Adaptive intrusion detection system and method based on deep learning

Abstract

The present invention discloses an adaptive intrusion detection system and method based on deep learning, which belongs to the field of deep learning technology. The system includes: a network node identification module for identifying network nodes; a sample input module for inputting historical intrusion event samples; an intrusion transfer analysis module for outputting transfer network nodes and preset transfer probabilities; a model construction module for building an intrusion transfer detection model; a network identification module for identifying network status data and system status data; an intrusion risk indicator acquisition module for acquiring intrusion risk indicators; and an intrusion reminder module for making reminders. This application solves the technical problem that traditional intrusion detection systems are difficult to effectively identify and respond to intrusion anomalies that are transferred through node connection relationships, resulting in difficulty in controlling stable network operation, and achieves the effect of identifying transfer networks, conducting targeted intrusion risk detection, and improving the accuracy of intrusion detection and the stability of the network.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an adaptive intrusion detection system and method based on deep learning. Background Art

[0002] With the rapid development of information technology, the network has become an indispensable infrastructure in modern society. However, network security issues have also arisen, bringing huge risks and challenges to individuals and enterprises. Traditional intrusion detection systems (IDS) usually perform anomaly detection based on fixed rules and features, but their detection accuracy and efficiency are often unsatisfactory when faced with complex and changeable network environments and attack patterns. In the current network environment, intrusion anomalies are not limited to a single node or device, they often transfer and spread through the connection relationship between nodes. This transfer may involve multiple network nodes, causing the impact range of the intrusion to expand rapidly, posing a serious threat to the stable operation of the entire network. Therefore, how to effectively identify and respond to such intrusion anomalies that are transferred through node connection relationships has become an urgent problem to be solved in the field of network security. Summary of the invention

[0003] The present application provides an adaptive intrusion detection system and method based on deep learning, aiming to solve the technical problem that traditional intrusion detection systems are difficult to effectively identify and respond to intrusion anomalies that are transferred through node connection relationships, resulting in difficulty in controlling the stable operation of the network. The application achieves the effect of identifying the transfer network, conducting targeted intrusion risk detection, and improving the accuracy of intrusion detection and the stability of the network.

[0004] In view of the above problems, the present application provides an adaptive intrusion detection system and method based on deep learning.

[0005] The first aspect disclosed in the present application provides an adaptive intrusion detection system based on deep learning, which includes: a network node identification module, which is used to identify multiple network nodes of a target network, wherein each network node corresponds to a network device; a sample entry module, which is used to enter historical intrusion event samples of the target network; an intrusion transfer analysis module, which is used to perform intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a model construction module, which is used to construct an intrusion transfer detection model according to the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a network identification module, which is used to identify the network status data and the system status data of the target network; an intrusion risk indicator acquisition module, which is used to input the network status data and the system status data into the intrusion transfer detection model, and obtain the intrusion risk indicator according to the intrusion transfer detection model; an intrusion reminder module, which is used to generate an intrusion detection report based on the intrusion risk indicator and send it to the gateway for reminder.

[0006] Another aspect disclosed in the present application provides an adaptive intrusion detection method based on deep learning, which includes: identifying multiple network nodes of the target network, wherein each network node corresponds to a network device; entering historical intrusion event samples of the target network; performing intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and outputting the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; constructing an intrusion transfer detection model according to the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; identifying network status data and system status data of the target network; inputting the network status data and the system status data into the intrusion transfer detection model, and obtaining an intrusion risk indicator according to the intrusion transfer detection model; generating an intrusion detection report based on the intrusion risk indicator and sending it to the gateway for reminder.

[0007] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0008] The invention adopts a network node identification module to identify multiple network nodes of the target network, wherein each network node corresponds to a network device; a sample entry module to enter the historical intrusion event samples of the target network; an intrusion transfer analysis module to analyze the intrusion transfer of the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a model construction module to construct an intrusion transfer detection model according to the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a network identification module to identify the network status data and system status data of the target network; an intrusion risk index acquisition module to input the network status data and the system status data into the intrusion transfer detection model, and obtain the intrusion risk index according to the intrusion transfer detection model; an intrusion reminder module to generate an intrusion detection report based on the intrusion risk index and send it to the gateway for reminder. The invention solves the technical problem that the traditional intrusion detection system is difficult to effectively identify and respond to the intrusion anomaly transferred through the node connection relationship, which makes it difficult to control the stable operation of the network, and achieves the effect of identifying the transfer network, carrying out targeted intrusion risk detection, improving the accuracy of intrusion detection and the stability of the network.

