtain the attack behavior multimodal encoding vector, wherein the normalized position-by-position response feature vector is adaptively learned through a learnable gating function and a response screening weight mask is output, the weight distribution is further refined through the mask operation to improve the distinguishability of feature selection, and the original position-by-position response feature vector is weighted position-by-position using the masked position-by-position response weight through a dot multiplication operation to obtain the attack behavior multimodal encoding vector, which constitutes a multidimensional feature description of the network attack behavior.

2. The network attack identification method based on behavior modeling according to claim 1 is characterized in that: Feature extraction is performed on the time series of network traffic values ​​in the predetermined time period, the system security log in the predetermined time period, and the threat intelligence in the predetermined time period to obtain a network traffic time series associated implicit feature vector, a system security log semantic encoding vector, and a threat intelligence semantic encoding vector, including: Inputting the time series of the network traffic value of the predetermined time period into a sequence encoder based on a Bi-LSTM model to obtain the network traffic time series associated implicit feature vector; The system security log of the predetermined time period and the threat intelligence of the predetermined time period are input into a semantic encoder including a word embedding layer to obtain the system security log semantic encoding vector and the threat intelligence semantic encoding vector.

3. The network attack identification method based on behavior modeling according to claim 2 is characterized in that: Inputting the system security log-threat intelligence semantic joint feature vector into the gate response function to obtain an information fusion response gate, including: Multiplying the system security log-threat intelligence semantic joint feature vector by a predetermined weight vector to obtain an information interaction fusion correlation coefficient; The information interaction fusion correlation coefficient and the predetermined bias parameter are added together and then activated by a sigmoid function to obtain a response gate for the information fusion.

4. The network attack identification method based on behavior modeling according to claim 3 is characterized in that: Determining whether the network behavior to be detected is an attack behavior based on a feature query match between the network behavior encoding vector to be detected and the set of attack behavior multimodal encoding vectors includes: Using the network behavior encoding vector to be detected as a query feature vector, calculating a one-way attention granularity scanning interactive matching result of the query feature vector relative to the set of attack behavior multimodal encoding vectors to obtain a one-way matching result representation vector; The one-way matching result representation vector is input into a classifier-based network behavior identifier to obtain a recognition result, and the recognition result is used to indicate whether the network behavior to be detected is an attack behavior.

5. The network attack identification method based on behavior modeling according to claim 4 is characterized in that: The method comprises: using the network behavior encoding vector to be detected as a query feature vector, calculating a one-way attention granularity scanning interactive matching result of the query feature vector relative to the set of attack behavior multimodal encoding vectors to obtain a one-way matching result representation vector, including: Calculating semantic metric coefficients between the query feature vector and each attack behavior multimodal encoding vector in the set of attack behavior multimodal encoding vectors to obtain a sequence of one-way matching semantic metric coefficients; Normalizing the sequence of one-way matching semantic metric coefficients through a softmax function to obtain a sequence of one-way matching semantic metric weights; Using the sequence of the one-way matching semantic measurement weights as weights, calculating the weighted sum of the set of attack behavior multimodal encoding vectors to obtain an attack behavior feature reshaping representation vector; A differential feature vector between the query feature vector and the attack behavior feature reshaping representation vector is calculated as the one-way matching result representation vector.

6. The network attack identification method based on behavior modeling according to claim 5 is characterized in that: Calculating semantic metric coefficients between the query feature vector and each attack behavior multimodal encoding vector in the set of attack behavior multimodal encoding vectors to obtain a sequence of one-way matching semantic metric coefficients includes: Calculating the square of each eigenvalue of each attack behavior multimodal coding vector in the set of attack behavior multimodal coding vectors to obtain a set of nonlinearly transformed attack behavior multimodal coding vectors; Concatenating the query feature vector with each nonlinear transformation attack behavior multimodal encoding vector in the set of nonlinear transformation attack behavior multimodal encoding vectors to obtain a sequence of semantic association feature vectors; Multiplying each semantic association feature vector in the sequence of semantic association feature vectors by a preset transformation vector to obtain a sequence of semantic similarities; Each semantic similarity in the sequence of semantic similarities is added with a bias term and then passed through a sigmoid activation function to obtain a sequence of one-way matching semantic measurement coefficients.

