A method for establishing identification rules based on network traffic characteristics

Abstract

The present invention discloses a method for establishing a rule based on network traffic feature recognition, which relates to the field of network technology, including: obtaining historical network traffic data and historical user behavior data and performing preprocessing operations; performing feature extraction on the preprocessed network traffic data and user behavior data respectively; dividing the historical data into a training set and a test set, using a symmetric uncertainty algorithm to filter out all candidate features related to each user behavior feature from the network traffic features of the training set data; calculating the weight of each feature attribute in the associated feature set of each user behavior feature, and performing similarity calculation on two feature attributes whose weight difference is within a preset threshold range; establishing a user abnormal network behavior recognition model, and performing model accuracy evaluation based on the remaining test set data. A precise user abnormal network behavior recognition method based on real-time network traffic features is realized.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method for establishing a rule based on network traffic feature recognition. Background Art

[0002] With the rapid development and popularization of network technology, network traffic monitoring and analysis are becoming more and more important. Network traffic data contains a large amount of user behavior information. For network administrators and security researchers, by identifying and analyzing network traffic characteristics, they can effectively detect and prevent various abnormal behaviors, such as network attacks, abuse, etc. In order to effectively manage and monitor network traffic, a method for establishing rules based on network traffic feature identification is proposed. This method conducts in-depth analysis of network traffic, identifies different network traffic characteristics, and establishes corresponding identification rules based on these characteristics to achieve effective monitoring and management of network traffic.

[0003] In a Chinese invention patent with application publication number CN102045363A, a method for establishing network traffic feature identification rules is disclosed, including: an analysis center server receives a network traffic sample, obtains load data of the network traffic sample, extracts traffic features from the load data, and when a feature parameter contained in the traffic feature reaches a corresponding threshold, determines that the network traffic belongs to a category corresponding to the corresponding threshold, stores the traffic feature in correspondence with the category to generate a feature identification rule, and sends the feature identification rule to a network traffic device.

[0004] In the above application, the analysis center server can extract the traffic characteristics of the network traffic and establish feature recognition rules without pre-installing and running the application software that generates the network traffic. By sending the dynamically updated feature recognition rules to the network traffic equipment, the network traffic equipment's ability to analyze, identify and control the network traffic can be continuously improved.

[0005] However, traditional network traffic feature recognition methods are usually based on manual rules or simple statistical features. They usually only consider a single network traffic feature and ignore the interaction between multiple features. They cannot effectively extract features related to user behavior from massive network traffic data, resulting in the inability to accurately identify complex abnormal behaviors. In addition, these methods usually require a lot of manual intervention and adjustment, which not only increases the workload but also easily leads to errors. Summary of the invention

[0006] 1. Technical issues to be solved

[0007] In view of the technical problems in the background technology, the present invention proposes a method for establishing rules based on network traffic feature recognition, including: obtaining historical network traffic data and historical user behavior data and performing preprocessing operations; extracting features from the preprocessed network traffic data and user behavior data respectively; dividing the historical data into a training set and a test set, using a symmetric uncertainty algorithm to filter out all candidate features related to each user behavior feature from the network traffic features of the training set data; calculating the weight of each feature attribute in the associated feature set of each user behavior feature, and performing similarity calculation on two feature attributes whose weight difference is within a preset threshold range; establishing a user abnormal network behavior recognition model, and evaluating the model accuracy based on the remaining test set data. A solution is provided for the problems in the background technology.

[0008] (II) Technical solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0010] A method for establishing a network traffic feature recognition rule, comprising:

[0011] Obtain historical network traffic monitoring data, including network traffic data and user behavior data, and perform preprocessing operations on the collected data;

[0012] Extract features from the preprocessed network traffic data and user behavior data respectively; save the extracted network traffic features and user behavior features in different feature sets respectively;

[0013] The historical data is divided into a training set and a test set. The symmetric uncertainty index between each network traffic feature attribute and each user behavior feature with a feature value of 1 is calculated using a symmetric uncertainty algorithm, and a symmetric uncertainty index threshold is preset. All network traffic feature attributes with a symmetric uncertainty index greater than the symmetric uncertainty index threshold are screened out from the network traffic features of the training set data as candidate feature attributes for the corresponding user behavior features.

