A two-way blocking method and system for network security threats

Abstract

The present invention relates to the field of network security technology, and in particular to a two-way blocking method and system for network security threats, including converting network traffic into a traffic word sequence to obtain a traffic word vector optimization space; performing cluster analysis on the traffic word vector optimization space to obtain a traffic abnormality word set; modeling the distribution of the traffic abnormality word set in different dimensions, identifying the dimensional mutation point, and performing anomaly scoring according to the probability density of the dimensional mutation point in each dimension to obtain an anomaly point score; scoring the character sequence of the traffic abnormality word set to obtain a character sequence score; obtaining the traffic abnormality word risk according to the anomaly point score and the character sequence score, constructing a TCP reset packet of a high-risk traffic data packet and injecting it into a two-way communication flow to force a connection interruption. The present invention effectively prevents potential network security threats by deeply analyzing network traffic and blocking high-risk traffic data packets in real time.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a two-way blocking method and system for network security threats. Background Art

[0002] With the rapid development of artificial intelligence technology, natural language processing (NLP) technology has been widely adopted due to its outstanding performance in text generation, understanding and translation. However, the widespread application of these technologies has also brought new security challenges, especially in the field of analysis and protection of network traffic security threats. A key technical difficulty is how to effectively identify and process rare words and newly coined words in network traffic. These words can be used by malicious actors to circumvent traditional security detection mechanisms, thereby increasing the complexity and difficulty of network defense.

[0003] In network traffic analysis, word vectors are an important representation of text data and a key tool for identifying and analyzing traffic. However, due to the scarcity of rare words and newly coined words in conventional training corpora, the word vector representations learned by traditional methods lack sufficient accuracy and robustness. In practical applications, the appearance of these unconventional words often leads to abnormal distribution in the word vector space, such as dimensionality mutation, clustering pattern deviation, etc. These abnormal phenomena are difficult to effectively identify through simple statistical methods or threshold settings. The high speed, massiveness and diversity of network traffic further bring huge challenges to word vector analysis, especially the existence of dynamically generated content, unknown protocols and other content, which makes the abnormal distribution of word vector space more common and difficult to predict. These abnormal features are significantly different from the vector distribution of conventional words, but are difficult to identify with simple statistical methods or threshold judgments, thereby increasing the difficulty of detection.

[0004] In addition, malicious actors may purposefully construct rare words and newly coined words to evade conventional text filtering and recognition mechanisms, further exacerbating the difficulty of detection. In a network environment, attackers may use traffic characteristics (such as fragmentation, reorganization, encryption, etc.) to hide malicious content, making word vector-based detection more difficult. How to accurately characterize these abnormal features in the high-dimensional space of word vectors and design a detection algorithm that can respond in real time and efficiently block potential threats has become a technical problem that urgently needs to be solved in the current field of network traffic security. In order to solve this problem, in-depth research is needed at multiple levels such as word vector learning and optimization to improve the representation ability of rare words and newly coined words. Reduce the deviation caused by data scarcity to protect the security of network traffic. Especially in network traffic analysis, it is necessary to consider the real-time requirements of traffic and design efficient parallel processing algorithms to meet the challenges of large-scale traffic data. At the same time, it is also necessary to combine network protocol analysis and traffic feature extraction technology to improve the processing capabilities of unknown protocols, so as to more comprehensively capture potential threats. In summary, the application of existing technologies in security threat discovery and two-way blocking in processing network traffic still faces major challenges, especially when dealing with rare words, newly coined words and complex network traffic environments. There is a lack of effective detection and blocking mechanisms, and it is impossible to build a more complete and efficient security defense system. Summary of the invention

[0005] The purpose of the present invention is to provide a two-way blocking method and system for network security threats, and the technical problem to be solved is to combine network protocol analysis and traffic feature extraction technology to achieve comprehensive capture and real-time blocking of potential threats, so as to ensure the security and stability of the network.

[0006] In order to solve the above technical problems, the present invention provides a two-way blocking method and system for network security threats.

[0007] In a first aspect, the present invention provides a method for bidirectionally blocking network security threats, the method comprising the following steps:

[0008] Extracting application layer data from network traffic and converting the application layer data into a traffic vocabulary sequence;

[0009] Optimizing and learning the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space;

[0010] Performing cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set;

[0011] Perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimension mutation points, and perform anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores;

[0012] Constructing a character combination pattern feature of the traffic vocabulary sequence, and scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution to obtain a character sequence score;

[0013] Quantifying the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly vocabulary risk;

[0014] A corresponding TCP reset packet is constructed according to the high-risk traffic data packet, and the TCP reset packet is synchronously injected into the bidirectional communication flow to force the connection to be interrupted.

[0015] In a further embodiment, the step of extracting application layer data from network traffic and converting the application layer data into a traffic vocabulary sequence comprises:

[0016] Extracting application layer data from network traffic using deep packet inspection methods, and identifying application layer protocol features from the application layer data using protocol fingerprinting and port mapping methods;

[0017] Using a vocabulary-based segmentation method to segment the application layer data into an initial vocabulary sequence, and performing part-of-speech tagging on the initial vocabulary sequence to obtain a tagged vocabulary sequence;

[0018] According to the application layer protocol features and a preset protocol feature library, identifying unknown protocol flow data and known protocol flow data from the marked vocabulary sequence;

[0019] Vectorizing the known protocol traffic data using a long short-term memory network embedded with a self-attention mechanism to obtain a vocabulary vectorized semantic representation;

[0020] Extract features from unknown protocol traffic data to generate unknown protocol traffic feature vectors, and use density clustering algorithm to perform unsupervised learning on unknown protocol traffic feature vectors to obtain semantic representations of different categories of unknown protocol traffic.

[0021] According to the semantic representation of unknown protocol traffic and the semantic representation of vocabulary vectorization, a conditional random field model is used to identify key semantic elements; the key semantic elements include keywords and phrases;

[0022] The named entity recognition algorithm is used to identify the entities, relations and events of the key semantic elements, form structured information including the entities, relations and events, and convert the structured information into a structured traffic vocabulary sequence.

[0023] In a further embodiment, the step of optimizing and learning the word vector dimension mutation characteristics of the traffic low-frequency words in the traffic word sequence to obtain the traffic word vector optimization space includes:

[0024] The traffic vocabulary sequence is divided into a number of traffic vocabulary segments by using a sliding time window mechanism, and weighted word frequency statistics are performed on the traffic vocabulary segments in each sliding time window according to a preset attenuation factor to obtain a weighted word frequency of traffic vocabulary;

[0025] According to the weighted word frequency of the traffic words, filtering out low-frequency traffic words from the traffic word sequence;

[0026] Calculate the word frequency weight of each low-frequency word in the sliding time window, and smooth each low-frequency word according to the word frequency weight to obtain a smoothed low-frequency word.

[0027] According to the dimensional changes of the word vector space of the low-frequency words in the smooth flow in different sliding time windows, the word vector dimensional mutation characteristics of the low-frequency words in the smooth flow are determined;

[0028] The exponential moving average method is used to smooth the mutation characteristics of the word vector dimension. The word vector dimension of each low-frequency word in the traffic in the word vector space is continuously optimized through multiple iterations until the word vector dimension reaches the preset convergence threshold, forming a traffic word vector optimization space.

