A deep learning-based intelligent transportation network intrusion detection method and system

Abstract

The present invention discloses a method and system for detecting intrusion in an intelligent transportation network based on deep learning, and relates to the technical field of network intrusion. The status code abnormal analysis module can effectively identify abnormal status codes through feature extraction and calculation of abnormal change coefficient Ybxs. When the abnormal change coefficient Ybxs exceeds the preset change threshold, the system will automatically issue a detection command to ensure timely response to potential intrusion behaviors. Then, by extracting the features of traffic changes and request data information, calculating the traffic fluctuation coefficient Lbxs and the request status coefficient Qzxs, and combining the deep learning model, the system can accurately calculate the risk assessment index Fpzs and provide a detailed prediction of the current network security status. By comparing and analyzing it with the evaluation threshold Q, the system can comprehensively judge the degree of intrusion of the network. When the intrusion risk reaches the set threshold, the system will automatically take corresponding protective measures.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion, and specifically to an intelligent transportation network intrusion detection method and system based on deep learning. Background Art

[0002] With the development of modern science and technology, network security has become an important link that cannot be ignored in all walks of life, especially in intelligent transportation networks. Due to its complex structure and importance to society, it is particularly important to ensure its safe operation. Intelligent transportation networks involve the coordinated work of many subsystems such as vehicles, traffic signals, and monitoring equipment. Massive real-time data is transmitted through the network to achieve optimal scheduling of traffic flow and emergency response. In this process, the effectiveness of network intrusion detection methods is directly related to the safety and stable operation of intelligent transportation systems.

[0003] In the security protection of intelligent transportation networks, the effectiveness of intrusion detection methods is crucial. Existing detection methods usually detect intrusions through predefined attack patterns, which makes the network powerless when encountering various attacks, and the analysis of abnormalities in network traffic and status codes is relatively rough, lacking in-depth data mining and intelligent analysis capabilities, resulting in high false alarm rates and low detection accuracy, affecting traffic lights and other traffic equipment. It is difficult to receive instructions from the control center, resulting in disordered changes in traffic lights and causing traffic accidents. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides an intelligent transportation network intrusion detection method and system based on deep learning, which solves the problems in the above-mentioned background technology.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: an intelligent transportation network intrusion detection system based on deep learning, including a network monitoring module, a status code anomaly analysis module, a model building module, an intrusion risk prediction module and a management module;

[0006] The network monitoring module is used to monitor the relevant traffic change data information in the network layer and the relevant request data information in the application layer in the intelligent transportation network in real time to construct a network data set, and at the same time monitor the relevant status code feedback data information returned by the server to the client in real time;

[0007] The status code abnormality analysis module is used to extract features from the relevant status code feedback data information, and construct an abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally;

[0008] The model building module is used to use recurrent neural network technology to standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then train and test them to build a deep learning model;

[0009] The intrusion risk prediction module is used to extract features from relevant traffic change data information and relevant request data information after receiving the detection command, so as to respectively calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs, and calculate the risk assessment index Fpzs in combination with the deep learning model;

[0010] The management module is used to pre-set the evaluation threshold Q, and compare and analyze the risk assessment index Fpzs with the evaluation threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding protection measures according to the intrusion level.

[0011] Preferably, the network monitoring module includes a first monitoring unit, a second monitoring unit and a third monitoring unit;

[0012] The first monitoring unit is used to monitor and record relevant traffic change data information in the network layer of the intelligent transportation network in real time, wherein the relevant traffic change data information includes IP addresses corresponding to various status code types, request time and response time, and byte rate Zjsz and data packet rate Sbsz;

[0013] The second monitoring unit is used to monitor and record relevant request data information in the application layer of the intelligent transportation network in real time, wherein the relevant request data information includes the request frequency Dqp, the request header sending speed Qfsd and the connection holding time Lbsc of the IP address corresponding to various status code types;

[0014] The third monitoring unit is used to monitor the relevant status code feedback data information returned by the server to the client in real time, wherein the relevant status code feedback data information includes the number Cms of different status code types in each monitoring time window, and combines the statistical mean algorithm to calculate the mean number of different status code types And the standard deviation of the number of different status code types .

[0015] Preferably, the status code abnormality analysis module includes a status code analysis unit and a preliminary judgment unit;

[0016] The state code analysis unit is used to calculate the abnormal change coefficient Ybxs of different types of state codes according to the relevant state code feedback data information after feature extraction, and the abnormal change coefficient Ybxs of the i-th type state code is calculated. i For example, it is obtained by the following formula:

[0017] ;

[0018] In the formula, It is represented as the number of status codes of type i in the jth monitoring time window, It is represented as the mean value of the number of type i status codes in all monitoring time windows, It is expressed as the standard deviation of the number of type i status codes in all monitoring time windows, It is expressed as the number of status codes of type i in the j-1 monitoring time window, Expressed as weight value.