[0009] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A structural schematic diagram of an adaptive intrusion detection system based on deep learning is provided for an embodiment of the present application;

[0011] Figure 2 A flowchart of an adaptive intrusion detection method based on deep learning is provided for an embodiment of the present application.

[0012] Explanation of the reference numerals: network node identification module 11 , sample entry module 12 , intrusion transfer analysis module 13 , model building module 14 , network identification module 15 , intrusion risk indicator acquisition module 16 , intrusion reminder module 17 . DETAILED DESCRIPTION

[0013] The present application provides an adaptive intrusion detection system and method based on deep learning, which solves the technical problem that traditional intrusion detection systems are difficult to effectively identify and respond to intrusion anomalies that are transferred through node connection relationships, resulting in difficulty in controlling the stable operation of the network. The application achieves the effect of identifying the transfer network, conducting targeted intrusion risk detection, and improving the accuracy of intrusion detection and the stability of the network.

[0014] Below, the technical solutions in the present application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments of the present application. It should be understood that the present application is not limited to the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. It should also be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, rather than all of them.

[0015] Embodiment 1, as Figure 1 As shown, the embodiment of the present application provides an adaptive intrusion detection system based on deep learning, the system comprising:

[0016] The network node identification module 11 is used to identify multiple network nodes of the target network, wherein each network node corresponds to a network device.

[0017] Specifically, in the network node identification module 11, the system terminal identifies multiple network nodes of the target network, which is essentially to locate and identify all basic components in a target network. In the network architecture, these network nodes represent various network devices, such as routers, switches, servers, workstations, etc.

[0018] The sample input module 12 is used to input historical intrusion event samples of the target network.

[0019] Specifically, in the sample entry module 12, the system terminal obtains historical intrusion event samples of the target network and enters these historical intrusion event samples into the storage space. These historical intrusion event samples contain relevant information of various network intrusion events that occurred in the past, such as the attacker's behavior pattern, attack time, attack target, attack method, etc. By collecting and entering these historical intrusion event samples, it is helpful to understand the potential risks faced by the network and provide data support for subsequent intrusion detection and analysis.

[0020] The intrusion transfer analysis module 13 is used to perform intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node.

[0021] Specifically, in the intrusion transfer analysis module 13, the system terminal performs intrusion transfer analysis on historical intrusion event samples according to the connection relationship of multiple network nodes, which is a key step in deeply analyzing and understanding the dynamic process of network intrusion. The system terminal determines which nodes have been attacked in the past by analyzing the structure of the network and the historical data of intrusion events, and then analyzes how these attacks are propagated to other nodes through the connection relationship of the network. Through this analysis, the system terminal can output other nodes that each network node may transfer to when attacked, that is, transfer network nodes, and the preset transfer probabilities of these transfers. These probabilities are based on the statistical results of historical data and represent the probability of transfer from one node to another.

[0022] Further, performing intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes includes:

[0023] According to the historical intrusion event samples, intrusion path samples are extracted; the transfer between each intrusion path sample and the network node is identified, and the number of transfers of each network node and the number of times each node transfers to other nodes are counted; the transfer probability of each network node is calculated according to the counted number of transfers, and for each network node, the network node with a probability greater than the expected probability is identified as the corresponding transfer network node, and the transfer probability of each transfer network node is obtained as the preset transfer probability.