[0029] In a further embodiment, the step of performing cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set includes:

[0030] Clustering the traffic word vectors in the traffic word vector optimization space using a density peak clustering algorithm to obtain the local density of each of the traffic word vectors and its minimum distance from a high-density point;

[0031] The product of the local density and the minimum distance from the high-density point is used as a cluster center decision point, and the cluster center of the traffic word vector optimization space is determined according to the cluster center decision point and a preset decision threshold;

[0032] Calculate the Euclidean distance from each traffic word vector in the traffic word vector optimization space to the nearest cluster center, and if the local density of the traffic word vector is less than a preset abnormal word density threshold and the Euclidean distance is greater than a preset distance threshold, determine the traffic word vector as a potential abnormal word;

[0033] Calculating the comprehensive abnormality degree of each potential abnormal word by weight coefficient according to the relative density difference and relative distance difference between each potential abnormal word and the cluster center;

[0034] The potential abnormal words are sorted according to the comprehensive abnormality degree to obtain a traffic abnormality word set.

[0035] In a further embodiment, the mathematical expression of the comprehensive abnormality degree is:

[0036]

[0037] In the formula, is the comprehensive abnormality degree; is the relative density difference between the potential abnormal word i and the cluster center; is the relative distance difference between the potential abnormal word i and the cluster center; , is the weight coefficient.

[0038] In a further embodiment, the step of performing kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identifying dimension mutation points, and performing anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores includes:

[0039] Performing principal component analysis on the traffic anomaly vocabulary set to obtain key features of the traffic anomaly vocabulary;

[0040] The kernel density estimation method is used to estimate the distribution of the key features of traffic anomaly words in different dimensions, and the kernel density estimation model of each dimension is obtained;

[0041] According to the kernel density estimation model of each dimension, the KL divergence of the probability density function between adjacent dimensions is calculated. If the KL divergence is greater than a preset threshold, the distribution change point of the key features of the traffic anomaly vocabulary between adjacent dimensions is determined as a dimension mutation point;

[0042] Calculate the log-likelihood value of each traffic anomaly word in the neighborhood of the dimensional mutation point, and normalize the log-likelihood value to obtain the anomaly score in the neighborhood of each dimensional mutation point;

[0043] The anomaly scores are integrated using a weighted average method to obtain anomaly point scores.

[0044] In a further embodiment, the step of constructing the character combination pattern feature of the traffic vocabulary sequence, scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution, and obtaining the character sequence score comprises:

[0045] Extracting a character sequence of the traffic vocabulary sequence and constructing a character combination pattern feature of the character sequence;

[0046] According to the character combination pattern feature, the frequency of occurrence of the character combination of the traffic anomaly vocabulary set is counted to obtain the character combination frequency;

[0047] Modeling the character sequence using a Markov chain model, calculating the conditional probability of each character in the character sequence appearing, and obtaining a character transition probability distribution;

[0048] Encoding the character combination frequency and the character transition probability distribution into corresponding character combination frequency feature vectors and character transition probability distribution feature vectors respectively;

[0049] Constructing an extended feature vector according to each character in the character sequence, the character combination frequency feature vector and the character transition probability distribution feature vector;

[0050] Using the extended feature vector as an input of a conditional random field model, modeling the character sequence through the conditional random field model, and calculating the character-level anomaly probability;

[0051] The weighted log-likelihood sum method is used to aggregate each character-level anomaly probability into a word-level anomaly probability score to obtain a character sequence score.

[0052] In a further embodiment, the step of quantifying the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly vocabulary risk includes:

[0053] Constructing a multi-dimensional abnormal feature vector of a traffic vocabulary sequence according to the abnormal point score and the character sequence score;

[0054] Using the multi-dimensional abnormal feature vector as a network propagation feature, calculating the semantic similarity between different network propagation features;

[0055] Establish edge connections based on the co-occurrence relationship between different network communication features, and use the semantic similarity between different network communication features as edge weights to construct a vocabulary co-occurrence network;

[0056] The belief propagation algorithm is used to propagate abnormal information in the vocabulary sharing network, and the risk level of traffic abnormality vocabulary of each network propagation feature is iteratively updated;

[0057] According to the risk level of the traffic anomaly vocabulary, a high-risk traffic data packet is identified from the traffic anomaly vocabulary set.

[0058] In a further embodiment, the step of constructing a corresponding TCP reset packet according to the high-risk traffic data packet and synchronously injecting the TCP reset packet into the bidirectional communication flow to forcibly interrupt the connection includes:

[0059] Constructing a mapping relationship between the risk of abnormal traffic words and the blocking priority, and determining the blocking priority of the high-risk traffic data packet according to the mapping relationship;

[0060] Extract the TCP connection identification tuple in the high-risk traffic data packet, and generate a TCP reset packet according to the pre-built TCPReset packet generator and blocking priority; the TCP connection identification tuple includes the source IP, destination IP, source port, destination port, sequence number and confirmation number;

[0061] The TCP reset packet is injected into the network flow of both communicating parties at the same time to interrupt the connection between the two communicating parties.

[0062] In a second aspect, the present invention provides a network security threat bidirectional blocking system, the system comprising:

[0063] A data extraction module, used to extract application layer data from network traffic and convert the application layer data into a traffic vocabulary sequence;

[0064] An optimization learning module is used to optimize and learn the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space;

[0065] A clustering analysis module, used to perform clustering analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set;

[0066] A dimensional anomaly analysis module is used to perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimensional mutation points, and perform anomaly scoring according to the probability density of the dimensional mutation points in each dimension to obtain anomaly point scores;

[0067] A character anomaly analysis module, used to construct a character combination pattern feature of the traffic vocabulary sequence, and score the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution to obtain a character sequence score;

[0068] A security threat analysis module, configured to quantify the risk of abnormal traffic words according to the abnormal point score and the character sequence score, and identify high-risk traffic data packets according to the abnormal traffic word risk;

[0069] The bidirectional blocking module is used to construct a corresponding TCP reset packet according to the high-risk traffic data packet, and synchronously inject the TCP reset packet into the bidirectional communication flow to forcibly interrupt the connection.

[0070] The present invention provides a two-way blocking method and system for network security threats. The method extracts application layer data from network traffic and converts the application layer data into a traffic word sequence; optimizes and learns the word vector dimension mutation characteristics of low-frequency traffic words in the traffic word sequence to obtain a traffic word vector optimization space; clusters the traffic word vector optimization space to obtain a traffic anomaly word set; kernel density estimation is performed on the distribution of the traffic anomaly word set in different dimensions to identify dimensional mutation points, and anomaly scores are performed according to the probability density of the dimensional mutation points in each dimension to obtain anomaly point scores; character sequences of the traffic anomaly word set are scored according to character combination pattern characteristics and character transfer probability distribution to obtain character sequence scores; traffic anomaly word risk is obtained according to the anomaly point score and the character sequence score, and high-risk traffic data packets are identified according to the traffic anomaly word risk, a corresponding TCP reset packet is constructed, and the TCP reset packet is injected into a two-way communication flow to force the connection to be interrupted. Compared with the existing technology, this method deeply analyzes network traffic and optimizes word vector space clustering analysis. It combines comprehensive analysis of word vector dimension mutation characteristics and character combination patterns to block high-risk traffic data packets in real time, effectively preventing potential network security threats. It can adapt to the security monitoring needs of large-scale network traffic and improve the intelligence and real-time performance of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is a schematic diagram of a flow chart of a bidirectional blocking method for network security threats provided by an embodiment of the present invention;

[0072] Figure 2 It is a block diagram of a network security threat bidirectional blocking system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0073] The following specifically illustrates the implementation mode of the present invention in conjunction with the accompanying drawings. The embodiments are provided for illustrative purposes only and cannot be understood as limiting the present invention. The accompanying drawings are provided for reference and illustration only and do not constitute a limitation on the scope of patent protection of the present invention, because many changes can be made to the present invention without departing from the spirit and scope of the present invention.