[0019] Preferably, the preliminary judgment unit is used to pre-set a change threshold, and compare and analyze the abnormal change coefficient Ybxs of the corresponding type of status code with the change threshold to preliminarily determine whether there is an intrusion risk in the current intelligent transportation network. The specific analysis content is as follows:

[0020] If the abnormal change coefficient Ybxs of the corresponding type of status code exceeds the change threshold, it is preliminarily judged that there is an intrusion risk in the current intelligent transportation network. At this time, a detection command will be issued and the corresponding type of status code will be marked as an abnormal status code;

[0021] If the abnormal change coefficient Ybxs of the corresponding type of status code does not exceed the change threshold, it is preliminarily judged that there is no intrusion risk in the current intelligent transportation network, and no additional detection commands will be issued to the outside at this time.

[0022] Preferably, the model building module is used to construct the original model using recurrent neural network technology, and train and test the original model with relevant traffic change data information in the network layer and relevant request data information in the application layer, and use the trained original model as the recognition model, obtain feature information in the recognition model respectively, and use the obtained feature information to train and test the recognition model, and finally use the trained recognition model as a deep learning model.

[0023] Preferably, the intrusion risk prediction module includes a multi-level detection unit and a comprehensive analysis unit;

[0024] The multi-level detection unit includes a first level analysis subunit and a second level analysis subunit;

[0025] The first hierarchical analysis subunit is used to extract features of the relevant traffic change data information corresponding to the abnormal status code according to the relevant traffic change data information in the network layer, extract the data packet rate Sbsz and the byte rate Zjsz when the abnormal status code appears, perform linear normalization on the two parameters, and map the corresponding data values ​​in the interval The flow fluctuation coefficient Lbxs is calculated and then based on the following formula:

[0026] ;

[0027] Where n represents the monitoring period, i=1, 2, 3, ..., n, Sbsz i It is expressed as the packet rate in the i-th monitoring period, Zjsz i It is expressed as the byte rate in the i-th monitoring period, Sbsz avg It is expressed as the average packet rate during the monitoring period, Zjsz avg Expressed as the average byte rate during the monitoring period, and All are weight values.

[0028] Preferably, the second hierarchical analysis subunit is used to perform linear normalization processing on the request header sending speed Qfsd and the connection holding time Lbsc according to the relevant request data information in the application layer, and map the corresponding data values ​​in the interval In order to calculate the request status coefficient Qzxs, according to the following formula:

[0029] ;

[0030] Wherein, Dqp represents the request frequency of the IP address corresponding to the abnormal status code, a1, a2 and a3 represent the weight values ​​of the request header sending speed Qfsd, the request frequency Dqp of the IP address corresponding to the abnormal status code and the connection holding time Lbsc, respectively, and C represents the first correction constant.

[0031] Preferably, the comprehensive analysis unit is used to transmit the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs obtained in the first level analysis subunit and the second level analysis subunit to the deep learning model to calculate the risk assessment index Fpzs, and the risk assessment index Fpzs is obtained by the following formula:

[0032] ;

[0033] In the formula, F1 and F2 represent the weight values ​​of the flow fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and V represents the second correction constant.

[0034] Preferably, the management module includes an intrusion analysis unit and a processing unit;

[0035] The intrusion analysis unit is used to compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion degree of the current intelligent transportation network. The specific comparison and analysis content is as follows:

[0036] If the risk assessment index Fpzs is greater than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state, and the first control instruction is issued;

[0037] If the risk assessment index Fpzs is equal to the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state, and the second control instruction is issued;

[0038] If the risk assessment index Fpzs is less than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is not in an abnormal state, and the third control instruction is issued at this time;

[0039] The processing unit is used to take corresponding protection measures according to the instructions obtained from the intrusion analysis unit, and the specific contents are as follows:

[0040] If the first control instruction is issued, the corresponding abnormal subnet will be determined according to the abnormal status code, and the detected abnormal subnet will be immediately isolated from the main network. An emergency alert will be sent to the network administrator and security team to notify them to immediately start the automated intrusion prevention system to detect and block new attack behaviors in real time, and start security audit logging to record all traffic and operations for subsequent analysis;

[0041] If the second control instruction is issued, traffic monitoring will be carried out in real time, network traffic will be analyzed in real time to capture abnormal behavior, access rights to key resources will be restricted, a comprehensive security scan will be conducted on the entire network, and network emergency plans will be prepared and tested;

[0042] If a third control directive is issued, the network will be regularly reviewed and assessed for security, security training and drills will be conducted regularly, and network activity logs will continue to be recorded and monitored.

[0043] A deep learning-based intelligent transportation network intrusion detection method comprises the following steps:

[0044] Step 1: First, real-time monitoring of the relevant traffic change data information in the network layer and the relevant request data information in the application layer of the intelligent transportation network is performed to construct a network data set, and at the same time, real-time monitoring of the relevant status code feedback data information returned by the server to the client is performed;

[0045] Step 2: then extract the features of the relevant status code feedback data information, and construct the abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally;

[0046] Step 3: Then, using recurrent neural network technology, standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then conduct training and testing to build a deep learning model;

[0047] Step 4. After receiving the detection command, perform feature extraction on the relevant traffic change data information and the relevant request data information to calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and calculate the risk assessment index Fpzs by combining the deep learning model;

[0048] Step 5: Pre-set the assessment threshold Q, and compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding management measures based on the intrusion level.