[0024] In a preferred embodiment, the system terminal extracts intrusion path samples from historical intrusion event samples. These path samples record in detail how the corresponding intrusion event attacks through a series of nodes in the network. Subsequently, the transfer relationship between each intrusion path sample and the network node is identified. During the identification process, the system terminal will check each intrusion event to determine the starting node, nodes along the way and destination node of the intrusion. At the same time, the number of times each network node is transferred during the intrusion process and the number of times each node is transferred to other nodes are counted. After that, based on these statistical transfer times, the system starts to calculate the transfer probability of each network node. This probability represents the possibility that when an intrusion event reaches a certain node, it will continue to transfer to other nodes. This probability is calculated by dividing the number of times a node is transferred to a specific node by the total number of transfers of the node. Then, for each network node, the system terminal identifies the network node with a transfer probability greater than the expected probability as the corresponding transfer network node. These transfer network nodes are considered to be the nodes most likely to be visited during the intrusion process. The expected probability is set based on historical data, business requirements and expert advice, and is used to determine whether the possibility of a certain network node being transferred during the intrusion process is significant. The system terminal also obtains the transition probability corresponding to each transfer network node and stores it as a preset transition probability. These preset transition probabilities are used in the subsequent construction of the intrusion transfer detection model to improve the accuracy and efficiency of the intrusion transfer detection model.

[0025] The model building module 14 is used to build an intrusion transfer detection model according to the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node.

[0026] Specifically, in the model building module 14, after obtaining the transfer network node and the preset transfer probability corresponding to each network node, the system terminal uses these data to build an intrusion transfer detection model. This model is designed to monitor network traffic in real time, calculate and output intrusion risk indicators based on the network status and system status, help the system terminal better understand the vulnerabilities and potential risks in the network, and provide strong support for generating more comprehensive intrusion detection reports.

[0027] Furthermore, an intrusion transfer detection model is constructed, including:

[0028] Initialize the model parameters of the hidden Markov model according to the transfer network nodes corresponding to each network node and the preset transfer probability of each transfer network node; calculate the initialized hidden Markov model based on the forward algorithm to obtain the forward probability sample; calculate the initialized hidden Markov model based on the backward algorithm to obtain the backward probability sample; iteratively update the model parameters of the initialized hidden Markov model according to the forward probability sample and the backward probability sample until the model converges to output the intrusion transfer detection model.

[0029] In a preferred embodiment, in the process of constructing the intrusion transfer detection model, the system terminal uses the Hidden Markov Model (HMM) to capture the transition probability between network nodes and predict potential intrusion behaviors accordingly. First, the system terminal initializes the model parameters of the hidden Markov model according to the transfer network nodes corresponding to each network node in the historical intrusion event sample and the preset transfer probabilities of these transfer network nodes. These parameters include the state transition probability matrix, the output probability matrix and the initial state probability distribution. Among them, the state transition probability matrix represents the probability of transferring from one node to another. The output probability matrix describes the probability of the observation value generated by each node. The initial state probability distribution describes the probability of each node at the beginning of the intrusion behavior. Subsequently, the system terminal inputs the historical network state data and the historical system state data in the historical intrusion event sample into the initialized hidden Markov model, and organizes the historical network state data and the historical system state data into an observation sequence. Afterwards, the probability of the hidden Markov model generating the sequence under the observation sequence and the initialized model parameters is calculated by the forward algorithm, that is, the forward probability. The forward algorithm starts from the initial state and gradually calculates the probability of being in each state at each moment until the end of the observation sequence. These calculated probability values ​​constitute the forward probability samples. The backward algorithm calculates the probability of the hidden state sequence at all moments under the conditions of the given moment and observation sequence. The backward algorithm starts from the last moment of the observation sequence and reversely calculates the state probability before each moment. These calculated probability values ​​constitute the backward probability samples. Then, the model parameters of the hidden Markov model are iteratively updated using the forward probability samples and the backward probability samples combined with the Baum-Welch algorithm. The Baum-Welch algorithm is an expectation maximization algorithm that updates the model parameters by maximizing the likelihood function of the observation sequence. In each iteration, the Baum-Welch algorithm re-estimates the state transition probability and the initial state probability based on the forward probability and the backward probability so that the hidden Markov model can better fit the observed data. During the iteration process, when the number of iterations reaches the iteration threshold, the system terminal considers that the hidden Markov model has converged, and the iterative update process stops at this time, and the final intrusion transfer detection model is output. This model is used to predict potential intrusion behaviors in new state data and output corresponding intrusion risk indicators.

[0030] Furthermore, the model parameters of the intrusion transfer detection model are memorized and updated, including:

[0031] A long short-term memory network is set; the long short-term memory network is embedded in the intrusion transfer detection model, and when a preset period is met, the model parameters of the intrusion transfer detection model are memorized and updated.

