Network security detection method and system based on deep learning

Abstract

The present invention proposes a network security detection method and system based on deep learning, the method includes: deploying a self-evolving neurocryptography module based on an adversarial network for adversarial learning; constructing a deep belief model, using preprocessed data to train the deep belief network, analyzing and identifying abnormal patterns and covert communication behaviors in network traffic; integrating multiple data sources, extracting multimodal deep features; constructing a multimodal deep learning model to process multimodal deep features; introducing an online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model is dynamically updated according to new data; using a multimodal deep learning model that introduces an online learning mechanism combined with data analysis and machine learning to monitor the network in real time and identify threats; if there is a threat, implementing an automated protection strategy and automatically triggering defense measures. The present invention provides a new, highly adaptive and comprehensive solution for the field of network security.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security detection, and in particular to a network security detection method and system based on deep learning. Background Art

[0002] With the rapid development of information technology and the increasing complexity of network environments, network security has become a global focus. Traditional network security defense systems, such as firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS), mainly rely on known threat signatures or simple behavioral pattern matching to identify and block attacks. These systems are highly efficient in dealing with traditional, well-defined forms of attack such as viruses, worms, and Trojans. However, in the face of ever-changing attack methods, especially zero-day attacks, advanced persistent threats (APTs), and complex threats using multi-level, multi-stage technologies, the effectiveness of these traditional defense tools has been significantly reduced.

[0003] Existing network security detection systems usually use static threat identification technologies, which are mostly based on static rules or known attack feature libraries. Their inherent limitations are that they are difficult to cope with rapidly changing attack strategies and patterns. For example, once an attacker modifies the attack code or adopts new evasion techniques, traditional security systems may not be able to identify and prevent these attacks. In addition, with the popularization of encrypted communications, malicious communications are increasingly hidden in encrypted data, which poses a great challenge to traditional security systems that rely on packet inspection.

[0004] In view of the above problems, although deep learning technology has been proposed to be applied in the field of network security, especially in the detection of abnormal behavior of non-encrypted traffic, it has shown good results. However, most existing deep learning models still face problems such as requiring a large amount of labeled data for training and difficulty in adapting to the rapid changes of new attack patterns. At the same time, the research and application of deep learning in processing encrypted traffic, especially in identifying covert communications (such as steganography), are not mature enough. In addition, the current system also has deficiencies in the integration and processing of multi-source data, and fails to make full use of multi-dimensional information resources such as system logs and user behavior to improve the comprehensiveness and accuracy of detection.

[0005] Therefore, a new network security detection system that can self-evolve, cross-source integration, and effectively identify covert communications is urgently needed to meet these challenges. Summary of the invention

[0006] The purpose of the present invention is to design a network security detection method and system based on deep learning. The present invention constructs a network security detection method and system based on deep learning that can self-evolve, respond in real time and efficiently process multi-source data. Each step is designed to solve the shortcomings of traditional network security technology in dealing with new, complex and hidden threats, and together ensure the efficiency and reliability of the system in a modern network environment. This comprehensive method fully solves the problems mentioned in the background technology and provides a new solution, aiming to improve the defense capabilities and intelligence level of the entire network security field.

[0007] In order to achieve the above object, a first aspect of the present invention provides a network security detection method based on deep learning, comprising the following steps:

[0008] Deploy a self-evolving neural cryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neural cryptography module includes an encryption algorithm and a decryption cracking algorithm;

[0009] Preprocess the encrypted communication data, build a deep belief model, use the preprocessed data to train the deep belief network, analyze and identify abnormal patterns and covert communication behaviors in network traffic;

[0010] Integrate multiple data sources and use deep learning algorithms to extract multimodal deep features; wherein the multiple data sources include network traffic data, system logs, and user behavior logs;

[0011] A multimodal deep learning model is constructed according to the multimodal deep features to process the multimodal deep features; wherein the loss function L of the multimodal deep learning model is:

[0012]

[0013] Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output;

[0014] Introducing an online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model can be dynamically updated according to new data;

[0015] Use a multimodal deep learning model that introduces an online learning mechanism, combined with data analysis and machine learning, to monitor the network in real time and identify threats; if a threat exists, implement automated protection strategies and automatically trigger defense measures;

[0016] Wherein, constructing a deep belief model includes:

[0017] Construct a multi-layer RBM stack to form a deep belief network, where each layer of RBM is responsible for extracting the features of the previous layer of data;