7. The network attack identification method based on behavior modeling according to claim 6 is characterized in that: The method further includes a training step of: training the sequence encoder based on the Bi-LSTM model, the semantic encoder including the word embedding layer, the feature vector dynamic interaction fusion module based on the gated response, the feature interaction response module based on the adaptive distinguishable mechanism, and the network behavior identifier based on the classifier; The training step includes: Acquire training data, the training data including a set of training network behavior reference data marked as attack behaviors, training network behavior data to be detected, and a true value of whether the training network behavior to be detected is an attack behavior, wherein the training network behavior reference data includes a time series of training network traffic values ​​for a predetermined time period, a training system security log for the predetermined time period, and training threat intelligence for the predetermined time period, and the training network behavior data to be detected includes a time series of training network traffic values ​​for a predetermined time period, a training system security log for the predetermined time period, and training threat intelligence for the predetermined time period; For each training network behavior reference data in the set of training network behavior reference data marked as attack behavior, inputting the time series of the training network traffic value of the predetermined time period into the sequence encoder based on the Bi-LSTM model to obtain a training network traffic time series associated implicit feature vector, and inputting the training system security log of the predetermined time period and the training threat intelligence of the predetermined time period into the semantic encoder including the word embedding layer to obtain a training system security log semantic encoding vector and a training threat intelligence semantic encoding vector; Inputting the training system security log semantic encoding vector and the training threat intelligence semantic encoding vector into the gated response-based feature vector dynamic interactive fusion module to obtain a training system security log-threat intelligence semantic fusion representation vector; Inputting the training system security log-threat intelligence semantic fusion representation vector of each training network behavior reference data and the training network traffic time series correlation implicit feature vector into the feature interaction response module based on the adaptive distinguishable mechanism to obtain a set of training attack behavior multimodal encoding vectors; Encoding the training network behavior data to be detected to obtain a training network behavior encoding vector; Using the training to-be-detected network behavior encoding vector as a training query feature vector, calculating a one-way attention granularity scanning interactive matching result of the training query feature vector relative to the set of training attack behavior multimodal encoding vectors to obtain a training one-way matching result representation vector; Inputting the training one-way matching result representation vector into the classifier-based network behavior identifier to obtain a classification loss function value; Calculating a one-way matching result loss function value of the training one-way matching result representation vector; The weighted sum of the one-way matching result loss function value and the classification loss function value is used as the loss function value to train the sequence encoder based on the Bi-LSTM model, the semantic encoder including the word embedding layer, the feature vector dynamic interaction fusion module based on the gated response, the feature interaction response module based on the adaptive distinguishable mechanism, and the network behavior identifier based on the classifier; During the model training process, the model is trained through gradient backpropagation based on the loss function, which includes the following steps: Calculate a first one-way matching result weight matrix and a second one-way matching result weight matrix based on the training one-way matching result representation vector, wherein the eigenvalue at the (i, j)th position of the first one-way matching result weight matrix is ​​the average of the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result representation vector, and the eigenvalue at the (i, j)th position of the second one-way matching result weight matrix is ​​half of the absolute value of the difference between the i-th eigenvalue and the j-th eigenvalue of the training one-way matching result representation vector; Performing query matrix multiplication on the training one-way matching result representation vector with the first one-way matching result weight matrix and the second one-way matching result weight matrix respectively to obtain a first one-way matching result intermediate vector and a second one-way matching result intermediate vector; Calculating the vector inner product of the first one-way matching result intermediate vector and the second one-way matching result intermediate vector to obtain a first one-way matching result loss term; Performing matrix multiplication on the first one-way matching result weight matrix and the second one-way matching result weight matrix, and calculating the Frobenius norm of the result matrix to obtain a second one-way matching result loss term; Subtracting the product of a predetermined weight hyperparameter and the second one-way matching result loss term from the first one-way matching result loss term to obtain a one-way matching result loss function value; and Based on the weighted sum of the one-way matching result loss function value and the classification loss function value, the model parameters are optimized through gradient back propagation.

Images