[0074] refer to Figure 1 , an embodiment of the present invention provides a two-way blocking method for network security threats, such as Figure 1 As shown, the method comprises the following steps:

[0075] S1. Extract application layer data from network traffic and convert the application layer data into a traffic vocabulary sequence.

[0076] In this embodiment, the step of extracting application layer data from network traffic and converting the application layer data into a traffic vocabulary sequence includes:

[0077] Extracting application layer data from network traffic using deep packet inspection methods, and identifying application layer protocol features from the application layer data using protocol fingerprinting and port mapping methods;

[0078] Using a vocabulary-based segmentation method to segment the application layer data into an initial vocabulary sequence, and performing part-of-speech tagging on the initial vocabulary sequence to obtain a tagged vocabulary sequence;

[0079] According to the application layer protocol features and a preset protocol feature library, identifying unknown protocol flow data and known protocol flow data from the marked vocabulary sequence;

[0080] Vectorizing the known protocol traffic data using a long short-term memory network embedded with a self-attention mechanism to obtain a vocabulary vectorized semantic representation;

[0081] Extract features from unknown protocol traffic data to generate unknown protocol traffic feature vectors, and use density clustering algorithm to perform unsupervised learning on unknown protocol traffic feature vectors to obtain semantic representations of different categories of unknown protocol traffic.

[0082] According to the semantic representation of unknown protocol traffic and the semantic representation of vocabulary vectorization, a conditional random field model is used to identify key semantic elements; the key semantic elements include keywords and phrases;

[0083] The named entity recognition algorithm is used to identify the entities, relations and events of the key semantic elements, form structured information including the entities, relations and events, and convert the structured information into a structured traffic vocabulary sequence.

[0084] This embodiment uses deep packet inspection technology to analyze network traffic, extracts application layer data and application layer protocol features through protocol fingerprint recognition and port mapping methods, and then uses a vocabulary-based segmentation method to convert the application layer data into an initial vocabulary sequence and mark the part of speech to obtain a marked vocabulary sequence, thereby identifying unknown protocol traffic data and known protocol traffic data through comparative judgment of a preset protocol feature library, and using a long short-term memory network embedded with a self-attention mechanism to vectorize the vocabulary sequence, and using the self-attention mechanism to calculate the correlation weights between words to capture the contextual semantic relationship to obtain a vocabulary vectorized semantic representation; feature extraction is performed on the unknown protocol traffic data to generate an unknown protocol traffic feature vector, and a density clustering algorithm is used to perform unsupervised learning on the unknown protocol traffic feature vector to obtain different categories. Semantic representation of unknown protocol traffic. According to the semantic representation of unknown protocol traffic and the semantic representation of vocabulary vectorization, a conditional random field model is used for sequence labeling to extract key semantic elements including keywords and phrases. The training process of the conditional random field model includes feature function selection, parameter initialization, gradient descent optimization and other steps. Finally, a named entity recognition tool is used to extract structured information such as entities, relationships, and events from key semantic elements. The extracted structured information is constructed into a knowledge network through triple extraction technology to organize the final structured traffic vocabulary sequence. This embodiment combines deep packet inspection and semantic analysis technology to deeply analyze network traffic content, so as to effectively and accurately identify and defend against malicious activities in network traffic in the future, which is of great significance to improving the ability of network traffic monitoring and threat detection.

[0085] Specifically, the present embodiment pre-builds a protocol feature library, which may include feature strings of common network protocols such as HTTP, FTP, and SMTP. Each application layer data is compared byte by byte with the protocol feature library. If a match is successful, the protocol type is determined. For example, the "GET" or "POST" request method in the HTTP protocol, and the "EHLO" or "MAILFROM" command in SMTP. The present embodiment can compare the application layer data with the protocol features in the protocol feature library through a port mapping method to identify the protocol type of the application layer data. The port mapping method identifies the protocol by maintaining a mapping table between a port number and an application protocol. For example, port 80 is directly associated with the HTTP protocol, and port 21 is mapped to the FTP protocol, thereby achieving rapid protocol determination based on port information. Then, the present embodiment adopts a vocabulary-based segmentation method and part-of-speech tagging technology. The vocabulary-based segmentation method divides the application layer data into an initial vocabulary sequence by identifying natural separators such as punctuation marks and spaces, and then uses a hidden Markov model for part-of-speech tagging. The model comprehensively considers the probability of occurrence of words and the probability of transition between them, thereby inferring the initial part-of-speech sequence. In addition, the present embodiment introduces the long and short The long-term memory network (LSTM) and self-attention mechanism are used to capture long-term dependencies and important information in sequence data. The LSTM network effectively controls the flow of information through its unique input gate, forget gate and output gate design, while the self-attention mechanism further improves the sensitivity of the model to key information by calculating the attention weights of the query, key and value matrices. For the processing of unknown protocol traffic, this embodiment adopts the density clustering algorithm DBSCAN. By setting a reasonable neighborhood radius ε=0.5 and a minimum number of points MinPts=4, effective clustering of unknown traffic features is achieved, and semantic representations of unknown protocol traffic of different categories are obtained. According to the semantic representation of unknown protocol traffic and the semantic representation of vocabulary vectorization, the conditional random field model is used for sequence annotation to extract key semantic elements including keywords and phrases. The training process of the conditional random field model includes the steps of feature function selection, parameter initialization, gradient descent optimization, etc. Finally, the named entity recognition tool is used to extract structured information such as entities, relationships, and events from the key semantic elements. The extracted structured information is constructed into a knowledge network through the triple extraction technology to form the final structured traffic vocabulary sequence.

[0086] S2. Optimize and learn the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space.

[0087] In this embodiment, the step of optimizing and learning the word vector dimension mutation characteristics of the traffic low-frequency words in the traffic word sequence to obtain the traffic word vector optimization space includes:

[0088] The traffic vocabulary sequence is divided into a number of traffic vocabulary segments by using a sliding time window mechanism, and weighted word frequency statistics are performed on the traffic vocabulary segments in each sliding time window according to a preset attenuation factor to obtain a weighted word frequency of traffic vocabulary;

[0089] According to the weighted word frequency of the traffic words, filtering out low-frequency traffic words from the traffic word sequence;

[0090] Calculate the word frequency weight of each low-frequency word in the sliding time window, and smooth each low-frequency word according to the word frequency weight to obtain a smoothed low-frequency word.

[0091] According to the dimensional changes of the word vector space of the low-frequency words in the smooth flow in different sliding time windows, the word vector dimensional mutation characteristics of the low-frequency words in the smooth flow are determined;

[0092] The exponential moving average method is used to smooth the mutation characteristics of the word vector dimension. The word vector dimension of each low-frequency word in the traffic in the word vector space is continuously optimized through multiple iterations until the word vector dimension reaches the preset convergence threshold, forming a traffic word vector optimization space.