[0014] The weight of each associated feature attribute in the associated feature set of each user behavior feature is calculated according to the symmetric uncertainty index between the calculated network traffic feature attribute and each user behavior feature with a feature value of 1, and the similarity of two associated feature attributes whose weight difference is within a preset weight threshold range is calculated. If the similarity of the two associated feature attributes is greater than the preset similarity threshold, one of the associated feature attributes is deleted from the associated feature set of the corresponding user behavior feature;

[0015] A user abnormal network behavior recognition model is established, and the model accuracy is evaluated based on the remaining test set data. Specifically, the sum of the weights of each user behavior feature is calculated, and the user behavior feature weight threshold is preset. When the calculated sum of the actual weights of the user behavior features is greater than the user behavior feature weight threshold, it means that the user is currently performing the corresponding abnormal network behavior; and the model with qualified recognition results is applied to the actual website.

[0016] Specifically, for network traffic data, the physical structure of the traffic packet is mainly analyzed, including traffic size and rate, number of packets, length, and time interval. The extracted network traffic features are saved in the feature set T1, where T1 = A1, A2, ..., A n}, where A i Represents the i-th network traffic feature, including the feature name and feature attribute set a i , n represents the number of network traffic features; all values ​​of each network traffic feature in the historical data are counted and recorded to obtain the characteristic attribute set a of each network traffic feature i , a i ={a i1 ,a i2 ,…,a io}, a ij That is, is the jth attribute of the ith network traffic feature, and o is the total number of attributes of each network traffic feature;

[0017] For user behavior data, we mainly analyze the field content of the data packet and compare it with the preset dictionary to determine whether the user has unsafe behavior, such as whether the user has visited a website with high-risk keywords, whether the user has operated a bank card, and whether the user has disclosed personal information. The extracted user behavior features are saved in the feature set T2, T2 = b1, b2, ..., b m}, where b k represents the kth user behavior feature, m represents the number of user behavior features, and b i The value of b is 0 or 1. k = 0, it means that the user has not performed the corresponding behavior; when b k =1, it means the user has performed the corresponding behavior.

[0018] Specifically, 80% of the data is selected from the historical data as a training set, and the network traffic characteristics and user behavior characteristics in each data are obtained after the features are extracted; the network traffic characteristic attributes corresponding to each user behavior feature are recorded in turn, and when all the user behavior data are processed, the number of all network traffic characteristic attributes corresponding to the user behavior feature is counted.

[0019] Furthermore, the probability p(a) of each network traffic characteristic attribute appearing is calculated based on the total number of data in the training set and the number of occurrences of all network traffic characteristic attributes. ij ), and further calculate the information entropy H(a) corresponding to each network traffic characteristic attribute ij ), the expression is:

[0020]

[0021] The probability p(b) of each user behavior is calculated based on the total number of data in the training set and the number of user behavior feature values ​​1. k =1), and further calculate the information entropy H(b) of each user behavior feature with a characteristic value of 1 k =1), the expression is:

[0022]

[0023] According to the probability p(a) of each network traffic characteristic attribute appearing ij ) further calculates the probability of occurrence of each network traffic feature attribute under the condition that the feature value of each user behavior feature is 1, and the conditional probability p(a ij |b k =1), then the probability of each network traffic feature attribute appearing is further calculated under the condition that the characteristic value of each user behavior feature is 1, and the conditional entropy H(a ij |b k =1), the expression is:

[0024]

[0025] Here, i is a positive integer not greater than n.