[0049] The present invention provides an intelligent transportation network intrusion detection method and system based on deep learning, which has the following beneficial effects:

[0050] (1) The system monitors the traffic changes and request information of the network layer and application layer in the intelligent transportation network in real time, so that the system can capture and record all relevant network activities and status code feedback in a timely manner, further ensuring a comprehensive understanding of the network environment. Real-time monitoring of the status code returned by the server helps to promptly detect server anomalies or potential signs of attack, such as abnormal changes in error codes such as 404 not found and 500 server error. The status code anomaly analysis module can effectively identify abnormal status codes through feature extraction and calculation of the abnormal change coefficient Ybxs. When the abnormal change coefficient Ybxs exceeds the preset change threshold, the system will automatically issue a detection command to ensure timely response to potential intrusion behaviors. Then, by extracting the features of traffic changes and request data information, calculating the traffic fluctuation coefficient Lbxs and the request status coefficient Qzxs, and combining the deep learning model, the system can accurately calculate the risk assessment index Fpzs and provide a detailed prediction of the current network security status. By comparing it with the assessment threshold Q, the system can comprehensively judge the degree of network intrusion. When the intrusion risk reaches the set threshold, the system will automatically take corresponding protective measures. This automated management not only improves response efficiency, but also reduces the need for manual intervention, further improving the intelligent level of network security management. In short, the system can further effectively improve the security of the intelligent transportation network through real-time monitoring, anomaly analysis, establishment of deep learning models and risk prediction, as well as automated management and protection. While quickly detecting the current intrusion risk, it can also start further in-depth analysis of the network, so as to timely discover and stop attacks, and provide strong support for the stable operation of the intelligent transportation network.

[0051] (2) By calculating the abnormal change coefficient Ybxs of different types of status codes, the system can further identify abnormal fluctuations in the status code. This method can capture subtle changes in the number of status codes and improve the sensitivity and accuracy of anomaly detection. By comparing and analyzing the calculated abnormal change coefficient Ybxs with the threshold, the system can effectively make a preliminary judgment on whether there is an intrusion risk in the current intelligent transportation network. If so, the system will issue a detection command and mark the relevant status code as an abnormal status code. This dynamic threshold mechanism can adapt to different network environments and attack modes, further improve the flexibility of detection, and locate the abnormal location in a timely manner. At the same time, this timely response mechanism helps to quickly deal with potential network intrusions and further reduce potential security threats.

[0052] (3) By calculating the traffic fluctuation coefficient Lbxs, the changes in traffic rate can be effectively integrated to identify irregular fluctuations in traffic and reflect abnormal fluctuations in network traffic, helping the system to promptly detect potential intrusion risks. By calculating the request state coefficient Qzxs, the abnormal request pattern in the application layer can be further effectively identified. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a block diagram of an intelligent transportation network intrusion detection system based on deep learning in the present invention;

[0054] Figure 2 This is a schematic flow chart of an intelligent transportation network intrusion detection method based on deep learning in the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Example 1

[0057] See also Figure 1 , the present invention provides an intelligent transportation network intrusion detection system based on deep learning, including a network monitoring module, a status code anomaly analysis module, a model building module, an intrusion risk prediction module and a management module;

[0058] The network monitoring module is used to monitor the relevant traffic change data information in the network layer and the relevant request data information in the application layer in the intelligent transportation network in real time to construct a network data set, and at the same time monitor the relevant status code feedback data information returned by the server to the client in real time;

[0059] The status code abnormality analysis module is used to extract features from the relevant status code feedback data information, and construct an abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally;

[0060] The model building module is used to use recurrent neural network technology to standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then train and test them to build a deep learning model;

[0061] The intrusion risk prediction module is used to extract features from relevant traffic change data information and relevant request data information after receiving the detection command, so as to respectively calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs, and calculate the risk assessment index Fpzs in combination with the deep learning model;

[0062] The management module is used to pre-set the evaluation threshold Q, and compare and analyze the risk assessment index Fpzs with the evaluation threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding protection measures according to the intrusion level.

[0063] During the operation of this system, the network monitoring module monitors the traffic change data information of the network layer and application layer in the intelligent transportation network in real time, as well as the status code feedback data information returned by the server to the client. This module can not only build a network data set, but also monitor abnormal traffic and requests in real time, effectively capturing potential intrusion behaviors; the status code anomaly analysis module can further accurately identify abnormal status codes through the construction of the abnormal change coefficient Ybxs. When the abnormal change coefficient Ybxs exceeds the change threshold, the system immediately issues a detection command. This precise anomaly detection mechanism can timely discover and respond to abnormal situations in the network, further improving the accuracy and response speed of detection, and paving the way for subsequent further analysis. The model building module uses recurrent neural network technology to standardize the relevant data of the network layer and application layer, and conducts training and testing to build a deep learning model. The model can learn and understand complex network traffic and request patterns, further improving the system's ability to identify abnormal behaviors. After receiving the detection command, the intrusion risk prediction module can calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs, and calculate the risk assessment index Fpzs in combination with the deep learning model. This multi-dimensional feature extraction and evaluation method ensures the high accuracy of the intrusion risk prediction. It is compared and analyzed with the evaluation threshold Q to comprehensively judge the intrusion degree of the current intelligent transportation network. According to the different intrusion degrees, the system can take corresponding protection measures, including isolating the affected subnet or device, blocking suspicious IP addresses and starting the intrusion defense system. This multi-level protection strategy ensures the multi-faceted and effectiveness of network security. In short, the system can further realize multi-faceted monitoring of the network layer and application layer to quickly identify abnormal status codes, and after the command is issued, it uses the deep learning model to efficiently construct and predict the intrusion risk, and implements corresponding protection measures through the comprehensive management module, thereby improving the security and stability of the intelligent transportation network.