[0018] The network weights and biases are initialized using the contrastive divergence algorithm; the update iteration formula is as follows:

[0019] Δw=∈·(<v0,h0> - <v k ,h k >)

[0020] Among them, ∈ represents the learning rate, v0 and h0 represent the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h k They represent the states of the visible layer and the hidden layer after k Gibbs samplings respectively; Δw represents the weight deviation;

[0021] The supervised learning method is used to train the deep belief model. The top layer of the deep belief model is trained with labeled data to realize the recognition of specific attack patterns. At the same time, a dynamic learning rate adjustment mechanism is introduced to dynamically adjust the learning rate according to the performance of the deep belief model on the validation set to enhance the generalization ability of the model. The formula for the dynamic adjustment is expressed as:

[0022]

[0023] Among them, ∈(t+1) represents the updated learning rate, t is the current iteration number, T is the total iteration number, Represents real-time learning rate adjustment weights.

[0024] Preferably, the method further comprises:

[0025] Establish a closed-loop mechanism of continuous learning and self-optimization to optimize the network security detection method, including:

[0026] Collect key performance indicators regularly, implement automated scripts and monitoring tools to record key performance indicators, and store them in the performance database;

[0027] Use statistical analysis and machine learning models to identify patterns in data in performance databases;

[0028] Based on the recognition results, the detection parameters and response strategies are dynamically adjusted, and then the improved response strategies are incorporated into real-time monitoring and evaluation again, forming a closed-loop optimization process.

[0029] Preferably, the deployment of the self-evolving neurocryptography module based on the adversarial network specifically comprises the following steps:

[0030] Deploy a physical random number generator based on quantum principles to determine the initial key length and generate the initial key, which is then published to the communication nodes and encryption devices of the network;

[0031] Monitor network traffic and attack patterns, collect data, and dynamically adjust key length and update frequency based on the monitored data;

[0032] A new key is generated based on the adjusted key length using a physical random number generator based on quantum principles and republished to the communication nodes and encryption devices of the network.

[0033] Preferably, the analyzing and identifying abnormal patterns and covert communication behaviors in network traffic includes:

[0034] The trained deep belief model is deployed in the network environment to analyze inbound and outbound traffic, as well as internal behavior patterns in real time. At the same time, the output layer of the deep belief network evaluates the abnormal probability of each event. When the detected behavior pattern is different from the learned normal pattern, a security alarm is triggered.

[0035] Preferably, the integration of multiple data sources and the use of deep learning algorithms to extract multimodal deep features include:

[0036] Define feature extraction rules for each type of data and use time window synchronization method to process data consistency;

[0037] Apply a specific feature extraction algorithm to each data source, and then convert the features of all data sources into a unified vector form;

[0038] A data-driven dynamic adaptive feature fusion network is constructed to automatically adjust the fusion weight of each feature vector for adaptive fusion. A context-aware autoencoder structure is constructed to take the context state as input. Then, through training, the dynamic adaptive feature fusion network can encode and utilize context information in the representation of features.

[0039] The adaptive fusion is expressed as follows:

[0040]

[0041] Among them, V fused represents the fused features, w i represents the fusion weight, V i represents the eigenvector, i represents the number of eigenvectors;

[0042] The context-aware autoencoder is represented as follows:

[0043]

[0044] Among them, Encoder and Decoder represent encoder and decoder respectively, V fused represents the fused features, C represents the context information, Represents the reconstructed feature representation.

[0045] Preferably, the structure of the multimodal deep learning model is a multi-input multi-output neural network structure, wherein each type of input data corresponds to an input branch, which is expressed as follows:

[0046] h i =f i (X i θ i )

[0047] Among them, X i represents the input of the i-th data type, f i represents the corresponding feature extraction function, θ i Represents the parameters of this layer;

[0048] At the same time, an adaptive fusion layer is introduced to dynamically integrate the features of each input branch using the learned weights, as shown below:

[0049]

[0050] Among them, α i represents the weight of the i-th branch obtained through learning, h i represents the feature representation obtained from the corresponding branch;

[0051] According to the multi-input of the multimodal deep learning model, multiple output layers are designed, which are expressed as follows:

[0052] Y k =g k (H fused ; φ k )

[0053] Among them, g k represents the function of the kth output task, φ k Represents the parameters of the output layer.