[0026] Furthermore, the information entropy H(a ij ) and conditional entropy H(a ij |b k =1), and the information gain I(a) of each network traffic feature attribute and each user behavior feature with a feature value of 1 is obtained. ij ,b k =1), the expression is:

[0027] I(a ij ,b k =1) = H(a ij )-H(a ij |b k =1)

[0028] According to the information entropy H(a ij ), conditional entropy H(a ij |b k=1) and information gain I(a ij ,b j =1), we can get the following expression:

[0029] I(a ij ,b k =1) = I(b k =1,a ij )

[0030] Then each network traffic characteristic attribute a ij The symmetric uncertainty index U(a) between each user behavior feature with a feature value of 1 ij ,b k =1) is calculated by the following expression:

[0031]

[0032] Set the symmetric uncertainty index threshold U0, when the network traffic characteristic attribute a is calculated ij The symmetric uncertainty index U(a) between each user behavior feature with a feature value of 1 ij ,b k =1)>U0, it means that the feature attribute is associated with the corresponding user behavior feature, and the feature attribute is used as the associated feature attribute of the user behavior feature; and U(a ij ,b k =1), the larger the feature attribute is, the greater the correlation between the feature attribute and the corresponding user behavior feature; all feature attributes that are correlated with each user behavior feature with a feature value of 1 are recorded separately, and the features corresponding to these feature attributes are combined into a correlation feature set of the user behavior feature.

[0033] Furthermore, according to the calculated network traffic characteristic attribute a ij The symmetric uncertainty index U between each user behavior feature with a eigenvalue of 1 i Calculate the weight of each feature attribute in the associated feature set of each user behavior feature; specifically:

[0034] The difference X between the symmetric uncertainty index U calculated for each network traffic characteristic attribute and the symmetric uncertainty index threshold U0 is i The weight of the characteristic attribute for the user behavior feature is obtained by dividing the sum of the difference between the symmetric uncertainty index calculated for all network traffic characteristic attributes and the symmetric uncertainty index threshold. The total number of characteristic attributes associated with the user behavior characteristics to be calculated is M, and the expression is:

[0035]

[0036] The sum of the weights of all associated feature attributes corresponding to each user behavior feature is 1.

[0037] Specifically, a weight threshold range of [-ε, ε] is preset, and the weight difference D of each associated feature attribute is compared with other associated feature attributes one by one. If the weight difference D of the associated feature attribute S1 and the associated feature attribute S2 is within the range of [-ε, ε], the similarity X of the two associated feature attributes is calculated, specifically: the number of characteristic values ​​of the two associated feature attributes in the corresponding user behavior features is counted respectively, and the number of associated feature attributes S2 that exist when the associated feature attribute S1 exists is counted; the conditional probability p(S2|S1) when the characteristic value of the user behavior feature is 1 and the conditional probability p(S2|S1) when the associated feature attribute S1 exists is calculated based on the above data; and the probability p(S'2) that the associated feature attribute S2 exists when the characteristic value of the user behavior feature is 0; then the similarity X between the associated feature attributes S1 and the associated feature attributes S2 in their corresponding user behavior features is calculated according to the formula X=p(S2|S1)-p(S'2).

[0038] Specifically, a similarity threshold X0 is set. If X>X0, it means that the associated feature attribute S1 is similar to the associated feature attribute S2, and the associated feature attribute S2 is deleted from the associated feature set corresponding to the user behavior feature;

[0039] The remaining associated feature attributes in each user behavior feature after similarity processing are normalized in terms of weights and form a new associated feature set.

[0040] Furthermore, the model trained above is identified for model accuracy; the remaining 20% ​​of the historical data is used as a test set, and the sum of the weights of each user behavior feature is calculated for each test set according to the model identification method, and compared with the user behavior feature weight threshold to obtain the expected user network identification result; the expected user network identification result of each test set is compared with the actual user network identification result, and if the expected user network identification result does not match the actual user network identification result, the identification failure is recorded;

[0041] Count the number of all recognition failure data in the test set and evaluate the model accuracy, and adjust the corresponding symmetric uncertainty index threshold according to the evaluation results; count the number of successful recognitions of each user behavior feature, and adjust the weight threshold or similarity threshold according to the evaluation results;

[0042] Specifically, the model identification method is as follows:

[0043] When a user visits a website, the user's operation flow data is monitored in real time, that is, the network traffic characteristic attributes generated by the user's operation are monitored in real time; the real-time network traffic characteristic attributes are compared with the associated feature set of each user behavior feature, the real-time network traffic characteristic attributes existing in the associated feature set are recorded, and the sum of the weights of each user behavior feature is calculated based on the weights of all the screened feature attributes for each user behavior feature; a user behavior feature weight threshold is set, and when the calculated sum of the actual weights of the user behavior features is greater than the user behavior feature weight threshold, it means that the user is currently performing the corresponding abnormal network behavior, and a corresponding web page reminder is made.

