A method for detecting illegal interconnection at network boundaries

Abstract

The present invention discloses a method for detecting illegal interconnection at a network boundary, which specifically relates to the technical field of network security; the existing illegal interconnection detection technology relies on static rules, lacks self-adaptation and automatic updating, and leads to missed reports, false reports and low efficiency. The present invention includes collecting network data and using an isolated forest training model to construct an abnormal data source; real-time monitoring of network data passing through a secure data source, and optimizing feedback of the secure data source; constructing an illegal interconnection detection model to perform illegal interconnection detection on network data in the abnormal data source; the technical solution ensures accurate identification of abnormal data through a two-layer detection mechanism of basic level detection and deep level detection; the feedback mechanism can adjust the parameters and weights of the detection model in real time according to the detection results, dynamically optimize the construction and detection accuracy of the data source, and continuously monitor the abnormal data in the secure data source; and can detect illegal interconnection behaviors at network boundaries at different levels.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for detecting illegal interconnection at a network boundary. Background Art

[0002] Detection of illegal interconnections at the network boundary is a key issue in network security, and faces a variety of technical challenges, including encrypted traffic, APT attacks, complexity of cross-border traffic, evasion techniques, etc. At the same time, its detection is of great significance to ensuring the security of the network, not only preventing external attacks, but also reducing compliance risks, preventing internal abuse and data leakage, and improving the initiative and real-time response capabilities of network defense;

[0003] At present, the detection of illegal interconnection at the network boundary faces the following challenges:

[0004] Traditional network boundary detection methods mostly rely on single rule matching or static detection mechanisms, which are prone to missed reports or false positives when dealing with complex and dynamic network environments;

[0005] Existing technologies usually lack adaptive optimization mechanisms during the detection process and are unable to adjust detection models and data source construction strategies based on real-time monitoring results, resulting in reduced accuracy and efficiency of detection results. In particular, when facing large-scale network traffic, existing systems are difficult to achieve real-time feedback and optimization adjustments.

[0006] In existing illegal interconnection detection systems, the management and update mechanisms of security data sources and abnormal data sources often lack automated processing capabilities, which easily leads to the detection system using outdated data models, thereby reducing the detection effect. Summary of the invention

[0007] In view of the above-mentioned problems, the present invention proposes a network boundary illegal interconnection detection method, which can effectively solve the problem that the traditional network boundary detection method proposed in the above-mentioned background technology mostly relies on a single rule matching or static detection mechanism.

[0008] To solve the above technical problems, the present invention provides the following technical solutions: a method for detecting illegal interconnection at a network boundary, comprising the following steps:

[0009] Collect network data and use the Isolation Forest training model to construct anomaly data sources, including,

[0010] Collect real-time network data and build anomaly data sources using the Isolation Forest training model, specifically:

[0011] A two-layer detection mechanism is set up to detect the collected real-time network data, and an abnormal data source is constructed based on the detection, including:

[0012] Basic hierarchical detection based on cosine similarity and scoring model based on isolation forest algorithm, and abnormal data source is constructed according to the scoring model;

[0013] Monitor network data passing through secure data sources in real time and provide optimized feedback to secure data sources;

[0014] Construct an illegal interconnection detection model to detect illegal interconnections of network data in abnormal data sources, including:

[0015] The first layer of detection built by the rule matching algorithm and the second layer of detection built by the random forest algorithm are as follows:

[0016] Based on predefined rules, the data in the abnormal data source is matched to detect whether illegal interconnection behavior at the network boundary is triggered. The random forest algorithm is used to build an autonomous detection model for illegal interconnection, and illegal interconnection detection at the network boundary is realized based on the output results of the model.