[0064] Example 2

[0065] Please refer to Figure 1 , specifically: the network monitoring module includes a first monitoring unit, a second monitoring unit and a third monitoring unit;

[0066] The first monitoring unit is used to monitor and record relevant traffic change data information in the network layer of the intelligent transportation network in real time, wherein the relevant traffic change data information includes IP addresses corresponding to various status code types, request time and response time, and byte rate Zjsz and data packet rate Sbsz;

[0067] Among them, the packet rate Sbsz refers to the number of packets transmitted per unit time, usually measured per second;

[0068] The byte rate Zjsz refers to the amount of data transferred per unit time, usually measured in bytes per second;

[0069] Both the byte rate Zjsz and the packet rate Sbsz can be monitored and obtained through a network traffic analyzer;

[0070] The second monitoring unit is used to monitor and record relevant request data information in the application layer of the intelligent transportation network in real time, wherein the relevant request data information includes the request frequency Dqp, the request header sending speed Qfsd and the connection holding time Lbsc of the IP address corresponding to various status code types;

[0071] Among them, the request frequency Dqp can be monitored and obtained through the Web server log analyzer;

[0072] The request header sending speed Qfsd can be monitored and obtained through the Web server performance monitor;

[0073] The connection holding time Lbsc can be monitored and obtained through application performance monitoring tools;

[0074] The third monitoring unit is used to monitor the relevant status code feedback data information returned by the server to the client in real time, wherein the relevant status code feedback data information includes the number Cms of different status code types in each monitoring time window, and combines the statistical mean algorithm to calculate the mean number of different status code types And the standard deviation of the number of different status code types .

[0075] The number of different status code types Cms mentioned above can be monitored and obtained through the Web server log analyzer;

[0076] In this embodiment, the network monitoring module includes a first monitoring unit, a second monitoring unit and a third monitoring unit, which further ensures that all levels from the network layer, application layer to status code feedback are monitored in real time in a multi-faceted manner. The first monitoring unit can record the traffic change data of the network layer. This detailed traffic data record can help accurately analyze network behavior and promptly discover abnormal traffic patterns. The second monitoring unit records the request data information of the application layer in real time. These data can reveal the anomalies of request behavior and help identify potential attack patterns, such as slow request attacks or connection maintenance attacks. The third monitoring unit monitors the status code returned by the server in real time. This function can accurately analyze the anomalies of the status code and identify abnormal status code patterns and trends. Through the monitored multi-dimensional parameters, the system can finely identify abnormal traffic or request behavior at the network and application layers. For example, through abnormal fluctuations in byte rate and packet rate, we can find signs of attacks at the network layer. By statistically analyzing the mean and standard deviation of the number of status code types, we can effectively identify abnormal changes in status codes. This method can help discover potential attacks. For example, a large number of 404 error codes may indicate scanning or crawler activities. Multi-dimensional data recording and real-time monitoring improve the understanding of network traffic and request behavior, thereby improving detection accuracy and network security. Real-time acquisition and analysis of detailed data enables the system to promptly detect and respond to potential network attacks and reduce the impact of intrusions on intelligent transportation networks.

[0077] It should be noted that in the context of traffic network intrusion, HTTP status code is a set of three-digit codes with specific meanings. HTTP status code is a status code returned by the server to the client (such as a browser) to indicate the result of request processing. Common error codes include 404: Page Not Found, 500: Internal Server Error, 403: Access Forbidden, etc. For example, the 404 status code indicates that the resource requested by the client is not found on the server; the 500 status code indicates that the server encountered an unexpected situation when processing the request, resulting in the inability to complete the request. In short, different status codes reflect different types of problems, and monitoring their frequency and pattern can help detect potential network intrusions or abnormal activities.

[0078] Example 3

[0079] Please refer to Figure 1 ,Specifically: the status code abnormality analysis module includes a status code analysis unit and a preliminary judgment unit;

[0080] The state code analysis unit is used to calculate the abnormal change coefficient Ybxs of different types of state codes according to the relevant state code feedback data information after feature extraction, and the abnormal change coefficient Ybxs of the i-th type state code is calculated. i For example, it is obtained by the following formula:

[0081] ;

[0082] In the formula, It is represented as the number of status codes of type i in the jth monitoring time window, It is represented as the mean value of the number of type i status codes in all monitoring time windows, It is expressed as the standard deviation of the number of type i status codes in all monitoring time windows, It is expressed as the number of status codes of type i in the j-1 monitoring time window, Represented as a weight value, where 0 < <1.