[0044] (III) Beneficial effects

[0045] The present invention provides a method for establishing a network traffic feature recognition rule, which has the following beneficial effects:

[0046] 1. By comprehensively considering network traffic data and user behavior data, we can have a more comprehensive understanding of the characteristics of network traffic, thereby improving the accuracy of identification rules;

[0047] 2. By using the symmetric uncertainty algorithm to screen out the candidate features related to each user's behavior characteristics and establish a user abnormal network behavior recognition model, the user's abnormal behavior can be identified more accurately;

[0048] 3. By calculating the weight of each feature attribute in the associated feature set of each user behavior feature, the feature attribute most relevant to the user behavior feature can be found, thereby improving the ability to identify unknown traffic types;

[0049] 4. It can automatically extract network traffic characteristics and user behavior characteristics from historical data, and use algorithms to automatically filter out candidate characteristics related to user behavior characteristics, reducing manual intervention and improving work efficiency;

[0050] 5. Through model accuracy evaluation, the model with qualified recognition results is applied to the actual website, making the method easy to deploy and apply, and has good practical value. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A flowchart of the steps of the method for establishing network traffic feature identification rules provided by the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] refer to Figure 1 The present invention provides a method for establishing a network traffic feature recognition rule, comprising:

[0054] S1. Obtain historical network traffic monitoring data, including network traffic data and user behavior data, and perform preprocessing operations on the collected data;

[0055] Whenever data traffic passes through, the historical network monitoring log will record the data traffic related information and user behavior information; extract the historical network traffic monitoring data from the historical network monitoring log, including network traffic data and user behavior data; among them, network traffic data refers to the amount of data transmitted in the network, data transmission speed, number of data packets, data packet size and data packet arrival time interval and other characteristics, these characteristics can reflect the state and behavior of network traffic, such as network congestion, network attack, etc.; user behavior data refers to the user's behavior characteristics in the network, including the user's access time, access frequency, access duration, access page operation, number of downloaded files, etc. These characteristics can reflect the user's interests, hobbies, behavioral habits, activity range and other information, which is helpful to understand the user's needs and behaviors, and provide a reference for network management and network security;

[0056] Before processing the collected data, preprocessing operations are required, including: data cleaning, deleting duplicate data, invalid data or erroneous data, handling missing values ​​and outliers, and standardization.

[0057] By collecting and analyzing network traffic data and user behavior data, we can better understand the network status and user behavior, and provide a data basis for establishing feature recognition rules for network traffic.

[0058] S2, extracting features from the preprocessed network traffic data and user behavior data respectively;

[0059] For network traffic data, the physical structure of traffic packets is mainly analyzed, including traffic size and rate, number of packets, length, time interval and other characteristics; the extracted network traffic features are saved in the feature set T1, T1 = {A1, A2, ..., A n}, where A i Represents the i-th network traffic feature, including the feature name and feature attribute set a i, n represents the number of network traffic features; all values ​​of each network traffic feature in the historical data are counted and recorded to obtain the characteristic attribute set a of each network traffic feature i , a i ={a i1 ,a i2 ,…,a io}, a ij That is, it is the jth attribute of the i-th network traffic feature, o is the total number of attributes of each network traffic feature, and o is not fixed;

[0060] For user behavior data, we mainly analyze the field content of the data packet and compare it with the preset dictionary to determine whether the user has unsafe behavior, such as whether the user has visited a website with high-risk keywords, whether the user has operated a bank card, and whether the user has disclosed personal information. The extracted user behavior features are saved in the feature set T2, T2 = {b1, b2, ..., b m}, where b k represents the kth user behavior feature, m represents the number of user behavior features, and b i The value of b is 0 or 1. k = 0, it means that the user has not performed the corresponding behavior; when b k =1, it means the user has performed the corresponding behavior.