[0017] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the basic level detection based on cosine similarity is as follows:

[0018] For the collected network data, the data of network boundary violations are collected from the database at the same time, and the two are constructed into vector data as well as , by comparing the similarities between the two, the basic level detection is completed, as follows:

[0019] Cosine similarity detection, then we have,

[0020]

[0021] in, Represents the vector data constructed by the collected network data, Represents vector data constructed from historical data extracted from the database, , They represent the modulus lengths of the two vectors, Indicates the similarity between the collected network data and historical data, and is used to filter abnormal data. The specific filtering is as follows:

[0022] According to the historical data in the database, two normal data and two abnormal data are extracted respectively, and the similarity of the normal data is calculated at the same time. and the similarity of abnormal data , based on the calculated similarity, we can complete the screening. Then,

[0023] When the similarity results between the collected network data and historical data satisfy the formula When , it indicates that the current data is normal data, and the current data is marked as normal data;

[0024] When the similarity results between the collected network data and historical data satisfy the formula When , it indicates that the current data is abnormal data, and the current data is marked as abnormal data;

[0025] When the similarity results between the collected network data and historical data satisfy the formula When the current data enters deep detection.

[0026] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the scoring model constructed based on the isolation forest algorithm is specifically as follows:

[0027]

[0028]

[0029]

[0030] in, Represents data points The length in the scoring model is the length from the root node to the current data point. The root node is constructed from abnormal data extracted from historical data and is set by the implementer according to the actual application scenario. Represents the expected path length, which is used to monitor abnormalities of different data points. Represents the total number of data points in the current time window, Represents data points The average path length in the scoring model, Represents the total number of abnormal data points in the current time window, Represents data points The distance to a random outlier data point, Indicates the local layer score of the data point in the current time window, where the time window is the time range of data collection;

[0031] Combining the data from multiple time windows in the past, we can calculate the abnormality of the data point in the long-term data pattern, and then we have:

[0032]

[0033] in, Indicates the upper limit of the number of time windows. represents the index of the time window, Indicates the weight of each time window, which is set by the implementer according to the fluctuation of network data. Represents a composite score of a data point calculated by combining data from multiple past time windows;

[0034] According to the calculated local score and comprehensive score, the global score of the data point in the scoring model is determined, then,

[0035]

[0036] in, Represents the adaptive fusion weight, which is set by the implementer according to the influence of the local score and the comprehensive score on the global score. represents the local layer score of the data point in the current time window, Represents the comprehensive score of a data point calculated by combining data from multiple time windows in the past. It indicates the score of the scoring model for the data detected by the basic level, which is used to provide a basis for building abnormal data sources.

[0037] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the construction of abnormal data source according to the scoring model is specifically as follows:

[0038] Use the data in the database that causes network anomalies, use the scoring model to score, and record the global score , by comparing the global scores of the two sets of data, the construction of the abnormal data source is completed. The specific construction is as follows:

[0039] If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , represents the data points and normal data in the current window, and is combined with the normal data detected at the basic level to build a secure data source;

[0040] If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , indicating that the data points in the current window are abnormal data, and are combined with the abnormal data detected at the basic level to construct an abnormal data source.

[0041] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the optimization feedback of the security data source is specifically as follows:

[0042] The secure data confirmed by deep-level detection is added to the secure data source to ensure the security of the data in the data;

[0043] At the same time, the detected new abnormal data is updated to the abnormal data source for subsequent detection;

[0044] For the update of abnormal data sources, if the amount of abnormal data detected in the security data source exceeds 30% of the overall data source, it means that the construction process of the data source in the previous article is abnormal. By adjusting the adaptive fusion weight in the previous article The construction of the data source is optimized according to the value of , until the amount of abnormal data in the network data detection process of the secure data source is less than 30% of the overall data source.

[0045] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the rule matching of data in the abnormal data source based on predefined rules is specifically as follows:

[0046] According to the fields extracted from the data, validation rules are formulated, including whitelist validation and blacklist validation.

[0047] The whitelist verification is a list set by security personnel containing legal network connection information, including safe source IP addresses, target IP addresses, protocols and port numbers;

[0048] The blacklist verification is set by security personnel to check for illegal and malicious connection information, including prohibited source IP addresses, target IP addresses, protocols, and port numbers;

[0049] According to the established verification rules, the data from abnormal data sources are checked for illegal interconnection at the network boundary.