[0083] Among them, the average number of different status code types And the standard deviation of the number of different status code types It is used to measure the deviation of the number of status codes from historical levels;

[0084] The number of status codes of type i in the j-1th monitoring time window Refers to the number of status codes in the previous time window, which is used to capture the changing trend of the number of status codes;

[0085] The preliminary judgment unit is used to pre-set a change threshold, and compare and analyze the abnormal change coefficient Ybxs of the corresponding type of status code with the change threshold to preliminarily determine whether there is an intrusion risk in the current intelligent transportation network. The specific analysis content is as follows:

[0086] If the abnormal change coefficient Ybxs of the corresponding type of status code exceeds the change threshold, it is preliminarily judged that there is an intrusion risk in the current intelligent transportation network. At this time, a detection command will be issued and the corresponding type of status code will be marked as an abnormal status code;

[0087] If the abnormal change coefficient Ybxs of the corresponding type of status code does not exceed the change threshold, it is preliminarily judged that there is no intrusion risk in the current intelligent transportation network, and no additional detection commands will be issued to the outside at this time.

[0088] In this embodiment, the status code analysis unit can further accurately identify the frequency and pattern of abnormal status codes by calculating the abnormal change coefficient Ybxs of different types of status codes. In the formula, the calculation of the abnormal change coefficient Ybxsi comprehensively considers the number, mean and standard deviation of the status code, ensuring the accuracy and reliability of abnormal detection. This refined abnormal detection can identify abnormal fluctuations in the status code and timely discover potential intrusion behaviors. The initial judgment unit can effectively preliminarily judge whether there is an intrusion risk in the current intelligent transportation network by presetting the change threshold and comparing the abnormal change coefficient Ybxs of the status code with the threshold. This method provides a dynamic risk assessment mechanism, enabling the system to adjust the threshold according to actual conditions and flexibly respond to various network environments and attack modes. When the abnormal change coefficient Ybxs of the status code exceeds the change threshold, the system will automatically issue a detection command and mark the corresponding type of status code as an abnormal status code. This automated response mechanism helps to take measures quickly to effectively deal with potential intrusion behaviors and prevent them from causing serious impact on the intelligent transportation network. If the abnormal change coefficient Ybxs of the status code does not exceed the change threshold, the system will not issue additional detection commands, further avoiding false alarms of normal traffic fluctuations. This strategy effectively reduces false alarms and missed alarms, improves the overall detection accuracy and stability of the system, and ensures the rational use of resources. By combining the calculation of the abnormal change coefficient Ybxs of the status code and the comparison of the change threshold, the system can provide a more comprehensive intrusion risk assessment. This comprehensive analysis not only helps to quickly identify anomalies, but also provides data support for subsequent detailed analysis and response. In short, through the above modules, it is possible to further judge abnormal situations from the status of the status code and realize dynamic risk assessment.

[0089] Example 4

[0090] Please refer to Figure 1 Specifically: the model building module is used to construct the original model using recurrent neural network technology, and train and test the original model with relevant traffic change data information in the network layer and relevant request data information in the application layer, and use the trained original model as the recognition model, obtain feature information in the recognition model respectively, and use the obtained feature information to train and test the recognition model, and finally use the trained recognition model as a deep learning model.

[0091] The intrusion risk prediction module includes a multi-level detection unit and a comprehensive analysis unit;

[0092] The multi-level detection unit includes a first level analysis subunit and a second level analysis subunit;

[0093] The first hierarchical analysis subunit is used to extract features of the relevant traffic change data information corresponding to the abnormal status code according to the relevant traffic change data information in the network layer, extract the data packet rate Sbsz and the byte rate Zjsz when the abnormal status code appears, perform linear normalization on the two parameters, and map the corresponding data values ​​in the interval The flow fluctuation coefficient Lbxs is calculated and then based on the following formula:

[0094] ;

[0095] Where n represents the monitoring period, i=1, 2, 3, ..., n, Sbsz i It is expressed as the packet rate in the i-th monitoring period, Zjsz i It is expressed as the byte rate in the i-th monitoring period, Sbsz avg It is expressed as the average packet rate during the monitoring period, Zjsz avg Expressed as the average byte rate during the monitoring period, and are weight values, where 0 < ≤1,0< ≤1, and + =1.

[0096] In this embodiment, the original model is constructed using the recurrent neural network (RNN) technology. By training and testing the relevant traffic changes and request data information of the network layer and the application layer, a basic model that can capture the complex patterns of time series data can be constructed. This technology is particularly suitable for processing network data with time dependence, ensuring that the model accurately recognizes dynamic network behavior. The original model is trained and tested to obtain feature information, and this feature information is used to further train the recognition model. In this way, the system can optimize model performance and improve recognition accuracy. The resulting deep learning model can more accurately detect and predict potential anomalies and intrusion behaviors in the network. The multi-level detection unit of the intrusion risk prediction module further provides an in-depth analysis of network traffic and request data. The first level analysis subunit focuses on the traffic data corresponding to the abnormal status code. Through feature extraction and linear normalization processing, the traffic fluctuation coefficient Lbxs is calculated, and the accurate measurement and evaluation of the packet rate Sbsz and the byte rate Zjsz are realized. The coefficient provides a detailed analysis of the network traffic and can reveal the traffic fluctuation when the abnormal status code appears. Through the model establishment and optimization process, the system can establish an accurate deep learning model for detecting and predicting network intrusions. The model uses complex data features and traffic pattern analysis to provide high-accuracy intrusion predictions, reduce false positives and false negatives, and improve overall network security. When abnormal traffic fluctuations are detected, the system can adjust security protection measures in a timely manner. The traffic fluctuation coefficient provides a detailed description of abnormal traffic, so that security policies can be dynamically adjusted according to actual conditions, and the response capability to network threats is enhanced. Through model construction, optimization and multi-level traffic analysis based on recurrent neural networks, the system can effectively establish and apply deep learning models to detect and predict network intrusions. Through precise feature extraction, traffic fluctuation analysis and model optimization, it not only improves the accuracy and reliability of intrusion detection, but also supports dynamic security protection measures, providing strong support for the security management of intelligent transportation networks.