[0093] Specifically, this embodiment adopts a sliding time window mechanism to monitor the traffic vocabulary sequence in real time. Sliding time windows of different lengths can be set, such as daily, weekly, monthly or hourly, and slide every five minutes. In each sliding time window, this embodiment uses a preset attenuation factor to count the occurrence frequency of each word in the window to obtain the weighted word frequency of the traffic vocabulary. It should be noted that the attenuation factor introduced in this embodiment can smooth the influence of historical data, and its value can be set to 0.9. The calculation formula of the weighted word frequency of the traffic vocabulary is:

[0094]

[0095] In the formula, Weighting words for traffic words; is the decay factor; B is the word frequency in the historical window; It is the vocabulary frequency of the traffic vocabulary segment in the current sliding time window.

[0096] Then, this embodiment selects low-frequency traffic words from the traffic word sequence according to the weighted word frequency of the traffic words, and calculates the word frequency weight of each low-frequency traffic word in the sliding time window. The word frequency weight is obtained by dividing the word frequency of the low-frequency traffic word by the total number of words in the sliding time window. At the same time, this embodiment uses Good-Turing smoothing processing to optimize each low-frequency traffic word according to the word frequency weight. This embodiment can use word embedding technology (such as Word2Vec, GloVe, BERT, etc.) in natural language processing to train smoothed low-frequency traffic words to obtain word vectors for each word, and then analyze the dimensional changes in the word vector space in different sliding time windows in different sliding time windows. These dimensions that have changed significantly reflect the semantic changes or importance changes of low-frequency words in different time windows. This embodiment can determine the dimension mutation characteristics according to the size and frequency of the dimension changes. For example, a threshold can be set. When the change of a certain dimension exceeds the threshold, it is considered that the dimension has mutated. In order to smooth the mutation of the dimension, this embodiment In this example, the exponential moving average method (EMA) is used to smooth the mutation characteristics of the word vector dimension. Subsequently, based on the smoothed dimensional changes and task performance indicators (such as accuracy, loss function value, etc.), the dimension of the word vector is gradually adjusted in multiple iterations. When the adjustment range of the word vector dimension drops below the preset convergence threshold after multiple iterations, a traffic word vector optimization space is formed. The word vector dimension configuration in this space is regarded as the optimal or better solution, so that the final word vector space can better reflect the internal structure and rules of the traffic data and can more effectively represent the characteristics of the traffic data. This optimization process improves the expression ability of the word vector for the characteristics of the traffic data. In order to ensure that the optimization does not excessively change the meaning of the word, this embodiment calculates the cosine similarity of the traffic word vectors before and after optimization. If the cosine similarity is lower than the threshold value of 0.8, this embodiment can appropriately adjust the smoothing coefficient to improve its expression ability in the word vector space while maintaining the semantics. The optimized traffic word vector space can more accurately capture the characteristics of the traffic data, thereby improving the effect of traffic data analysis.

[0097] S3. Perform cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set.

[0098] In this embodiment, the step of performing cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set includes:

[0099] Clustering the traffic word vectors in the traffic word vector optimization space using a density peak clustering algorithm to obtain the local density of each of the traffic word vectors and its minimum distance from a high-density point;

[0100] The product of the local density and the minimum distance from the high-density point is used as a cluster center decision point, and the cluster center of the traffic word vector optimization space is determined according to the cluster center decision point and a preset decision threshold;

[0101] Calculate the Euclidean distance from each traffic word vector in the traffic word vector optimization space to the nearest cluster center, and if the local density of the traffic word vector is less than a preset abnormal word density threshold and the Euclidean distance is greater than a preset distance threshold, determine the traffic word vector as a potential abnormal word;

[0102] Calculating the comprehensive abnormality degree of each potential abnormal word by weight coefficient according to the relative density difference and relative distance difference between each potential abnormal word and the cluster center;

[0103] The potential abnormal words are sorted according to the comprehensive abnormality degree to obtain a traffic abnormality word set, wherein the mathematical expression of the comprehensive abnormality degree is:

[0104]

[0105] In the formula, is the comprehensive abnormality degree; is the relative density difference between the potential abnormal word i and the cluster center; is the relative distance difference between the potential abnormal word i and the cluster center; , is the weight coefficient.

[0106] Specifically, this embodiment adopts a density peak clustering algorithm (DPC) to perform efficient clustering analysis on the traffic word vectors in the traffic word vector optimization space, calculates the local density of each of the traffic word vectors and its minimum distance from the high-density point, and identifies potential cluster centers by using the two indicators of local density and its minimum distance from the high-density point. Among them, this embodiment obtains the local density by counting the number of points whose distance from each of the traffic word vectors is less than the cutoff distance, and the minimum distance from the high-density point is to find the nearest point with a higher local density and calculate its distance. Subsequently, the local density is determined based on the product of the local density and its minimum distance from the high-density point. The cluster center of the traffic word vector optimization space, this embodiment can set a preset decision threshold, screen out the cluster center decision point higher than the preset decision threshold as the final cluster center, thereby determining the cluster center distribution of the vocabulary. For the detection of potential abnormal words in traffic, this embodiment sets an abnormal word density threshold and a distance threshold to screen potential abnormal words. If its local density is lower than the preset abnormal word density threshold and the Euclidean distance is greater than the preset distance threshold, it is preliminarily determined as a potential abnormal word. In order to further quantify the degree of abnormality, this embodiment calculates the relative density difference and the relative distance difference, and determines the weight coefficient through cross-validation. and , to evaluate the comprehensive abnormality degree, sort the potential abnormal words according to the comprehensive abnormality degree, and classify the abnormal words of the traffic word vector according to the sorting result, and divide the abnormal words into high, moderate and mild abnormalities. This embodiment takes an actual application scenario containing 10,000 100-dimensional word vectors as an example, determines the cluster center through precise calculation and screening, and effectively identifies potential abnormal words. For example, a word vector B is judged as moderately abnormal due to its low local density and distance from the cluster center.

[0107] S4. Perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimension mutation points, and perform anomaly scoring based on the probability density of the dimension mutation points in each dimension to obtain anomaly point scores.

[0108] In this embodiment, the steps of performing kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identifying dimension mutation points, and performing anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores include:

[0109] Performing principal component analysis on the traffic anomaly vocabulary set to obtain key features of the traffic anomaly vocabulary;

[0110] The kernel density estimation method is used to estimate the distribution of the key features of traffic anomaly words in different dimensions, and the kernel density estimation model of each dimension is obtained;

[0111] According to the kernel density estimation model of each dimension, the KL divergence of the probability density function between adjacent dimensions is calculated. If the KL divergence is greater than a preset threshold, the distribution change point of the key features of the traffic anomaly vocabulary between adjacent dimensions is determined as a dimension mutation point;

[0112] Calculate the log-likelihood value of each traffic anomaly word in the neighborhood of the dimensional mutation point, and normalize the log-likelihood value to obtain the anomaly score in the neighborhood of each dimensional mutation point;

[0113] The anomaly scores are integrated using a weighted average method to obtain anomaly point scores.