[0050] Set the fields to extract network data from the current data. ,in, is the source IP address of the current data, is the target IP address of the current data, is the data protocol type of the current data, is the port number of the current data, is the collection timestamp of the current data, and the whitelist is , the blacklist is ;

[0051] Verify according to the set black and white lists, then there are,

[0052] When the data field satisfies the formula When , it means that the current data field meets the whitelist's test for the data field, and the data corresponding to the current data field does not trigger illegal interconnection at the network boundary;

[0053] When the data field satisfies the formula When , it means that the current data field meets the blacklist's test for the data field, and the data corresponding to the current data field triggers illegal interconnection at the network boundary;

[0054] When the data field does not fully meet the field detection of the whitelist or the field detection of the blacklist, it is impossible to determine whether the current data triggers illegal interconnection at the network boundary through the first layer detection. The current data is recorded and further determined through the second layer detection to detect whether the current data triggers illegal interconnection at the network boundary.

[0055] As a preferred solution of the network boundary illegal interconnection detection method described in the present invention, the illegal interconnection autonomous detection model constructed by using the random forest algorithm is specifically as follows:

[0056] For network data that passes the first layer detection mechanism , and prepare normal network behavior data with the same fields as the current network data , and construct the two types of data into a labeled dataset, which is a labeled binary classification dataset, including the network data to be detected and the normal network behavior data, and each piece of data has a corresponding label , and the label value is the behavior to be detected and the normal network behavior, then,

[0057]

[0058] in, Indicates The feature vector of a piece of network data includes the source IP address, the destination IP address, the data protocol type, the port number, and the acquisition timestamp. Indicates The label of the data, a value of 0 indicates normal network behavior, and a value of 1 indicates behavior to be detected;

[0059] The constructed dataset is divided into a training set and a test set, with 80% used for training and 20% for testing;

[0060] The random forest algorithm is used to build a binary classification model, and the training set is used to train the model. At the same time, the accuracy of the model is evaluated using the test set, as follows:

[0061] Randomly select multiple features from the data set to build a decision tree;

[0062] Use each decision tree to classify the input features, collect the classification results of all decision trees, and select the classification result with the most votes as the final output, then we have,

[0063]

[0064] in, Represents the random forest for the input feature vector The classification output represents the input sample The probability of illegal interconnection behavior, represents the number of decision trees constructed, Indicates A decision tree for input features The classification result is 0, which indicates normal network behavior, and 1, which indicates illegal Internet behavior.

[0065] As a preferred solution of the network boundary illegal interconnection detection system of the present invention, the illegal interconnection detection of the network boundary is realized according to the output result of the model as follows:

[0066] If the final output satisfies the formula , it means that the network data corresponding to the current input sample is an illegal interconnection behavior, otherwise it means that the network data corresponding to the current input sample is a normal network behavior, where represents the probability threshold;

[0067] For illegal interconnection detection of network data, if the detection result is illegal interconnection behavior, the current network data will be blocked from connecting to the network, an early warning will be issued, and the current illegal interconnection behavior will be recorded. If the detection result is normal network behavior, the current network data will be classified as a safe data source for recording;

[0068] For the detection results, the test set is used for optimization verification, as follows:

[0069]

[0070] in, represents the amount of data correctly identified as violations, Indicates the amount of data correctly identified as normal network behavior. represents the amount of data that was incorrectly identified as a violation, Indicates the amount of data that is incorrectly identified as normal network behavior. Indicates the accuracy of the model and must satisfy the formula , indicating that the accuracy of the constructed model meets the requirements for illegal interconnection detection at the network boundary, otherwise it does not meet the requirements for illegal interconnection detection at the network boundary. The model is trained twice using the training set until the requirements are met. is the verification threshold.

[0071] Beneficial effects of the present invention: The present invention can ensure accurate identification of abnormal data through a double-layer detection mechanism of basic level detection and deep level detection; the feedback mechanism can adjust the parameters and weights of the detection model in real time according to the detection results, thereby dynamically optimizing the construction of the data source and the detection accuracy, continuously monitoring the abnormal data in the security data source, and adjusting the optimization model through adaptive fusion weights to effectively reduce false positives and missed negatives; through rule matching detection and secondary detection based on the random forest algorithm, illegal interconnection behaviors at the network boundary can be detected at different levels. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0073] Figure 1 It is a schematic diagram of the overall method step structure of the present invention.

[0074] Figure 2 A logical judgment schematic diagram is constructed for the abnormal data source of the present invention.

[0075] Figure 3 The figure is a schematic diagram of the optimization feedback implementation process of the present invention.