[0097] Example 5

[0098] Please refer to Figure 1 Specifically: the second hierarchical analysis subunit is used to perform linear normalization processing on the request header sending speed Qfsd and the connection holding time Lbsc according to the relevant request data information in the application layer, and map the corresponding data values ​​in the interval In order to calculate the request status coefficient Qzxs, according to the following formula:

[0099] ;

[0100] Wherein, Dqp represents the request frequency of the IP address corresponding to the abnormal status code, a1, a2 and a3 represent the weight values ​​of the request header sending speed Qfsd, the request frequency Dqp of the IP address corresponding to the abnormal status code and the connection holding time Lbsc, respectively, wherein 0<a1≤1, 0<a2≤1, 0<a3≤1, and a1+a2+a3=1, and C represents the first correction constant.

[0101] The comprehensive analysis unit is used to transmit the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs obtained in the first level analysis subunit and the second level analysis subunit to the deep learning model to calculate the risk assessment index Fpzs. The risk assessment index Fpzs is obtained by the following formula:

[0102] ;

[0103] In the formula, F1 and F2 represent the weight values ​​of the flow fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and V represents the second correction constant, where 0<F1≤1, 0<F2≤1, and F1+F2=1. The weight value can be obtained by referring to the hierarchical analysis method;

[0104] The management module includes an intrusion analysis unit and a processing unit;

[0105] The intrusion analysis unit is used to compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion degree of the current intelligent transportation network. The specific comparison and analysis content is as follows:

[0106] If the risk assessment index Fpzs is greater than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state, and the first control instruction is issued;

[0107] If the risk assessment index Fpzs is equal to the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state. At this time, a second control instruction is issued, indicating that the intrusion level of the current intelligent transportation network is in a warning state and medium protection measures need to be taken to prevent further deterioration.

[0108] If the risk assessment index Fpzs is less than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is not in an abnormal state, and the third control instruction is issued at this time;

[0109] The processing unit is used to take corresponding protection measures according to the instructions obtained from the intrusion analysis unit, and the specific contents are as follows:

[0110] If the first control instruction is issued, the corresponding abnormal subnet will be determined according to the abnormal status code, and the detected abnormal subnet will be immediately isolated from the main network to prevent the attack from spreading. An emergency alert will be sent to the network administrator and security team to notify them to immediately start the automated intrusion prevention system to detect and block new attack behaviors in real time, and start security audit logging to record all traffic and operations for subsequent analysis;

[0111] If the second control instruction is issued, traffic monitoring will be carried out in real time, network traffic will be analyzed in real time to capture abnormal behavior, or some non-critical services will be temporarily restricted or shut down to reduce the attack surface, and access to key resources will be restricted. A comprehensive security scan will be conducted on the entire network to identify potential vulnerabilities and weaknesses. At the same time, network emergency plans will be prepared and tested to enable rapid response when the situation deteriorates;

[0112] If a third-party control directive is issued, the network will be regularly reviewed and assessed for security to ensure the security status of all systems and equipment, regular security training and drills will be conducted to enhance the security awareness and response capabilities of employees and administrators, and network activity logs will continue to be recorded and monitored for auditing and analysis when necessary.

[0113] It should be noted that the hierarchical analysis method is a combination of qualitative and quantitative analysis methods. It can decompose complex problems into multiple levels. By comparing the importance of factors at each level, it can help decision makers make decisions on complex problems and determine the final decision plan. In this process, the hierarchical analysis method can be used to determine the weight values ​​of these indicators.

[0114] In this embodiment, by performing linear normalization processing on the request header sending speed Qfsd and the connection holding time Lbsc of the application layer, the system can accurately calculate the request state coefficient Qzxs. This processing method standardizes the data values ​​related to the request to a unified interval, so that the request header sending speed and the connection time can be effectively compared and analyzed. The traffic fluctuation coefficient Lbxs obtained from the first-level analysis subunit and the request state coefficient Qzxs obtained from the second-level analysis subunit are analyzed in combination with the deep learning model to calculate the risk assessment index Fpzs, so that the system can comprehensively evaluate the traffic fluctuation and request state, and further accurately predict the potential intrusion risk. When a serious intrusion risk is detected, the system can quickly isolate the abnormal subnet to prevent the attack from spreading, and start the automated intrusion prevention system, send an emergency alert to the network administrator and security team, and record all operations and traffic at the same time, providing detailed data for post-analysis. This rapid response mechanism effectively reduces the impact of attacks on the network. When the intrusion risk is in an alert state, the system reduces the attack surface through real-time traffic monitoring and temporary restriction measures, and performs security scans and vulnerability identification on the network. This preventive measure helps reduce the potential risk of attack and ensure the security of the network. When the intrusion risk is normal, the system regularly conducts network security reviews and employee training to maintain the long-term security status of the network. Through continuous monitoring and recording, the system can promptly detect and respond to possible security issues and enhance the network's protection capabilities.