[0061] S3, divide the historical data into a training set and a test set, and use a symmetric uncertainty algorithm to filter out all candidate features related to each user's behavior characteristics from the network traffic characteristics of the training set data;

[0062] The symmetric uncertainty algorithm is a feature selection algorithm that selects relevant features by minimizing the symmetric uncertainty of all feature pairs based on the similarity matrix. The algorithm can be used to process high-dimensional data and large-scale data sets, and can effectively screen out features related to the target variable.

[0063] 80% of the data is selected from the historical data as the training set, and the network traffic characteristics and user behavior characteristics in each data are obtained after the features are extracted; the network traffic characteristic attributes corresponding to each user behavior feature are recorded in turn, and when all the user behavior data are processed, the number of all network traffic characteristic attributes corresponding to the user behavior feature is counted;

[0064] The probability p(a) of each network traffic characteristic attribute appearing is calculated based on the total number of data in the training set and the number of occurrences of all network traffic characteristic attributes. ij ), and further calculate the information entropy H(a) corresponding to each network traffic characteristic attribute ij ), the expression is:

[0065]

[0066] Wherein, i is a positive integer not greater than n;

[0067] The probability p(b) of each user behavior is calculated based on the total number of data in the training set and the number of user behavior feature values ​​1. k =1), and further calculate the information entropy H(b) of each user behavior feature with a characteristic value of 1 k =1), the expression is:

[0068]

[0069] According to the probability p(a) of each network traffic characteristic attribute appearing ij ) further calculates the probability of occurrence of each network traffic feature attribute under the condition that the feature value of each user behavior feature is 1, and the conditional probability p(a ij |b k =1), then the probability of each network traffic feature attribute appearing is further calculated under the condition that the characteristic value of each user behavior feature is 1, and the conditional entropy H(a ij |b k =1), the expression is:

[0070]

[0071] The information entropy H(a ij ) and conditional entropy H(a ij |b k =1), and the information gain I(a) of each network traffic feature attribute and each user behavior feature with a feature value of 1 is obtained. ij ,b k =1), the expression is:

[0072] I(a ij ,b k =1) = H(a ij )-H(a ij |b k =1)

[0073] According to the information entropy H(a ij ), conditional entropy H(a ij |b k =1) and information gain I(a ij ,b j =1), we can get the following expression:

[0074] I(a ij ,b k =1) = I(b k =1,a ij )

[0075] Then each network traffic characteristic attribute a ij The symmetric uncertainty index U(a) between each user behavior feature with a feature value of 1 ij ,b k =1) is calculated by the following expression:

[0076]

[0077] Set the symmetric uncertainty index threshold U0, when the network traffic characteristic attribute a is calculated ij The symmetric uncertainty index U(a) between each user behavior feature with a feature value of 1 ij ,b k =1)>U0, it means that the feature attribute is associated with the corresponding user behavior feature, and the feature attribute is used as the associated feature attribute of the user behavior feature; and U(a ij ,b k =1), the larger the feature attribute is, the greater the correlation between the feature attribute and the corresponding user behavior feature; all feature attributes that are correlated with each user behavior feature with a feature value of 1 are recorded separately, and the features corresponding to these feature attributes are combined into a correlation feature set of the user behavior feature.

[0078] S4, calculating the weight of each feature attribute in the associated feature set of each user behavior feature, and performing similarity calculation on two feature attributes whose weight difference is within a preset threshold range;

[0079] The weight of each feature attribute in the associated feature set of each user behavior feature is calculated because different feature attributes may contribute to different degrees to user behavior. By calculating the weight, the influence of each feature attribute on user behavior can be quantified, so as to better understand and analyze user behavior.