[0076] Figure 4 Schematic diagram of illegal interconnection detection logic judgment of the present invention. DETAILED DESCRIPTION

[0077] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0078] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0079] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0080] Example 1

[0081] Reference Figure 1 to Figure 4 , as an embodiment of the present invention, provides a network boundary illegal interconnection detection method, comprising the following steps,

[0082] S1: Collect network data and construct anomaly data sources using the isolation forest training model.

[0083] Specifically, collecting network data and using the isolated forest training model to build a secure data source is to collect real-time network data, and then use the isolated forest training model to build an abnormal data source. Collecting real-time network data is to deploy a traffic capture tool on the network node, use the traffic capture tool to collect data packets passing through the network interface in real time, and store the collected data in a distributed storage database to ensure the concurrent reading and writing capabilities and scalability of the data;

[0084] The use of the isolation forest training model to construct an abnormal data source is based on the isolation forest algorithm to build an abnormal data source training mechanism. The abnormal data source training mechanism is to complete the detection of abnormal data by establishing a two-layer detection mechanism, and combine the detected abnormal data into an abnormal data source. The two-layer detection mechanism includes basic level detection and deep level detection. The detection of abnormal data is to detect the collected network data through a two-layer detection mechanism, and combine the detected abnormal data into an abnormal data source. The specific detection is as follows:

[0085] For the collected network data, the data of network boundary violations are collected from the database at the same time, and the two are constructed into vector data as well as , by comparing the similarities between the two, the basic level detection is completed, as follows:

[0086] Cosine similarity detection, then we have,

[0087]

[0088] in, Represents the vector data constructed by the collected network data, Represents vector data constructed from historical data extracted from the database, , They represent the modulus lengths of the two vectors, Indicates the similarity between the collected network data and historical data, and is used to filter abnormal data. The specific filtering is as follows:

[0089] According to the historical data in the database, two normal data and two abnormal data are extracted respectively, and the similarity of the normal data is calculated at the same time. and the similarity of abnormal data , based on the calculated similarity, we can complete the screening. Then,

[0090] When the similarity results between the collected network data and historical data satisfy the formula When , it indicates that the current data is normal data, and the current data is marked as normal data;

[0091] When the similarity results between the collected network data and historical data satisfy the formula When , it indicates that the current data is abnormal data, and the current data is marked as abnormal data;

[0092] When the similarity results between the collected network data and historical data satisfy the formula When the current data enters the deep detection;

[0093] Deep detection is to input the collected network data and historical data into the scoring model constructed by the isolation forest algorithm, and complete the abnormal data detection by comparing the scores between the two, as follows:

[0094] For the data detected by the basic level, sort them according to the time series of collection, then we have: ;

[0095] Input the data detected by the basic layer into the scoring model and calculate the local layer score in the current time window, then we have:

[0096]

[0097]

[0098]

[0099] in, Represents data points The length in the scoring model is the length from the root node to the current data point. The root node is constructed from abnormal data extracted from historical data and is set by the implementer according to the actual application scenario. Represents the expected path length, which is used to monitor abnormalities of different data points. Represents the total number of data points in the current time window, Represents data points The average path length in the scoring model, Represents the total number of abnormal data points in the current time window, Represents data points The distance to a random outlier data point, Indicates the local layer score of the data point in the current time window. The time window is the time range of data collection. The specific size is set by the implementer according to the actual application scenario;

[0100] Combining the data from multiple time windows in the past, we can calculate the abnormality of the data point in the long-term data pattern, and then we have:

[0101]

[0102] in, Indicates the upper limit of the number of time windows. represents the index of the time window, Indicates the weight of each time window, which is set by the implementer according to the fluctuation of network data. Represents a composite score of a data point calculated by combining data from multiple past time windows;

[0103] According to the calculated local score and comprehensive score, the global score of the data point in the scoring model is determined, then,

[0104]

[0105] in, Represents the adaptive fusion weight, which is set by the implementer according to the influence of the local score and the comprehensive score on the global score. represents the local layer score of the data point in the current time window, Represents the comprehensive score of a data point calculated by combining data from multiple time windows in the past. Indicates the score of the scoring model for the data detected at the basic level, which is used to provide a basis for judgment when constructing anomaly data sources;

[0106] Use the data in the database that causes network anomalies, use the scoring model to score, and record the global score ,By comparing the global scores of the two types of data, the construction of the abnormal data source is completed. The specific construction is as follows:

[0107] If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , represents the data points and normal data in the current window, and is combined with the normal data detected at the basic level to build a secure data source ;

[0108] If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , indicating that the data point in the current window is abnormal data, and combined with the abnormal data detected at the basic level to construct an abnormal data source ;

[0109] The constructed security data sources and abnormal data sources are sorted according to the sequence of collection time to provide a data basis for subsequent illegal interconnection detection.