[0032] In a feasible implementation, in order to enable the intrusion transfer detection model to accurately perform intrusion transfer detection in the future. The system terminal sets a long short-term memory network (LSTM) to memorize and update the parameters of the intrusion transfer detection model. The long short-term memory network is a special recurrent neural network (RNN) that can learn and memorize long-term dependencies in sequence data, and is used to capture time dependencies and pattern changes in network traffic data, which may indicate potential security threats. The system terminal sets the network structure of the long short-term memory network according to actual needs and data characteristics, including determining the number of hidden layers, the number of neurons in each layer, etc., and then initializes the weights and biases of the long short-term memory network. Subsequently, the long short-term memory network is trained according to the historical network state data and the historical system state data, and the output and loss of the long short-term memory network are calculated by forward propagation. Back propagation and Adam are used to update the parameters of the long short-term memory network. The training process is repeated until the preset maximum number of training rounds is reached. Then the trained long short-term memory network is evaluated using the historical network state data and the historical system state data that are not used to train. If the evaluation result meets expectations, the long short-term memory network is output, otherwise, the structure is adjusted and retrained. Afterwards, the trained long short-term memory network is embedded into the intrusion transfer detection model to extract features from the input network status data and system status data. When the preset period is reached, the system terminal uses the status data generated within a preset period to train the current long short-term memory network and hidden Markov model, that is, memory update, to optimize the performance of the intrusion transfer detection model so that it can better adapt to the current security environment.

[0033] The network identification module 15 is used to identify the network status data and system status data of the target network.

[0034] Specifically, in the network identification module 15, the system terminal identifies the target network and extracts the current network status data and system status data. The network status data refers to various information about the current operation and performance of the network, including flow data, flow data, routing information, etc. The system status data refers to the operating status of each system component in the target network, including the status information of network devices such as servers, routers, switches, and the status information of software systems such as operating systems, databases, and applications.

[0035] The intrusion risk index acquisition module 16 is used to input the network status data and the system status data into the intrusion transfer detection model, and acquire the intrusion risk index according to the intrusion transfer detection model.

[0036] Specifically, in the intrusion risk index acquisition module 16, the system terminal inputs the obtained network status data and the system status data into the pre-built intrusion risk assessment model to obtain abnormal network nodes. Subsequently, the obtained abnormal network nodes are input into the intrusion transfer detection model, that is, the network status data and system status data corresponding to the abnormal network nodes are input. Once the data is input into the intrusion transfer detection model, the intrusion transfer detection model will analyze and process the data, and generate an intrusion risk index based on the learned knowledge, which is used to quantify the degree of security risk faced by the network.

[0037] Further, inputting the network status data and the system status data into the intrusion transfer detection model includes:

[0038] Construct an intrusion risk assessment model and connect the intrusion risk assessment model with the intrusion transfer detection model; identify anomalies of the network status data and the system status data according to the intrusion risk assessment model to obtain abnormal network nodes; send the abnormal network nodes to the intrusion transfer detection model to obtain the intrusion transfer indicators of the abnormal network nodes.

[0039] In a preferred embodiment, the system terminal obtains an intrusion risk assessment model in advance based on historical intrusion event samples. The goal of this intrusion risk assessment model is to conduct a comprehensive security assessment of the network and identify potential threats and risks that may exist. Subsequently, the system terminal connects the intrusion risk assessment model with the intrusion transfer detection model, that is, the output layer of the intrusion risk assessment model is connected to the input layer of the intrusion transfer detection model. After that, the intrusion risk assessment model is used to identify abnormalities in the network status data and the system status data, find abnormal behaviors or data that do not conform to the normal mode, and generate abnormal network nodes. These abnormal network nodes represent potential network attacks or security vulnerabilities. Then, the system terminal sends these node information to the intrusion transfer detection model through the established connection relationship. The intrusion transfer detection model generates intrusion transfer indicators about abnormal network nodes based on the learned knowledge. These indicators include the type, intensity, duration, and transfer path of the intrusion behavior.

[0040] Furthermore, an intrusion risk assessment model is constructed, including:

[0041] According to the historical intrusion event samples, intrusion feature samples are identified, wherein the intrusion feature samples include network traffic features, IP and domain name features, protocol and port features, content features, behavior features and timing features; according to the intrusion feature samples and identification information identifying intrusion risks, the intrusion risk assessment model is trained.