[0080] According to the network traffic characteristic attribute a calculated in step S3 ij The symmetric uncertainty index U between each user behavior feature with a eigenvalue of 1 i Calculate the weight of each feature attribute in the associated feature set of each user behavior feature, U i Represents the symmetric uncertainty index of each feature attribute in the associated feature set; specifically: the difference X between the symmetric uncertainty index U calculated for each network traffic feature attribute and the symmetric uncertainty index threshold U0 i The weight of the characteristic attribute for the user behavior feature is obtained by dividing the sum of the difference between the symmetric uncertainty index calculated for all network traffic characteristic attributes and the symmetric uncertainty index threshold. The total number of characteristic attributes associated with the user behavior characteristics to be calculated is M, and the expression is:

[0081]

[0082] The sum of the weights of all associated feature attributes corresponding to each user behavior feature is 1.

[0083] Deleting one of the feature attributes whose similarity is greater than the set threshold is to avoid redundancy and overfitting of feature attributes. If the similarity between two feature attributes is too high, then the information they provide may be repeated, so just keep one of them. This can reduce the number of features and improve the efficiency and generalization ability of the model;

[0084] The weight threshold range is preset to [-ε,ε], and the weight difference D between each associated feature attribute and other associated feature attributes is compared one by one. If D∈[-ε,ε], it means that the two associated feature attributes have almost the same weight. Then the similarity X of the two associated feature attributes is calculated, and it is determined whether the two associated feature attributes can be optimized in quantity according to the similarity. The specific calculation method is as follows:

[0085] If the weight difference between the associated feature attribute S1 and the associated feature attribute S2 is within the range of [-ε,ε], the number of eigenvalues ​​of 1 and 0 of the two associated feature attributes in their corresponding user behavior features is counted respectively, and the number of associated feature attributes S2 that exist when the associated feature attribute S1 exists is counted; based on the above data, the conditional probability p(S2|S1) that the associated feature attribute S2 exists when the eigenvalue of the user behavior feature is 1 is calculated when the associated feature attribute S1 exists; and the probability p(S'2) that the associated feature attribute S2 exists when the eigenvalue of the user behavior feature is 0; then the similarity X between the associated feature attributes S1 and S2 in their corresponding user behavior features is calculated according to the following formula:

[0086] X=p(S2|S1)-p(S'2)

[0087] Set a similarity threshold X0. If X>X0, it means that the associated feature attribute S1 is similar to the associated feature attribute S2. Delete the associated feature attribute S2 from the associated feature set corresponding to the user behavior feature.

[0088] The remaining associated feature attributes in each user behavior feature after similarity processing are normalized in terms of weights and form a new associated feature set.

[0089] S5. Establish a user abnormal network behavior recognition model, evaluate the model accuracy based on the remaining test set data, and apply the model with qualified recognition results to the actual website.

[0090] According to the steps S3-S4, a user abnormal network behavior recognition model is established. When a user visits a website, the user's operation flow data is monitored in real time, that is, the network traffic characteristic attributes generated by the user's operation are monitored in real time; the real-time network traffic characteristic attributes are compared with the associated feature set of each user behavior feature, the real-time network traffic characteristic attributes existing in the associated feature set are recorded, and the sum of the weights of each user behavior feature is calculated according to the corresponding weights; a user behavior feature weight threshold is set, and when the calculated sum of the actual weights of the user behavior features is greater than the user behavior feature weight threshold, it means that the user is currently performing the corresponding abnormal network behavior and needs to be reminded accordingly;

[0091] The model trained above is identified for model accuracy; the remaining 20% ​​of the historical data is used as a test set, and the sum of the weights of each user behavior feature is calculated for each test set according to the above method, and compared with the user behavior feature weight threshold to obtain the expected user network identification result; the expected user network identification result of each test set is compared with the actual user network identification result. If the expected user network identification result does not match the actual user network identification result, the identification is recorded as a failure;

[0092] Count the number of all recognition failure data in the test set and evaluate the model accuracy, and adjust the corresponding symmetric uncertainty index threshold according to the evaluation results; count the number of successful recognitions of each user behavior feature, and adjust the weight threshold or similarity threshold according to the evaluation results;

[0093] Apply the model with qualified accuracy recognition results to the actual website.