[0110] S2: Monitor network data passing through secure data sources in real time and provide optimized feedback to secure data sources.

[0111] The optimization feedback of the security data source is carried out by formulating a feedback optimization mechanism. The feedback optimization mechanism realizes the optimization feedback of the security data source by real-time monitoring of the data in the security data source and executing corresponding measures according to the monitoring results.

[0112] Real-time monitoring of data in the security data source is to use the cosine similarity detection algorithm to randomly extract data from the security data source, and compare the extracted data with the historical abnormal data by cosine similarity. If the comparison result meets the detection requirements of the security data source in the basic level, it means that the current data is safe data. If the comparison result does not meet the detection requirements of the security data source in the basic level, the current data is deeply tested and the data is adjusted according to the deep test results.

[0113] Optimization feedback is an optimization detection process that adaptively adjusts security data sources and detection models. The details are as follows:

[0114] The secure data confirmed by deep-level detection is added to the secure data source to ensure the security of the data in the data;

[0115] At the same time, the detected new abnormal data is updated to the abnormal data source for subsequent detection;

[0116] For the update of abnormal data sources, if the amount of abnormal data detected in the security data source exceeds 30% of the overall data source, it means that the construction process of the data source in the previous article is abnormal. By adjusting the adaptive fusion weight in the previous article The construction of the data source is optimized according to the value of the security data source until the amount of abnormal data in the network data detection process of the security data source is less than 30% of the overall data source.

[0117] S3: Build an illegal interconnection detection model to detect illegal interconnections of network data in abnormal data sources.

[0118] Specifically, the illegal interconnection detection of network data in the abnormal data source is performed by constructing an illegal interconnection detection model, taking the data in the abnormal data source as the input of the model, and performing illegal interconnection detection at the network boundary according to the output result of the model. The illegal interconnection detection model is used to detect illegal interconnection behavior at the network boundary, and is constructed based on a two-level detection mechanism, including a first-level detection constructed by a rule matching algorithm and a second-level detection constructed by a random forest algorithm.

[0119] Furthermore, the first layer of detection is to verify the data in the abnormal data source through the rule matching algorithm. The rule matching algorithm is based on predefined rules to match the data in the abnormal data source to detect whether the illegal interconnection behavior at the network boundary is triggered. The rule matching is to check each field in the data one by one to determine whether the current data complies with the security rules. The specific implementation is as follows:

[0120] For data in abnormal data sources ,Extract various fields of network data from the current data, including ,the data source IP address, the target IP address, the data ,protocol type, the data port number, and the data collection timestamp;

[0121] According to the fields extracted from the data, validation rules are formulated, including whitelist validation and blacklist validation.

[0122] Whitelist verification is a list set by security personnel that contains legal network connection information, including safe source IP addresses, destination IP addresses, protocols, and port numbers;

[0123] Blacklist verification is the illegal and malicious connection information set by security personnel, including prohibited source IP addresses, target IP addresses, protocols and port numbers;

[0124] According to the established verification rules, the data from abnormal data sources are checked for illegal interconnection at the network boundary.

[0125] Set the fields to extract network data from the current data. ,in, is the source IP address of the current data, is the target IP address of the current data, is the data protocol type of the current data, is the port number of the current data, is the collection timestamp of the current data, and the whitelist is , the blacklist is ;

[0126] Verify according to the set black and white lists, then there are,

[0127] When the data field satisfies the formula When , it means that the current data field meets the whitelist's test for the data field, and the data corresponding to the current data field does not trigger illegal interconnection at the network boundary;

[0128] When the data field satisfies the formula When , it means that the current data field meets the blacklist's test for the data field, and the data corresponding to the current data field triggers illegal interconnection at the network boundary;

[0129] When the data field does not fully meet the field detection of the whitelist or the field detection of the blacklist, it is impossible to determine whether the current data triggers illegal interconnection at the network boundary through the first layer detection. The current data is recorded and further determined through the second layer detection to detect whether the current data triggers illegal interconnection at the network boundary.