[0042] In a feasible implementation, in order to build an efficient intrusion risk assessment model, the system terminal extracts and identifies key intrusion feature samples from historical intrusion event samples. These feature samples cover multiple aspects, including network traffic features, IP and domain name features, protocol and port features, content features, behavior features, and timing features. Among them, network traffic features refer to the characteristics of data in network transmission, such as traffic size, speed, frequency, etc. These features can help identify abnormal traffic patterns. IP and domain name features are key elements in network communication. Analyzing these features can reveal potential sources or targets of attacks. Protocol and port features describe the purpose and security of different network protocols and ports. By analyzing these features, possible malicious activities can be discovered. Content features include the content in data packets, text in log files, etc. These features may contain traces or sensitive information left by attackers. Behavioral features refer to the behavior patterns of network entities. Abnormal behavior may be a precursor to attacks. Timing features refer to the frequency and duration of attacks, etc., which help identify abnormal patterns in time series. After obtaining these intrusion feature samples, the system terminal initializes a feedforward neural network according to the category of the intrusion feature samples and actual needs, sets the parameters of the neural network, including the number of neurons in the input layer, hidden layer and output layer, activation function, and loss function, and then uses random numbers to generate the weights and bias of the neural network. Subsequently, the intrusion feature samples and identification information that identifies the intrusion risk are used to train the intrusion risk assessment model in the same way as the aforementioned long short-term memory network training.

[0043] Further, obtaining the intrusion transfer index of the abnormal network node includes:

[0044] The abnormal network node is sent to the intrusion transfer detection model to identify the intrusion transfer network node corresponding to the abnormal network node and the intrusion transfer risks respectively corresponding to the intrusion transfer network nodes; the intrusion transfer risks respectively corresponding to the intrusion transfer network nodes are integrated to obtain the intrusion transfer index of the abnormal network node.

[0045] In a feasible implementation, after an abnormal network node is identified, in order to more comprehensively evaluate the security risks that the node may bring, the system terminal sends the abnormal network node to the intrusion transfer detection model for analysis. The intrusion transfer detection model analyzes other network nodes that interact or are associated with the abnormal node based on the network status data and system status data of the abnormal network node, combined with the learned knowledge, identifies other network nodes that may be affected by the abnormal node, and uses these nodes as intrusion transfer network nodes. Subsequently, the intrusion transfer detection model will perform a risk assessment on each intrusion transfer network node and calculate their respective intrusion transfer risks. This risk value is a quantitative indicator that reflects the possibility of the node being invaded or participating in an intrusion activity. Afterwards, in order to obtain a comprehensive evaluation result, the risk values ​​of all intrusion transfer network nodes will be fused at the output layer of the intrusion transfer detection model. This process involves weighted average calculation of the risk values ​​of all intrusion transfer network nodes, aiming to obtain an intrusion transfer indicator that can fully reflect the potential risks of abnormal network nodes. The weight of each intrusion transfer network node is assigned according to the importance of the node and expert advice. For example, core servers, key servers, gateways, etc. will be given a larger weight.

[0046] The intrusion warning module 17 is used to generate an intrusion detection report based on the intrusion risk indicator and send it to the gateway for warning.

[0047] Specifically, in the intrusion alert module 17, the system terminal generates an intrusion detection report based on the intrusion risk index. The intrusion detection report contains key information about abnormal network nodes and the calculated intrusion risk index. Subsequently, the system terminal sends the intrusion detection report to the gateway for reminder, ensuring that the operator receives the alarm in the first time and takes corresponding measures, thereby improving the security of the entire network.