[0094] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0095] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for establishing a rule based on network traffic feature recognition, characterized in that: include: Obtain historical network traffic monitoring data, including network traffic data and user behavior data, and perform preprocessing operations on the collected data; Extract features from the preprocessed network traffic data and user behavior data respectively; save the extracted network traffic features and user behavior features in different feature sets respectively; The historical data is divided into a training set and a test set, and the symmetric uncertainty algorithm is used to calculate the symmetric uncertainty index between each network traffic feature attribute and each user behavior feature with a feature value of 1, and a symmetric uncertainty index threshold is preset. All network traffic feature attributes with a symmetric uncertainty index greater than the symmetric uncertainty index threshold are screened out from the network traffic features of the training set data as candidate feature attributes for the corresponding user behavior features; The weight of each associated feature attribute in the associated feature set of each user behavior feature is calculated according to the symmetric uncertainty index between the calculated network traffic feature attribute and each user behavior feature with a feature value of 1, and the similarity of two associated feature attributes whose weight difference is within a preset weight threshold range is calculated. If the similarity of the two associated feature attributes is greater than the preset similarity threshold, one of the associated feature attributes is deleted from the associated feature set of the corresponding user behavior feature; Establish a user abnormal network behavior recognition model, and evaluate the model accuracy based on the remaining test set data. Specifically, calculate the sum of the weights of each user behavior feature, and preset the user behavior feature weight threshold. When the calculated sum of the actual weights of the user behavior features is greater than the user behavior feature weight threshold, it means that the user is currently performing the corresponding abnormal network behavior; And apply the model with qualified recognition results to the actual website.

2. A method for establishing a network traffic feature recognition rule according to claim 1, characterized in that: For network traffic data, analyze the physical structure of traffic packets, including traffic size and rate, number of packets, length, and time interval; save the extracted network traffic features in the feature set middle, ,in, Indicates Network traffic features, including feature names and feature attribute sets , Indicates the number of network traffic features; counts and records all the values ​​of each network traffic feature in the historical data to obtain the characteristic attribute set of each network traffic feature , , That is the The network traffic characteristics properties, is the total number of attributes for each network traffic feature; For user behavior data, analyze the field content of the data packet, compare it with the preset dictionary to determine whether the user has unsafe behavior, and save the extracted user behavior features in the feature set. middle, ,in, Indicates User behavior characteristics, represents the number of user behavior features, and The value of is 0 or 1. When , it means that the user has not performed the corresponding behavior; when , it indicates that the user has performed the corresponding behavior.

3. A method for establishing a network traffic feature recognition rule according to claim 2, characterized in that: 80% of the historical data is selected as the training set. After extracting the features, the network traffic features and user behavior features in each data are obtained. The network traffic characteristic attributes corresponding to each user behavior feature are recorded in turn. When all user behavior data are processed, the number of all network traffic characteristic attributes corresponding to the user behavior feature is counted.

4. A method for establishing a network traffic feature recognition rule according to claim 3, characterized in that: The probability of each network traffic characteristic attribute appearing is calculated based on the total number of data in the training set and the number of occurrences of all network traffic characteristic attributes. , and further calculate the information entropy corresponding to each network traffic feature attribute , the expression is: The probability of each user behavior is calculated based on the total number of data in the training set and the number of user behavior feature values ​​​​that are 1 , and further calculate the information entropy of each user behavior feature with a characteristic value of 1 , the expression is: According to the probability of occurrence of each network traffic characteristic attribute The probability of occurrence of each network traffic feature attribute is further calculated under the condition that the characteristic value of each user behavior feature is 1. , then the probability of each network traffic feature attribute appearing is further calculated as the conditional entropy under the condition that the feature value of each user behavior feature is 1 , the expression is: in, Not greater than A positive integer.