[0130] Furthermore, the second-level detection uses the random forest algorithm to perform secondary detection on the network data that passes the first-level detection mechanism to realize the detection of illegal interconnection of network data. The second-level detection is to build an illegal interconnection autonomous detection model based on the random forest algorithm, and through training the model, realize the detection of illegal interconnection at the network boundary according to the output results of the model. The random forest algorithm uses the network data that passes the first-level detection mechanism and the normal network behavior data as the output of the model, and uses the loss function to train the model at the same time. Finally, the detection of illegal interconnection at the network boundary is realized according to the output results of the model.

[0131] Specifically, the illegal interconnection autonomous detection model is a binary classification detection model based on the random forest algorithm. According to the binary classification results, illegal interconnection detection at the network boundary is realized. The specific detection is as follows:

[0132] For network data that passes the first layer detection mechanism , and prepare normal network behavior data with the same fields as the current network data The two types of data are constructed into a labeled dataset. The dataset is a labeled binary classification dataset, including the network data to be detected and the normal network behavior data. At the same time, each piece of data has a corresponding label. , and the label value is the behavior to be detected and the normal network behavior, then,

[0133]

[0134] in, Indicates The feature vector of a piece of network data includes the source IP address, the destination IP address, the data protocol type, the port number, and the acquisition timestamp. Indicates The label of the data, a value of 0 indicates normal network behavior, and a value of 1 indicates behavior to be detected;

[0135] The constructed dataset is divided into a training set and a test set, with 80% used for training and 20% for testing;

[0136] The random forest algorithm is used to build a binary classification model, and the training set is used to train the model. At the same time, the accuracy of the model is evaluated using the test set, as follows:

[0137] Randomly select multiple features from the data set to build a decision tree;

[0138] Use each decision tree to classify the input features, collect the classification results of all decision trees, and select the classification result with the most votes as the final output, then we have,

[0139]

[0140] in, Represents the random forest for the input feature vector The classification output represents the input sample The probability of illegal interconnection behavior, represents the number of decision trees constructed, Indicates A decision tree for input features The classification result is 0, which indicates normal network behavior, and 1, which indicates illegal Internet behavior.

[0141] Furthermore, the classification result of the decision tree for the input features is the label corresponding to the feature vector The value of is determined. If the corresponding label is a normal network behavior, the classification result of the decision tree is a normal network behavior. If the corresponding label is a behavior to be detected, the classification result of the decision tree is an illegal Internet behavior.

[0142] The classification output of the random forest for the input feature vector is obtained by averaging the output results of all decision trees. The illegal interconnection detection of network data is completed based on the final classification output. Then,

[0143] If the final output satisfies the formula , it means that the network data corresponding to the current input sample is illegal interconnection behavior, otherwise it means that the network data corresponding to the current input sample is normal network behavior, where, It represents the probability threshold, which is set by the implementer according to the actual application scenario. In this embodiment, it is described with a value of 0.5.

[0144] It should be noted that for the detection of illegal interconnection of network data, if the detection result is illegal interconnection behavior, the network connection of the current network data is blocked, an early warning is issued, and the current illegal interconnection behavior is recorded. If the detection result is normal network behavior, the current network data is classified as a safe data source for recording;

[0145] For the detection results, the test set is used for optimization verification, as follows:

[0146]

[0147] in, represents the amount of data correctly identified as violations, Indicates the amount of data correctly identified as normal network behavior. represents the amount of data that was incorrectly identified as a violation, Indicates the amount of data that is incorrectly identified as normal network behavior. Indicates the accuracy of the model and must satisfy the formula , indicating that the accuracy of the constructed model meets the requirements for illegal interconnection detection at the network boundary, otherwise it does not meet the requirements for illegal interconnection detection at the network boundary. The model is trained twice using the training set until the requirements are met. To verify the threshold, the implementer sets it according to the actual application scenario, and in this embodiment, 0.8 is used for description.