[0048] In summary, the deep learning-based adaptive intrusion detection system provided in the embodiments of the present application has the following technical effects:

[0049] A network node identification module 11 is used to identify multiple network nodes of the target network, wherein each network node corresponds to a network device; a sample entry module 12 is used to enter historical intrusion event samples of the target network; an intrusion transfer analysis module 13 is used to perform intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a model construction module 14 is used to construct an intrusion transfer detection model according to the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; a network identification module 15 is used to identify the network status data and system status data of the target network; an intrusion risk indicator acquisition module 16 is used to input the network status data and the system status data into the intrusion transfer detection model, and obtain the intrusion risk indicator according to the intrusion transfer detection model; an intrusion reminder module 17 is used to generate an intrusion detection report based on the intrusion risk indicator and send it to the gateway for reminder. Through the above steps, the technical problem that traditional intrusion detection systems are difficult to effectively identify and respond to intrusion anomalies transferred through node connection relationships, resulting in difficulty in controlling stable network operation, is solved. The goal is to identify the transfer network, conduct targeted intrusion risk detection, and improve the accuracy of intrusion detection and the stability of the network.

[0050] Embodiment 2 is based on the same inventive concept as the adaptive intrusion detection system based on deep learning in the above embodiment. Figure 2 As shown, the embodiment of the present application provides an adaptive intrusion detection method based on deep learning, the method comprising:

[0051] Identify multiple network nodes of the target network, wherein each network node corresponds to a network device; input historical intrusion event samples of the target network; perform intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; construct an intrusion transfer detection model according to the transfer network node corresponding to each network node, and the preset transfer probability of each transfer network node; identify network status data and system status data of the target network; input the network status data and the system status data into the intrusion transfer detection model, and obtain an intrusion risk indicator according to the intrusion transfer detection model; based on the intrusion risk indicator, generate an intrusion detection report and send it to the gateway for reminder.

[0052] Further, inputting the network status data and the system status data into the intrusion transfer detection model includes:

[0053] Construct an intrusion risk assessment model and connect the intrusion risk assessment model with the intrusion transfer detection model; identify anomalies of the network status data and the system status data according to the intrusion risk assessment model to obtain abnormal network nodes; send the abnormal network nodes to the intrusion transfer detection model to obtain the intrusion transfer indicators of the abnormal network nodes.

[0054] Furthermore, an intrusion risk assessment model is constructed, including:

[0055] According to the historical intrusion event samples, intrusion feature samples are identified, wherein the intrusion feature samples include network traffic features, IP and domain name features, protocol and port features, content features, behavior features and timing features; according to the intrusion feature samples and identification information identifying intrusion risks, the intrusion risk assessment model is trained.

[0056] Further, performing intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes includes:

[0057] According to the historical intrusion event samples, intrusion path samples are extracted; the transfer between each intrusion path sample and the network node is identified, and the number of transfers of each network node and the number of times each node transfers to other nodes are counted; the transfer probability of each network node is calculated according to the counted number of transfers, and for each network node, the network node with a probability greater than the expected probability is identified as the corresponding transfer network node, and the transfer probability of each transfer network node is obtained as the preset transfer probability.

[0058] Furthermore, it also includes:

[0059] The abnormal network node is sent to the intrusion transfer detection model to identify the intrusion transfer network node corresponding to the abnormal network node and the intrusion transfer risks respectively corresponding to the intrusion transfer network nodes; the intrusion transfer risks respectively corresponding to the intrusion transfer network nodes are integrated to obtain the intrusion transfer index of the abnormal network node.

[0060] Furthermore, an intrusion transfer detection model is constructed, including:

[0061] Initialize the model parameters of the hidden Markov model according to the transfer network nodes corresponding to each network node and the preset transfer probability of each transfer network node; calculate the initialized hidden Markov model based on the forward algorithm to obtain the forward probability sample; calculate the initialized hidden Markov model based on the backward algorithm to obtain the backward probability sample; iteratively update the model parameters of the initialized hidden Markov model according to the forward probability sample and the backward probability sample until the model converges to output the intrusion transfer detection model.

[0062] Furthermore, it also includes:

[0063] A long short-term memory network is set; the long short-term memory network is embedded in the intrusion transfer detection model, and when a preset period is met, the model parameters of the intrusion transfer detection model are memorized and updated.

[0064] Any step of the method described above can be stored as a computer instruction or program in an unlimited computer memory, and can be called and recognized by an unlimited computer processor to implement any method in the embodiments of the present application, without any unnecessary restrictions.

[0065] Furthermore, the first or second mentioned above may not only represent an order relationship, but may also represent a specific concept, and / or refer to the selection of multiple elements individually or in whole. Obviously, those skilled in the art may make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalent technologies, the present application intends to include these modifications and variations.