[0114] Specifically, this embodiment uses principal component analysis (PCA) to reduce the dimension of the traffic anomaly vocabulary set, retains the principal components whose explained variance ratio reaches a preset threshold, and obtains the key features of the traffic anomaly vocabulary. This embodiment assumes that the original data is a 100-dimensional traffic anomaly word vector set containing 1000 samples. After PCA dimensionality reduction, the dimension is successfully reduced to 20 dimensions, while retaining 96.5% of the variance information; then the kernel density estimation (KDE) method is used to model the key features of the traffic anomaly vocabulary to capture the distribution characteristics of the values ​​in each dimension. This embodiment can select a Gaussian kernel function as the kernel function, and calculate the bandwidth parameter according to the Silverman criterion. The kernel density estimation method is used to construct a kernel function for each dimension. A corresponding probability density function is built to obtain a kernel density estimation model for each dimension, so as to use the kernel density estimation model to characterize the distribution characteristics of these key features in different dimensions; in order to identify the mutation characteristics of the word vector dimension, this embodiment calculates the KL divergence (Kullback-Leibler divergence) of the probability density function between adjacent dimensions in the value distribution according to the kernel density estimation model of each dimension, so as to quantify the significance of the distribution difference between these dimensions. If the KL divergence between adjacent dimensions is greater than a preset threshold, it is considered that the distribution characteristics of the traffic anomaly vocabulary between different dimensions have a mutation, and the distribution change point of the key features of the traffic anomaly vocabulary between adjacent dimensions is determined as the dimension mutation point. For example, assuming that the original data is In the case of a 100-dimensional traffic anomaly word vector set, this embodiment identifies three mutation points, which are located in the 5th, 12th and 18th dimensions respectively; in order to more accurately describe the distribution of each dimension, this embodiment performs Gaussian mixture model (GMM) modeling on the values ​​of each dimension, uses the expectation maximization (EM) algorithm to estimate the model parameters, and determines the optimal number of Gaussian components for each dimension through the Bayesian Information Criterion (BIC). For example, the optimal number of components for the first dimension is 3, the second dimension is 2, and so on. This embodiment calculates the log-likelihood value of each data point (each traffic anomaly word in the traffic anomaly word set) in the neighborhood of the dimensional mutation point or the affected area based on the kernel density estimation model. These log-likelihood values ​​reflect The degree to which the data point deviates from the normal distribution near the mutation point is used to evaluate the impact of the mutation point on the data distribution. Taking a mutation point in a certain dimension as an example, its log likelihood value in the first dimension is -5.2. Subsequently, this embodiment uses the min-max normalization method to map the log likelihood value to the interval [0, 1], and obtains an abnormal score of 0.78 for the mutation point in the first dimension. Finally, this embodiment uses the weighted average method to integrate the abnormal scores to obtain the abnormal point score, where the abnormal point score is proportional to the degree of mutation of the dimension. For example, the weight of the 5th dimension is set to 0.3, the 12th dimension is 0.25, and the 18th dimension is 0.2. The remaining 0.25 is evenly distributed to the remaining dimensions (that is, each is 0.0125), this embodiment obtains the abnormality score of the mutation point of this dimension as 0.72 through weighted average. .

[0115] S5. Constructing the character combination pattern features of the traffic vocabulary sequence, scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern features and the character transition probability distribution, and obtaining a character sequence score.

[0116] In this embodiment, the steps of constructing the character combination pattern feature of the traffic vocabulary sequence, scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution, and obtaining the character sequence score include:

[0117] Extracting a character sequence of the traffic vocabulary sequence and constructing a character combination pattern feature of the character sequence;

[0118] According to the character combination pattern feature, the frequency of occurrence of the character combination of the traffic anomaly vocabulary set is counted to obtain the character combination frequency;

[0119] Modeling the character sequence using a Markov chain model, calculating the conditional probability of each character in the character sequence appearing, and obtaining a character transition probability distribution;

[0120] Encoding the character combination frequency and the character transition probability distribution into corresponding character combination frequency feature vectors and character transition probability distribution feature vectors respectively;

[0121] Constructing an extended feature vector according to each character in the character sequence, the character combination frequency feature vector and the character transition probability distribution feature vector;

[0122] Using the extended feature vector as an input of a conditional random field model, modeling the character sequence through the conditional random field model, and calculating the character-level anomaly probability;

[0123] The weighted log-likelihood sum method is used to aggregate each character-level anomaly probability into a word-level anomaly probability score to obtain a character sequence score.

[0124] Since the accuracy of the anomaly point scoring and the character sequence scoring directly affects the quality of the multi-dimensional anomaly feature vector, the present embodiment adopts the above implementation process to ensure the accuracy of the scoring, so that the subsequent steps can accurately reflect the abnormal characteristics of the traffic vocabulary sequence and improve the accuracy and reliability of the analysis results. Specifically, the present embodiment adopts a variable-length n-gram model (n-gram, n=2 to 5) to construct the character combination pattern feature of the character sequence. Then, the present embodiment performs statistics on the character sequence in the traffic vocabulary sequence according to the character combination pattern feature, calculates the frequency of occurrence of character combinations from 2-gram to 5-gram, obtains the character combination frequency, and encodes the character combination frequency into a character combination frequency feature vector. Then, the present embodiment adopts a Markov chain model to model the character sequence, calculates the conditional probability of occurrence of each character, obtains the character transition probability distribution, and encodes the character transition probability distribution into a character transition probability distribution feature vector; each character in the character sequence, the character combination frequency feature vector and the character transition probability distribution feature vector are constructed as an extended feature vector. In order to more accurately evaluate the character sequence of the traffic anomaly vocabulary, the present embodiment uses a conditional random field (CRF) for modeling. In the CRF model, the present embodiment converts the character The character is regarded as an observation value, and the abnormality degree of the character is regarded as a hidden state. In this embodiment, the extended feature vector is used as the input of the CRF model, and the CRF model is trained to learn the dependency relationship between characters and the mapping from characters to abnormal probabilities, so that the character sequence can be decoded using the trained CRF model to calculate the abnormality probability of each character. In this step, the CRF model determines the abnormality degree of each character by considering the character itself, the frequency of character combinations around it, and the character transition probability. In order to capture the dependency relationship between characters and extract character semantic information, this embodiment integrates character-level word embedding technology. At the same time, for low-frequency words, this The embodiment adopts a fallback model, and falls back to a low-order n-gram when the high-order n-gram probability is unreliable. Based on the trained CRF model, the embodiment calculates the abnormal probability of each character of the traffic abnormality vocabulary. Subsequently, the embodiment adopts a weighted log-likelihood sum method to aggregate the character-level abnormal probability into a vocabulary-level abnormal probability to obtain a character sequence score. The character sequence score takes into account factors such as character position, n-gram order, and character combination frequency to ensure the rationality and accuracy of the score. Finally, the embodiment normalizes the character sequence score results and maps them to the [0, 1] interval for easy comparison and interpretation.

[0125] S6. According to the abnormal point score and the character sequence score, the traffic anomaly vocabulary risk is quantified, and high-risk traffic data packets are identified according to the traffic anomaly vocabulary risk.