[0148] Furthermore, if the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0149] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0150] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk case (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0151] Additionally, in order to provide a concise description of exemplary embodiments, all features of an actual embodiment may not be described (ie, those features that are not relevant to the best mode presently contemplated for carrying out the invention or those features that are not relevant to implementing the invention).

[0152] It should be understood that in the development of any actual implementation, as in any engineering or design project, numerous implementation-specific decisions may be made. Such a development effort may be complex and time-consuming, but for those of ordinary skill having the benefit of this disclosure, the development effort will be a routine task of design, fabrication, and production without undue experimentation.

[0153] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting illegal interconnection at a network boundary, characterized by: The following steps are included: Collect network data and use the Isolation Forest training model to construct anomaly data sources, including, Collect real-time network data and build anomaly data sources using the Isolation Forest training model, specifically: Set up a two-layer detection mechanism to detect real-time network data, build anomaly data sources based on the detection, and also include: Basic hierarchical detection based on cosine similarity and scoring model based on isolation forest algorithm, and abnormal data source is constructed according to the scoring model; Monitor network data passing through secure data sources in real time and provide optimized feedback to secure data sources; Construct an illegal interconnection detection model to detect illegal interconnections of network data in abnormal data sources, including: The first layer of detection built by the rule matching algorithm and the second layer of detection built by the random forest algorithm are as follows: Based on predefined rules, the data in the abnormal data source is matched to detect whether illegal interconnection behavior at the network boundary is triggered. The random forest algorithm is used to build an autonomous detection model for illegal interconnection, and illegal interconnection detection at the network boundary is implemented based on the output results of the model. The basic level detection based on cosine similarity is as follows: For the collected network data, the data of network boundary violations are collected from the database at the same time, and the two are constructed into vector data as well as , by comparing the similarities between the two, the basic level detection is completed, as follows: Cosine similarity detection, then we have, in, Represents the vector data constructed by the collected network data, Represents vector data constructed from historical data extracted from the database, , They represent the modulus lengths of the two vectors, Indicates the similarity between the collected network data and historical data, and is used to filter abnormal data. The specific filtering is as follows: According to the historical data in the database, two normal data and two abnormal data are extracted respectively, and the similarity of the normal data is calculated at the same time. and the similarity of abnormal data , based on the calculated similarity, we can complete the screening. Then, When the similarity results between the collected network data and historical data satisfy the formula When , mark the current data as normal data; When the similarity results between the collected network data and historical data satisfy the formula When , the current data is marked as abnormal data; When the similarity results between the collected network data and historical data satisfy the formula When the current data enters the deep detection; The scoring model constructed based on the isolation forest algorithm is specifically as follows: in, Represents data points The length in the scoring model is the length from the root node to the current data point. The root node is constructed from abnormal data extracted from historical data and is set by the implementer according to the actual application scenario. Represents the expected path length, which is used to monitor abnormalities of different data points. Represents the total number of data points in the current time window, Represents data points The average path length in the scoring model, Represents the total number of abnormal data points in the current time window, Represents data points The distance to a random outlier data point, Indicates the local layer score of the data point in the current time window, where the time window is the time range of data collection; Combining the data from multiple time windows in the past, we can calculate the abnormality of the data point in the long-term data pattern, and then we have: in, Indicates the upper limit of the number of time windows. represents the index of the time window, Indicates the weight of each time window, which is set by the implementer according to the fluctuation of network data. Represents a composite score of a data point calculated by combining data from multiple past time windows; According to the calculated local score and comprehensive score, the global score of the data point in the scoring model is determined, then, in, Represents the adaptive fusion weight, which is set by the implementer according to the influence of the local score and the comprehensive score on the global score. represents the local layer score of the data point in the current time window, Represents the comprehensive score of a data point calculated by combining data from multiple time windows in the past. It indicates the score of the scoring model for the data detected by the basic level, which is used to provide a judgment basis for constructing abnormal data sources; The construction of the abnormal data source according to the scoring model is specifically as follows: Use the data in the database that causes network anomalies, use the scoring model to score, and record the global score , by comparing the global scores of the two sets of data, the construction of the abnormal data source is completed. The specific construction is as follows: If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , represents the data points and normal data in the current window, and is combined with the normal data detected at the basic level to build a secure data source; If the global score corresponding to the data point in the current time window is compared with the global score corresponding to the historical abnormal data, the result satisfies the formula , indicating that the data points in the current window are abnormal data, and are combined with the abnormal data detected at the basic level to construct an abnormal data source; The optimization feedback of the security data source is specifically as follows: The secure data confirmed by deep-level detection is added to the secure data source to ensure the security of the data in the data; At the same time, the detected new abnormal data is updated to the abnormal data source for subsequent detection; For the update of abnormal data sources, if the construction process of the data source is abnormal, the adaptive fusion weight is adjusted The value of is used to optimize the construction of the data source; The specific details of using the random forest algorithm to build an illegal interconnection autonomous detection model are as follows: For network data that passes the first layer detection mechanism , and prepare normal network behavior data with the same fields as the current network data , and construct the two types of data into a labeled dataset, which is a labeled binary classification dataset, including the network data to be detected and the normal network behavior data, and each piece of data has a corresponding label , and the label value is the behavior to be detected and the normal network behavior, then, in, Indicates The feature vector of a piece of network data includes the source IP address, the destination IP address, the data protocol type, the port number, and the acquisition timestamp. Indicates The label of the data, a value of 0 indicates normal network behavior, and a value of 1 indicates behavior to be detected; Divide the constructed dataset into training set and test set; The random forest algorithm is used to build a binary classification model, and the training set is used to train the model. At the same time, the accuracy of the model is evaluated using the test set, as follows: Randomly select multiple features from the data set to build a decision tree; Use each decision tree to classify the input features, collect the classification results of all decision trees, and select the classification result with the most votes as the final output, then we have, in, Represents the random forest for the input feature vector The classification output represents the input sample The probability of illegal Internet behavior, represents the number of decision trees constructed, Indicates A decision tree for input features The classification result is 0, which indicates normal network behavior, and 1, which indicates illegal Internet behavior.