[0115] According to the instructions of the intrusion analysis unit, the system can take targeted protective measures. Whether it is emergency isolation, real-time traffic monitoring, or regular security review, the system can flexibly respond to different degrees of intrusion risks and further improve the overall network security level. The system provides multi-faceted intelligent transportation network intrusion detection and response capabilities through multi-level request status analysis, traffic monitoring and risk assessment, combined with deep learning technology. Its precise request analysis and comprehensive risk assessment mechanism effectively improve the accuracy of intrusion detection, and through flexible protection measures and response mechanisms, it enhances the network's security protection capabilities.

[0116] Example 6

[0117] Please refer to Figure 1 and Figure 2 ,Specifically: A deep learning-based intelligent transportation network intrusion detection method, comprising the following steps:

[0118] Step 1: First, real-time monitoring of the relevant traffic change data information in the network layer and the relevant request data information in the application layer of the intelligent transportation network is performed to construct a network data set, and at the same time, real-time monitoring of the relevant status code feedback data information returned by the server to the client is performed;

[0119] Step 2: then extract the features of the relevant status code feedback data information, and construct the abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally;

[0120] Step 3: Then, using recurrent neural network technology, standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then conduct training and testing to build a deep learning model;

[0121] Step 4. After receiving the detection command, perform feature extraction on the relevant traffic change data information and the relevant request data information to calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and calculate the risk assessment index Fpzs by combining the deep learning model;

[0122] Step 5: Pre-set the assessment threshold Q, and compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding management measures based on the intrusion level.

[0123] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An intelligent transportation network intrusion detection system based on deep learning, characterized by: It includes network monitoring module, status code anomaly analysis module, model building module, intrusion risk prediction module and management module; The network monitoring module is used to monitor the relevant traffic change data information in the network layer and the relevant request data information in the application layer in the intelligent transportation network in real time to construct a network data set, and at the same time monitor the relevant status code feedback data information returned by the server to the client in real time; The network monitoring module includes a first monitoring unit, a second monitoring unit and a third monitoring unit; The first monitoring unit is used to monitor and record relevant traffic change data information in the network layer of the intelligent transportation network in real time, wherein the relevant traffic change data information includes IP addresses corresponding to various status code types, request time and response time, and byte rate Zjsz and data packet rate Sbsz; The second monitoring unit is used to monitor and record relevant request data information in the application layer of the intelligent transportation network in real time, wherein the relevant request data information includes the request frequency Dqp, the request header sending speed Qfsd and the connection holding time Lbsc of the IP address corresponding to various status code types; The third monitoring unit is used to monitor the relevant status code feedback data information returned by the server to the client in real time, wherein the relevant status code feedback data information includes the number Cms of different status code types in each monitoring time window, and combines the statistical mean algorithm to calculate the mean number of different status code types And the standard deviation of the number of different status code types ; The status code abnormality analysis module is used to extract features from the relevant status code feedback data information, and construct an abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally; The status code abnormality analysis module includes a status code analysis unit and a preliminary judgment unit; The state code analysis unit is used to calculate the abnormal change coefficient Ybxs of different types of state codes according to the relevant state code feedback data information after feature extraction, and the abnormal change coefficient Ybxs of the i-th type state code is calculated. i For example, it is obtained by the following formula: ； In the formula, It is represented as the number of status codes of type i in the jth monitoring time window, It is represented as the mean value of the number of type i status codes in all monitoring time windows, It is expressed as the standard deviation of the number of type i status codes in all monitoring time windows, It is expressed as the number of status codes of type i in the j-1 monitoring time window, Expressed as weight value; The model building module is used to use recurrent neural network technology to standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then train and test them to build a deep learning model; The intrusion risk prediction module is used to extract features from relevant traffic change data information and relevant request data information after receiving the detection command, so as to respectively calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs, and calculate the risk assessment index Fpzs in combination with the deep learning model; The intrusion risk prediction module includes a multi-level detection unit and a comprehensive analysis unit; The multi-level detection unit includes a first level analysis subunit and a second level analysis subunit; The first hierarchical analysis subunit is used to extract features of the relevant traffic change data information corresponding to the abnormal status code according to the relevant traffic change data information in the network layer, extract the data packet rate Sbsz and the byte rate Zjsz when the abnormal status code appears, perform linear normalization on the two parameters, and map the corresponding data values ​​in the interval The flow fluctuation coefficient Lbxs is calculated and then based on the following formula: ； Where n represents the monitoring period, i=1, 2, 3, ..., n, Sbsz i It is expressed as the packet rate in the i-th monitoring period, Zjsz i It is expressed as the byte rate in the i-th monitoring period, Sbsz avg It is expressed as the average packet rate during the monitoring period, Zjsz avg Expressed as the average byte rate during the monitoring period, and All are weight values; The second hierarchical analysis subunit is used to perform linear normalization processing on the request header sending speed Qfsd and the connection holding time Lbsc according to the relevant request data information in the application layer, and map the corresponding data values ​​in the interval In order to calculate the request status coefficient Qzxs, according to the following formula: ； Where Dqp represents the request frequency of the IP address corresponding to the abnormal status code, a1, a2 and a3 represent the weight values ​​of the request header sending speed Qfsd, the request frequency Dqp of the IP address corresponding to the abnormal status code and the connection holding time Lbsc, respectively, and C represents the first correction constant; The management module is used to pre-set the evaluation threshold Q, and compare and analyze the risk assessment index Fpzs with the evaluation threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding protection measures according to the intrusion level.