[0126] In this embodiment, the steps of quantifying the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly vocabulary risk include:

[0127] Constructing a multi-dimensional abnormal feature vector of a traffic vocabulary sequence according to the abnormal point score and the character sequence score;

[0128] Using the multi-dimensional abnormal feature vector as a network propagation feature, calculating the semantic similarity between different network propagation features;

[0129] Establish edge connections based on the co-occurrence relationship between different network communication features, and use the semantic similarity between different network communication features as edge weights to construct a vocabulary co-occurrence network;

[0130] The belief propagation algorithm is used to propagate abnormal information in the vocabulary sharing network, and the risk level of traffic abnormality vocabulary of each network propagation feature is iteratively updated;

[0131] According to the risk level of the traffic anomaly vocabulary, a high-risk traffic data packet is identified from the traffic anomaly vocabulary set.

[0132] Specifically, this embodiment constructs a multi-dimensional abnormal feature vector of the traffic vocabulary sequence based on the abnormal point score, the character sequence score, and additional features such as word frequency and word length. In order to eliminate the influence of different feature dimensions, the Z-score standardization method is used to process these features, calculate the mean and standard deviation of each feature, and convert the feature value into a unified scale. Specifically, this embodiment can determine the dimension of the multi-dimensional feature vector according to the abnormal point score and the character sequence score. For example, if the abnormal point score includes three dimensions of frequency abnormality, pattern abnormality and context abnormality, and the character sequence score includes two dimensions of character complexity and repetition, then the multi-dimensional feature vector contains at least five dimensions. For each traffic vocabulary sequence, the corresponding feature value is extracted according to the abnormal point score and the character sequence score. These features The values ​​will constitute the various components of the multidimensional feature vector. In order to improve the efficiency and accuracy of subsequent analysis or model training, it is usually necessary to standardize or normalize the extracted feature values ​​to ensure that they are in the same numerical range. Then, the multidimensional abnormal feature vector is regarded as a network propagation feature, and the semantic similarity between these network propagation features is calculated using natural language processing (NLP) technology. Based on the co-occurrence relationship and semantic similarity between different network propagation features, a vocabulary co-occurrence network is constructed. In this network, each network propagation feature corresponds to a node, and an edge connection is established between the co-occurrence relationship (such as appearing in multiple data packets at the same time) and the features with high semantic similarity, and the semantic similarity is used as the weight of the edge. In the vocabulary co-occurrence network, this embodiment uses a belief propagation algorithm (such as Loopy Belief Propagation) is used to propagate abnormal information. Each node receives messages from neighboring nodes and updates its own abnormal beliefs, thereby iteratively updating the traffic anomaly word risk of each network propagation feature. The algorithm propagates abnormal information in the network so that nodes connected to high-risk nodes also obtain higher risk assessments. According to the traffic anomaly word risk of each network propagation feature, words with traffic anomaly word risk exceeding the set threshold are screened out from the traffic anomaly word set, and then the data packets containing these words are identified as high-risk traffic data packets.

[0133] S7. Construct a corresponding TCP reset packet according to the high-risk traffic data packet, and synchronously inject the TCP reset packet into the two-way communication flow to forcibly interrupt the connection.

[0134] The step of constructing a corresponding TCP reset packet according to the high-risk traffic data packet and synchronously injecting the TCP reset packet into the bidirectional communication flow to forcibly interrupt the connection includes:

[0135] Constructing a mapping relationship between the risk of abnormal traffic words and the blocking priority, and determining the blocking priority of the high-risk traffic data packet according to the mapping relationship;

[0136] Extract the TCP connection identification tuple in the high-risk traffic data packet, and generate a TCP reset packet according to the pre-built TCPReset packet generator and blocking priority; the TCP connection identification tuple includes the source IP, destination IP, source port, destination port, sequence number and confirmation number;

[0137] The TCP reset packet is injected into the network flow of both communicating parties at the same time to interrupt the connection between the two communicating parties.

[0138] This embodiment pre-constructs a mapping relationship between the risk of abnormal traffic words and the blocking priority, and according to the mapping relationship, assigns a corresponding blocking priority to each high-risk traffic data packet, and at the same time inputs the TCP connection identification tuple and the blocking priority of the high-risk traffic data packet into a pre-constructed TCPReset packet generator. The TCPReset packet generator dynamically adjusts the specific parameters of the reset packet (such as reset reason code, timestamp, etc.) according to the TCP connection identification tuple and the blocking priority, and generates a TCP reset packet with targeted parameters to ensure the effectiveness and concealment of the reset operation, wherein a high-priority data packet will trigger more urgent or stricter blocking measures, such as immediately disconnecting the connection and recording detailed logs, using The network traffic analysis and control technology accurately and simultaneously injects the TCP reset packet into the network flow of both communicating parties, ensuring the immediacy and synchronization of the interruption operation, so that both parties can receive the reset packet, thereby realizing the immediate interruption of the connection. When both communicating parties receive the TCP reset packet, according to the provisions of the TCP protocol, the current communication connection will be terminated immediately. In summary, this embodiment constructs and injects TCP reset packets according to high-risk traffic data packets to interrupt the connection, which can not only effectively identify and block the communication connection containing network traffic with potential security threats, thereby ensuring the security and stability of network communications, but also because the injection method of the TCP Reset packet is highly concealed and synchronous, this embodiment adopts an active response mechanism based on the TCP Reset packet to block the identified high-risk traffic data packets in real time, ensuring that the system can respond quickly when an abnormality is found, reducing the risk of being detected and evaded by attackers.

[0139] The embodiment of the present invention provides a bidirectional blocking method for network security threats, the method comprising extracting application layer data in network traffic and converting the application layer data into a traffic word sequence; optimizing and learning the word vector dimension mutation characteristics of low-frequency traffic words in the traffic word sequence to obtain a traffic word vector optimization space; clustering analysis of the traffic word vector optimization space to obtain a traffic anomaly word set; performing kernel density estimation on the distribution of the traffic anomaly word set in different dimensions to identify dimensional mutation points, and performing anomaly scoring according to the probability density of the dimensional mutation points in each dimension to obtain anomaly point scores; constructing character combination pattern features of the traffic word sequence, scoring the character sequence of the traffic anomaly word set according to the character combination pattern features and the character transition probability distribution to obtain a character sequence score; quantifying the traffic anomaly word risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly word risk; constructing a corresponding TCP reset packet according to the high-risk traffic data packet, and injecting the TCP reset packet into a bidirectional communication flow to forcefully interrupt the connection. Compared with the prior art, the method proposed in this embodiment deeply analyzes network traffic, extracts and converts it into vocabulary sequences from application layer data, uses optimized traffic word vector space for cluster analysis, and combines comprehensive analysis of word vector dimension mutation characteristics and character combination patterns. It significantly improves the recognition granularity of high-risk traffic data packets, realizes accurate identification, efficient evaluation and real-time blocking of high-risk vocabulary data packets, significantly improves the intelligence and real-time performance of network security protection, and provides strong support for building a secure and trusted network environment.