2. A network boundary illegal interconnection detection method as claimed in claim 1, characterized in that: The rule matching of data in the abnormal data source based on the predefined rules is specifically as follows: According to the fields extracted from the data, validation rules are formulated, including whitelist validation and blacklist validation. According to the verification rules, the data of abnormal data sources are checked for illegal interconnection at the network boundary, then, Set the fields to extract network data from the current data. ,in, is the source IP address of the current data, is the target IP address of the current data, is the data protocol type of the current data, is the port number of the current data, is the collection timestamp of the current data, and the whitelist is , the blacklist is ; Verify according to the set black and white lists, then there are, When the data field satisfies the formula When , it means that the current data field meets the whitelist's test for the data field, and the data corresponding to the current data field does not trigger illegal interconnection at the network boundary; When the data field satisfies the formula When , it means that the current data field meets the blacklist's test for the data field, and the data corresponding to the current data field triggers illegal interconnection at the network boundary; When the first layer detection cannot determine whether the current data triggers illegal interconnection at the network boundary, the current data is recorded and the current data is determined through the second layer detection to detect whether the current data triggers illegal interconnection at the network boundary.

3. The network boundary illegal interconnection detection method according to claim 1, characterized in that: The specific implementation of illegal interconnection detection at the network boundary according to the output result of the model is as follows: If the final output satisfies the formula , it means that the network data corresponding to the current input sample is an illegal interconnection behavior, otherwise it means that the network data corresponding to the current input sample is a normal network behavior, where represents the probability threshold; For illegal interconnection detection of network data, if the detection result is illegal interconnection behavior, the current network data will be blocked from connecting to the network, an early warning will be issued, and the current illegal interconnection behavior will be recorded. If the detection result is normal network behavior, the current network data will be classified as a safe data source for recording; For the detection results, the test set is used for optimization verification, as follows: in, represents the amount of data correctly identified as violations, Indicates the amount of data correctly identified as normal network behavior. represents the amount of data that was incorrectly identified as a violation, Indicates the amount of data that is incorrectly identified as normal network behavior. Indicates the accuracy of the model and must satisfy the formula , indicating that the accuracy of the constructed model meets the requirements for illegal interconnection detection at the network boundary, otherwise it does not meet the requirements for illegal interconnection detection at the network boundary. The model is trained twice using the training set until the requirements are met. is the verification threshold.

Images