2. According to claim 1, a deep learning-based intelligent transportation network intrusion detection system is characterized by: The preliminary judgment unit is used to pre-set a change threshold, and compare and analyze the abnormal change coefficient Ybxs of the corresponding type of status code with the change threshold to preliminarily determine whether there is an intrusion risk in the current intelligent transportation network. The specific analysis content is as follows: If the abnormal change coefficient Ybxs of the corresponding type of status code exceeds the change threshold, it is preliminarily judged that there is an intrusion risk in the current intelligent transportation network. At this time, a detection command will be issued and the corresponding type of status code will be marked as an abnormal status code; If the abnormal change coefficient Ybxs of the corresponding type of status code does not exceed the change threshold, it is preliminarily judged that there is no intrusion risk in the current intelligent transportation network, and no additional detection commands will be issued to the outside at this time.

3. The deep learning-based intelligent transportation network intrusion detection system according to claim 1, characterized in that: The model building module is used to construct the original model using recurrent neural network technology, and train and test the original model with relevant traffic change data information in the network layer and relevant request data information in the application layer, and use the trained original model as the recognition model, obtain feature information in the recognition model respectively, and use the obtained feature information to train and test the recognition model, and finally use the trained recognition model as a deep learning model.

4. The deep learning-based intelligent transportation network intrusion detection system according to claim 1, characterized in that: The comprehensive analysis unit is used to transmit the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs obtained in the first level analysis subunit and the second level analysis subunit to the deep learning model to calculate the risk assessment index Fpzs. The risk assessment index Fpzs is obtained by the following formula: ； In the formula, F1 and F2 represent the weight values ​​of the flow fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and V represents the second correction constant.

5. The deep learning-based intelligent transportation network intrusion detection system according to claim 1 is characterized in that: The management module includes an intrusion analysis unit and a processing unit; The intrusion analysis unit is used to compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion degree of the current intelligent transportation network. The specific comparison and analysis content is as follows: If the risk assessment index Fpzs is greater than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state, and the first control instruction is issued; If the risk assessment index Fpzs is equal to the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is in an abnormal state, and the second control instruction is issued; If the risk assessment index Fpzs is less than the assessment threshold Q, it means that the intrusion level of the current intelligent transportation network is not in an abnormal state, and the third control instruction is issued at this time; The processing unit is used to take corresponding protection measures according to the instructions obtained from the intrusion analysis unit, and the specific contents are as follows: If the first control instruction is issued, the corresponding abnormal subnet will be determined according to the abnormal status code, and the detected abnormal subnet will be immediately isolated from the main network. An emergency alert will be sent to the network administrator and security team to notify them to immediately start the automated intrusion prevention system to detect and block new attack behaviors in real time, and start security audit logging to record all traffic and operations for subsequent analysis; If the second control instruction is issued, traffic monitoring will be carried out in real time, network traffic will be analyzed in real time to capture abnormal behavior, access rights to key resources will be restricted, a comprehensive security scan will be conducted on the entire network, and network emergency plans will be prepared and tested; If a third control directive is issued, the network will be regularly reviewed and assessed for security, security training and drills will be conducted regularly, and network activity logs will continue to be recorded and monitored.

6. A deep learning-based intelligent transportation network intrusion detection method, used to implement the deep learning-based intelligent transportation network intrusion detection system described in any one of claims 1 to 5, characterized in that: The following steps are included: Step 1: First, real-time monitoring of the relevant traffic change data information in the network layer and the relevant request data information in the application layer of the intelligent transportation network is performed to construct a network data set, and at the same time, real-time monitoring of the relevant status code feedback data information returned by the server to the client is performed; Step 2: then extract the features of the relevant status code feedback data information, and construct the abnormal change coefficient Ybxs based on the relevant status code feedback data information after feature extraction. If the abnormal change coefficient Ybxs exceeds the change threshold, a detection command is issued externally; Step 3: Then, using recurrent neural network technology, standardize the relevant traffic change data information in the network layer and the relevant request data information in the application layer, and then conduct training and testing to build a deep learning model; Step 4. After receiving the detection command, perform feature extraction on the relevant traffic change data information and the relevant request data information to calculate the traffic fluctuation coefficient Lbxs and the request state coefficient Qzxs respectively, and calculate the risk assessment index Fpzs by combining the deep learning model; Step 5: Pre-set the assessment threshold Q, and compare and analyze the risk assessment index Fpzs with the assessment threshold Q to comprehensively estimate the intrusion level of the current intelligent transportation network and take corresponding management measures based on the intrusion level.

Images