[0140] It should be noted that the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0141] In one embodiment, Figure 2 As shown, an embodiment of the present invention provides a network security threat bidirectional blocking system, the system comprising:

[0142] The data extraction module 101 is used to extract application layer data from network traffic and convert the application layer data into a traffic vocabulary sequence;

[0143] An optimization learning module 102 is used to optimize and learn the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain a traffic word vector optimization space;

[0144] A cluster analysis module 103 is used to perform cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set;

[0145] The dimension anomaly analysis module 104 is used to perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimension mutation points, and perform anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores;

[0146] The character anomaly analysis module 105 is used to construct the character combination pattern characteristics of the traffic vocabulary sequence, and score the character sequence of the traffic anomaly vocabulary set according to the character combination pattern characteristics and the character transition probability distribution to obtain a character sequence score;

[0147] The security threat analysis module 106 is used to quantify the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identify high-risk traffic data packets according to the traffic anomaly vocabulary risk;

[0148] The bidirectional blocking module 107 is used to construct a corresponding TCP reset packet according to the high-risk traffic data packet, and synchronously inject the TCP reset packet into the bidirectional communication flow to forcibly interrupt the connection.

[0149] For the specific definition of a network security threat bidirectional blocking system, please refer to the above-mentioned definition of a network security threat bidirectional blocking method, which will not be repeated here. Those of ordinary skill in the art will appreciate that the various modules and steps described in conjunction with the embodiments disclosed in this application can be implemented in hardware, software, or a combination of both. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0150] The embodiment of the present invention provides a bidirectional blocking system for network security threats. The system extracts application layer data in network traffic through a data extraction module and converts the application layer data into a traffic word sequence; optimizes and learns the word vector dimension mutation characteristics of low-frequency words in the traffic word sequence through an optimization learning module to obtain a traffic word vector optimization space; clusters and analyzes the traffic word vector optimization space through a cluster analysis module to obtain a traffic abnormality word set; kernel density estimation is performed on the distribution of the traffic abnormality word set in different dimensions through a dimension abnormality analysis module to identify dimension mutation points, and an abnormality score is performed according to the probability density of the dimension mutation point in each dimension to obtain an abnormal point score; character combination pattern characteristics of the traffic word sequence are constructed through a character abnormality analysis module, and the character sequence of the traffic abnormality word set is scored according to the character combination pattern characteristics and the character transition probability distribution to obtain a character sequence score; the security threat analysis module quantifies the traffic abnormality word risk according to the abnormal point score and the character sequence score, and identifies high-risk traffic data packets according to the traffic abnormality word risk; a corresponding TCP reset packet is constructed according to the high-risk traffic data packet, and the TCP reset packet is injected into a bidirectional communication flow to force the connection to be interrupted. Compared with the existing technology, the system proposed in this embodiment deeply analyzes network traffic, extracts and converts it into vocabulary sequences from application layer data, uses optimized traffic word vector space for cluster analysis, and combines comprehensive analysis of word vector dimension mutation characteristics and character combination patterns. It significantly improves the recognition granularity of high-risk traffic data packets, realizes accurate identification, efficient evaluation and real-time blocking of high-risk vocabulary data packets, significantly improves the intelligence and real-time performance of network security protection, and provides strong support for building a secure and trusted network environment.

[0151] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A two-way blocking method for network security threats, characterized in that: The following steps are involved: Extracting application layer data from network traffic and converting the application layer data into a traffic vocabulary sequence; Optimizing and learning the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space; Performing cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set; Perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimension mutation points, and perform anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores; Constructing a character combination pattern feature of the traffic vocabulary sequence, and scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution to obtain a character sequence score; quantifying the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly vocabulary risk; Constructing a corresponding TCP reset packet according to the high-risk traffic data packet, and synchronously injecting the TCP reset packet into the bidirectional communication flow to forcefully interrupt the connection; The step of optimizing and learning the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space includes: The traffic vocabulary sequence is divided into a number of traffic vocabulary segments by using a sliding time window mechanism, and weighted word frequency statistics are performed on the traffic vocabulary segments in each sliding time window according to a preset attenuation factor to obtain a weighted word frequency of traffic vocabulary; According to the weighted word frequency of the traffic words, filtering out low-frequency traffic words from the traffic word sequence; Calculate the word frequency weight of each low-frequency word in the sliding time window, and smooth each low-frequency word according to the word frequency weight to obtain a smoothed low-frequency word. According to the dimensional changes of the word vector space of the low-frequency words in the smooth flow in different sliding time windows, the word vector dimensional mutation characteristics of the low-frequency words in the smooth flow are determined; The exponential moving average method is used to smooth the mutation characteristics of the word vector dimension. The word vector dimension of each low-frequency word in the traffic in the word vector space is continuously optimized through multiple iterations until the word vector dimension reaches the preset convergence threshold, forming a traffic word vector optimization space; The step of constructing the character combination pattern feature of the traffic vocabulary sequence, scoring the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution, and obtaining the character sequence score comprises: Extracting a character sequence of the traffic vocabulary sequence, and constructing a character combination pattern feature of the character sequence using a variable-length n-gram model; According to the character combination pattern feature, the frequency of occurrence of the character combination of the traffic anomaly vocabulary set is counted to obtain the character combination frequency; Modeling the character sequence using a Markov chain model, calculating the conditional probability of each character in the character sequence appearing, and obtaining a character transition probability distribution; Encoding the character combination frequency and the character transition probability distribution into corresponding character combination frequency feature vectors and character transition probability distribution feature vectors respectively; Constructing an extended feature vector according to each character in the character sequence, the character combination frequency feature vector and the character transition probability distribution feature vector; Using the extended feature vector as an input of a conditional random field model, modeling the character sequence through the conditional random field model, and calculating the character-level anomaly probability; The weighted log-likelihood sum method is used to aggregate each character-level anomaly probability into a word-level anomaly probability score to obtain a character sequence score; The step of constructing a corresponding TCP reset packet according to the high-risk traffic data packet and synchronously injecting the TCP reset packet into the bidirectional communication flow to forcibly interrupt the connection includes: Constructing a mapping relationship between the risk of abnormal traffic words and the blocking priority, and determining the blocking priority of the high-risk traffic data packet according to the mapping relationship; Extract the TCP connection identification tuple in the high-risk traffic data packet, and generate a TCP reset packet according to the pre-built TCPReset packet generator and blocking priority; the TCP connection identification tuple includes the source IP, destination IP, source port, destination port, sequence number and confirmation number; The TCP reset packet is injected into the network flow of both communicating parties at the same time to interrupt the connection between the two communicating parties.

2. A two-way blocking method for network security threats according to claim 1, characterized in that: The step of extracting application layer data from network traffic and converting the application layer data into a traffic vocabulary sequence comprises: Extracting application layer data from network traffic using deep packet inspection methods, and identifying application layer protocol features from the application layer data using protocol fingerprinting and port mapping methods; Using a vocabulary-based segmentation method to segment the application layer data into an initial vocabulary sequence, and performing part-of-speech tagging on the initial vocabulary sequence to obtain a tagged vocabulary sequence; According to the application layer protocol features and a preset protocol feature library, identifying unknown protocol flow data and known protocol flow data from the marked vocabulary sequence; Vectorizing the known protocol traffic data using a long short-term memory network embedded with a self-attention mechanism to obtain a vocabulary vectorized semantic representation; Extract features from unknown protocol traffic data to generate unknown protocol traffic feature vectors, and use density clustering algorithm to perform unsupervised learning on unknown protocol traffic feature vectors to obtain semantic representations of different categories of unknown protocol traffic. According to the semantic representation of unknown protocol traffic and the semantic representation of vocabulary vectorization, a conditional random field model is used to identify key semantic elements; the key semantic elements include keywords and phrases; The named entity recognition algorithm is used to identify the entities, relations and events of the key semantic elements, form structured information containing the entities, relations and events, and convert the structured information into a structured traffic vocabulary sequence.