Claims

1. Adaptive intrusion detection system based on deep learning, characterized by: The system comprises: A network node identification module, used to identify multiple network nodes of a target network, wherein each network node corresponds to a network device; A sample input module, used to input historical intrusion event samples of the target network; An intrusion transfer analysis module, used to perform intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and output the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node; A model building module, used to build an intrusion transfer detection model according to the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node; A network identification module, used to identify the network status data and system status data of the target network; An intrusion transfer index acquisition module is used to input the network state data and the system state data into the intrusion transfer detection model, and acquire the intrusion transfer index according to the intrusion transfer detection model. Specifically, the network state data and the system state data are anomaly identified according to a pre-built intrusion risk assessment model to acquire abnormal network nodes; the abnormal network nodes are sent to the intrusion transfer detection model to acquire the intrusion transfer index of the abnormal network nodes; An intrusion reminder module is used to generate an intrusion detection report based on the intrusion transfer indicator and send it to the gateway for reminder; Wherein, the intrusion transfer analysis is performed on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and the system includes: Extracting intrusion path samples according to the historical intrusion event samples; Identify the transfer between each intrusion path sample and network nodes, count the number of transfers to each network node, and the number of times each node transfers to other nodes; According to the statistical number of transfers, the transfer probability of each network node is calculated, and for each network node, the network node with a probability greater than the expected probability is identified as the corresponding transfer network node, and the transfer probability of each transfer network node is obtained as the preset transfer probability.

2. The deep learning-based adaptive intrusion detection system according to claim 1, characterized in that: Construct an intrusion risk assessment model. The system includes: Identify intrusion feature samples based on the historical intrusion event samples, wherein the intrusion feature samples include network traffic features, IP and domain name features, protocol and port features, content features, behavior features, and timing features; The intrusion risk assessment model is trained according to the intrusion feature samples and identification information identifying the intrusion risk.

3. The deep learning-based adaptive intrusion detection system according to claim 1, characterized in that: Sending the abnormal network node to the intrusion transfer detection model to identify the intrusion transfer network node corresponding to the abnormal network node and the intrusion transfer risks respectively corresponding to the intrusion transfer network node; The intrusion transfer risks respectively corresponding to the intrusion transfer network nodes are integrated to obtain the intrusion transfer index of the abnormal network node.

4. The deep learning-based adaptive intrusion detection system according to claim 1, characterized in that: Construct an intrusion transfer detection model. The system includes: Initialize the model parameters of the hidden Markov model according to the transfer network nodes corresponding to each network node and the preset transfer probability of each transfer network node; Calculating the initialized hidden Markov model based on a forward algorithm to obtain a forward probability sample; Calculating the initialized hidden Markov model based on a backward algorithm to obtain backward probability samples; The model parameters of the initialized hidden Markov model are iteratively updated according to the forward probability samples and the backward probability samples until the model converges and an intrusion transfer detection model is output.

5. The deep learning-based adaptive intrusion detection system according to claim 4, characterized in that: The system further comprises: Set up a long short-term memory network; The long short-term memory network is embedded in the intrusion transfer detection model, and when a preset period is met, the model parameters of the intrusion transfer detection model are memorized and updated.

6. The adaptive intrusion detection method based on deep learning is characterized by: The method is performed by the deep learning-based adaptive intrusion detection system according to any one of claims 1 to 5, comprising: Identifying a plurality of network nodes of a target network, wherein each network node corresponds to a network device; Recording historical intrusion event samples of the target network; Performing intrusion transfer analysis on the historical intrusion event samples according to the connection relationship of the multiple network nodes, and outputting the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node; According to the transfer network node corresponding to each network node and the preset transfer probability of each transfer network node, an intrusion transfer detection model is constructed; identifying network status data and system status data of the target network; Input the network status data and the system status data into the intrusion transfer detection model, and obtain the intrusion transfer index according to the intrusion transfer detection model. Specifically, perform abnormal identification on the network status data and the system status data according to a pre-built intrusion risk assessment model to obtain abnormal network nodes; send the abnormal network nodes to the intrusion transfer detection model to obtain the intrusion transfer index of the abnormal network nodes; Based on the intrusion transfer indicator, an intrusion detection report is generated and sent to the gateway for reminder.

Images