5. A method for establishing a rule based on network traffic feature recognition as claimed in claim 4, characterized in that: The information entropy calculated and conditional entropy Combined, we get the information gain of each network traffic feature attribute and each user behavior feature with a feature value of 1. , the expression is: According to the information entropy , conditional entropy And information gain Combining, we get the following expression: Then each network traffic characteristic attribute Symmetric uncertainty index between each user behavior feature with a feature value of 1 It is calculated by the following expression: Set the symmetry uncertainty index threshold , when the network traffic characteristic attributes are calculated Symmetric uncertainty index between each user behavior feature with a feature value of 1 , the feature attribute is used as the associated feature attribute of the user behavior feature; all feature attributes associated with each user behavior feature whose feature value is 1 are recorded respectively, and the features corresponding to these feature attributes are combined into an associated feature set of the user behavior feature.

6. A method for establishing a rule based on network traffic feature recognition as claimed in claim 5, characterized in that: Based on the calculated network traffic characteristic attributes Symmetric uncertainty index between each user behavior feature with a feature value of 1 Calculate the weight of each feature attribute in the associated feature set of each user behavior feature; specifically: The symmetric uncertainty index calculated for each network traffic characteristic attribute Symmetric uncertainty index threshold The difference Divide the sum of the differences between the symmetric uncertainty index calculated for all network traffic feature attributes and the symmetric uncertainty index threshold to get the weight of the feature attribute for the user behavior feature. , the total number of characteristic attributes associated with the user behavior characteristics to be calculated is , the expression is: The sum of the weights of all associated feature attributes corresponding to each user behavior feature is 1.

7. A method for establishing a network traffic feature recognition rule according to claim 6, characterized in that: Preset weight threshold range , compare the weight difference between each associated feature attribute and other associated feature attributes one by one , if the associated feature attribute Associate feature attributes The weight difference exist If the range is within , the similarity of the two associated feature attributes is calculated. , specifically: Count the number of 1 and 0 feature values ​​of these two associated feature attributes in their corresponding user behavior features, and count the associated feature attributes When present, associated feature attributes The number of existing features; when the characteristic value of the user behavior feature is 1, the associated feature attribute Associate feature attributes when present Conditional probability of existence ; and when the characteristic value of the user behavior characteristic is 0, the associated characteristic attribute Probability of existence ; then the associated feature attributes Associate feature attributes Similarity in its corresponding user behavior characteristics , similarity According to the formula Calculated.

8. A method for establishing a rule based on network traffic feature recognition as claimed in claim 7, characterized in that: Setting the similarity threshold ,like , then it means the associated feature attribute Associate feature attributes If there is similarity, delete the associated feature attributes from the associated feature set corresponding to the user behavior feature. ; The remaining associated feature attributes in each user behavior feature after similarity processing are normalized in terms of weights and form a new associated feature set.

9. A method for establishing a network traffic feature recognition rule according to claim 8, characterized in that: The model trained above is identified for model accuracy; the remaining 20% ​​of the historical data is used as a test set, and the sum of the weights of each user behavior feature is calculated for each test set according to the model identification method, and compared with the user behavior feature weight threshold to obtain the expected user network identification result; the expected user network identification result of each test set is compared with the actual user network identification result. If the expected user network identification result does not match the actual user network identification result, the identification is recorded as a failure; Count the number of all recognition failure data in the test set and evaluate the model accuracy, and adjust the corresponding symmetric uncertainty index threshold based on the evaluation results; count the number of successful recognitions of each user behavior feature, and adjust the weight threshold or similarity threshold based on the evaluation results.

10. A method for establishing a rule based on network traffic feature recognition as claimed in claim 9, characterized in that: The model identification method is specifically as follows: when a user visits a website, the user's operation flow data is monitored in real time, that is, the network traffic characteristic attributes generated by the user's operation are monitored in real time; the real-time network traffic characteristic attributes are compared with the associated feature set of each user behavior feature, the real-time network traffic characteristic attributes existing in the associated feature set are recorded, and the weight sum of each user behavior feature is calculated based on the weight of all the screened characteristic attributes for each user behavior feature; Set the user behavior feature weight threshold. When the calculated sum of the actual weights of the user behavior features is greater than the user behavior feature weight threshold, it means that the user is currently performing the corresponding abnormal network behavior, and a corresponding web page reminder is issued.

Images