3. A two-way blocking method for network security threats according to claim 1, characterized in that: The step of performing cluster analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set includes: Clustering the traffic word vectors in the traffic word vector optimization space using a density peak clustering algorithm to obtain the local density of each of the traffic word vectors and its minimum distance from a high-density point; The product of the local density and the minimum distance from the high-density point is used as a cluster center decision point, and the cluster center of the traffic word vector optimization space is determined according to the cluster center decision point and a preset decision threshold; Calculate the Euclidean distance from each traffic word vector in the traffic word vector optimization space to the nearest cluster center, and if the local density of the traffic word vector is less than a preset abnormal word density threshold and the Euclidean distance is greater than a preset distance threshold, determine the traffic word vector as a potential abnormal word; Calculating the comprehensive abnormality degree of each potential abnormal word by weight coefficient according to the relative density difference and relative distance difference between each potential abnormal word and the cluster center; The potential abnormal words are sorted according to the comprehensive abnormality degree to obtain a traffic abnormality word set.

4. A two-way blocking method for network security threats as claimed in claim 3, characterized in that: The mathematical expression of the comprehensive abnormality degree is: In the formula, is the comprehensive abnormality degree; is the relative density difference between the potential abnormal word i and the cluster center; is the relative distance difference between the potential abnormal word i and the cluster center; , is the weight coefficient.

5. A two-way blocking method for network security threats as claimed in claim 1, characterized in that: The step of performing kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identifying dimension mutation points, and performing anomaly scoring according to the probability density of the dimension mutation points in each dimension to obtain anomaly point scores includes: Performing principal component analysis on the traffic anomaly vocabulary set to obtain key features of the traffic anomaly vocabulary; The kernel density estimation method is used to estimate the distribution of the key features of traffic anomaly words in different dimensions, and the kernel density estimation model of each dimension is obtained; According to the kernel density estimation model of each dimension, the KL divergence of the probability density function between adjacent dimensions is calculated. If the KL divergence is greater than a preset threshold, the distribution change point of the key features of the traffic anomaly vocabulary between adjacent dimensions is determined as a dimension mutation point; Calculate the log-likelihood value of each traffic anomaly word in the neighborhood of the dimensional mutation point, and normalize the log-likelihood value to obtain the anomaly score in the neighborhood of each dimensional mutation point; The anomaly scores are integrated using a weighted average method to obtain anomaly point scores.

6. A two-way blocking method for network security threats as claimed in claim 1, characterized in that: The step of quantifying the traffic anomaly vocabulary risk according to the anomaly point score and the character sequence score, and identifying high-risk traffic data packets according to the traffic anomaly vocabulary risk includes: Constructing a multi-dimensional abnormal feature vector of a traffic vocabulary sequence according to the abnormal point score and the character sequence score; Using the multi-dimensional abnormal feature vector as a network propagation feature, calculating the semantic similarity between different network propagation features; Establish edge connections based on the co-occurrence relationship between different network communication features, and use the semantic similarity between different network communication features as edge weights to construct a vocabulary co-occurrence network; The belief propagation algorithm is used to propagate abnormal information in the vocabulary sharing network, and the risk level of traffic abnormality vocabulary of each network propagation feature is iteratively updated; According to the risk level of the traffic anomaly vocabulary, a high-risk traffic data packet is identified from the traffic anomaly vocabulary set.

7. A two-way blocking system for network security threats, characterized in that: The system comprises: A data extraction module, used to extract application layer data from network traffic and convert the application layer data into a traffic vocabulary sequence; An optimization learning module is used to optimize and learn the word vector dimension mutation characteristics of the low-frequency traffic words in the traffic word sequence to obtain the traffic word vector optimization space; A clustering analysis module, used to perform clustering analysis on the traffic word vector optimization space to obtain a traffic anomaly vocabulary set; A dimensional anomaly analysis module is used to perform kernel density estimation on the distribution of the traffic anomaly vocabulary set in different dimensions, identify dimensional mutation points, and perform anomaly scoring according to the probability density of the dimensional mutation points in each dimension to obtain anomaly point scores; A character anomaly analysis module, used to construct a character combination pattern feature of the traffic vocabulary sequence, and score the character sequence of the traffic anomaly vocabulary set according to the character combination pattern feature and the character transition probability distribution to obtain a character sequence score; A security threat analysis module, configured to quantify the risk of traffic anomaly words according to the anomaly point score and the character sequence score, and identify high-risk traffic data packets according to the traffic anomaly words risk; A bidirectional blocking module, used to construct a corresponding TCP reset packet according to the high-risk traffic data packet, and synchronously inject the TCP reset packet into the bidirectional communication flow to forcefully interrupt the connection; Wherein, the optimization learning module is specifically used for: The traffic vocabulary sequence is divided into a number of traffic vocabulary segments by using a sliding time window mechanism, and weighted word frequency statistics are performed on the traffic vocabulary segments in each sliding time window according to a preset attenuation factor to obtain a weighted word frequency of traffic vocabulary; According to the weighted word frequency of the traffic words, filtering out low-frequency traffic words from the traffic word sequence; Calculate the word frequency weight of each low-frequency word in the sliding time window, and smooth each low-frequency word according to the word frequency weight to obtain a smoothed low-frequency word. According to the dimensional changes of the word vector space of the low-frequency words in the smooth flow in different sliding time windows, the word vector dimensional mutation characteristics of the low-frequency words in the smooth flow are determined; The exponential moving average method is used to smooth the mutation characteristics of the word vector dimension. The word vector dimension of each low-frequency word in the traffic in the word vector space is continuously optimized through multiple iterations until the word vector dimension reaches the preset convergence threshold, forming a traffic word vector optimization space; The character anomaly analysis module is specifically used for: Extracting a character sequence of the traffic vocabulary sequence, and constructing a character combination pattern feature of the character sequence using a variable-length n-gram model; According to the character combination pattern feature, the frequency of occurrence of the character combination of the traffic anomaly vocabulary set is counted to obtain the character combination frequency; Modeling the character sequence using a Markov chain model, calculating the conditional probability of each character in the character sequence appearing, and obtaining a character transition probability distribution; Encoding the character combination frequency and the character transition probability distribution into corresponding character combination frequency feature vectors and character transition probability distribution feature vectors respectively; Constructing an extended feature vector according to each character in the character sequence, the character combination frequency feature vector and the character transition probability distribution feature vector; Using the extended feature vector as an input of a conditional random field model, modeling the character sequence through the conditional random field model, and calculating the character-level anomaly probability; The weighted log-likelihood sum method is used to aggregate each character-level anomaly probability into a word-level anomaly probability score to obtain a character sequence score; The bidirectional blocking module is specifically used for: Constructing a mapping relationship between the risk of abnormal traffic words and the blocking priority, and determining the blocking priority of the high-risk traffic data packet according to the mapping relationship; Extract the TCP connection identification tuple in the high-risk traffic data packet, and generate a TCP reset packet according to the pre-built TCPReset packet generator and blocking priority; the TCP connection identification tuple includes the source IP, destination IP, source port, destination port, sequence number and confirmation number; The TCP reset packet is injected into the network flow of both communicating parties at the same time to interrupt the connection between the two communicating parties.

Images