[0054] Preferably, the online learning mechanism is expressed as follows:

[0055]

[0056] Among them, θ t represents the model parameters at time t, η t represents the learning rate, represents the gradient of the loss function L with respect to the parameter, x t and t Respectively represent the data and labels currently being processed;

[0057] The adaptive adjustment is expressed as follows:

[0058] η t+1 =Adjust(η t , performance t )

[0059] Among them, Adjust means based on performance indicators performance t Adjust the learning rate η t function.

[0060] Preferably, the use of a multimodal deep learning model that introduces an online learning mechanism combined with data analysis and machine learning to monitor the network in real time includes:

[0061] Collect network traffic data and logs of network devices and security devices in real time, and pre-process them to obtain pre-processed data streams;

[0062] Extract key features and analyze abnormal behaviors in data streams in real time, use sliding window technology to process data streams, and extract time series features;

[0063] Use machine learning models to predict whether network behavior is a threat based on time series characteristics; if a threat is present, predefined response measures are automatically executed.

[0064] Preferably, if a threat exists, defense measures are automatically triggered simultaneously, including:

[0065] The threat level is assessed based on the prediction results of the machine learning model and metadata, as shown below:

[0066] =R(y,m)

[0067] Among them, L represents the threat level, y represents the predicted threat type, and m represents metadata related to the threat;

[0068] Configure automated response strategies based on threat levels, automatically execute corresponding defense measures, and dynamically adjust response strategies based on feedback results.

[0069] In a second aspect of the present invention, a network security detection system based on deep learning is provided, the system comprising:

[0070] An encrypted communication device is used to deploy a self-evolving neurocryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neurocryptography module includes an encryption algorithm and a decryption cracking algorithm; at the same time, the encrypted communication data is preprocessed to construct a deep belief model, and the deep belief network is trained using the preprocessed data to analyze and identify abnormal patterns and covert communication behaviors in network traffic;

[0071] A data integration device, used to integrate multiple data sources and extract multimodal deep features using a deep learning algorithm; wherein the multiple data sources include network traffic data, system logs, and user behavior logs;

[0072] A safety detection device is used to construct a multimodal deep learning model based on the multimodal deep features to process the multimodal deep features; wherein the loss function L of the multimodal deep learning model is:

[0073]

[0074] Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output;

[0075] Dynamic update and alarm device, used to introduce online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model can be dynamically updated according to new data; use the multimodal deep learning model introduced with online learning mechanism combined with data analysis and machine learning to monitor the network in real time and identify threats; if there is a threat, implement automated protection strategy and automatically trigger defense measures;

[0076] Wherein, constructing a deep belief model includes:

[0077] Construct a multi-layer RBM stack to form a deep belief network, where each layer of RBM is responsible for extracting the features of the previous layer of data;

[0078] The network weights and biases are initialized using the contrastive divergence algorithm; the update iteration formula is as follows:

[0079] Δw=∈·( <v0,h0)-<v k ,h k >)

[0080] Among them, ∈ represents the learning rate, v0 and h0 represent the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h kThey represent the states of the visible layer and the hidden layer after k Gibbs samplings respectively; Δw represents the weight deviation;

[0081] The supervised learning method is used to train the deep belief model. The top layer of the deep belief model is trained with labeled data to realize the recognition of specific attack patterns. At the same time, a dynamic learning rate adjustment mechanism is introduced to dynamically adjust the learning rate according to the performance of the deep belief model on the validation set to enhance the generalization ability of the model. The formula for the dynamic adjustment is expressed as:

[0082]

[0083] Among them, ∈(t+1) represents the updated learning rate, t is the current iteration number, T is the total iteration number, Represents real-time learning rate adjustment weights.

[0084] The beneficial technical effects of the present invention are at least as follows:

[0085] (1) The present invention uses the framework of adversarial networks to enable encryption and decryption algorithms to self-learn and optimize in the continuous attack and defense process, effectively responding to new and unknown attack methods, especially zero-day attacks and advanced persistent threats (APT). This solves the defect that traditional systems cannot adapt to rapidly changing attack patterns.

[0086] (2) The present invention uses deep belief networks to process encrypted traffic, and with its powerful feature learning capabilities, it can effectively identify and reveal covert communications conducted through technologies such as steganography. This innovation overcomes the shortcomings of existing technologies in processing encryption and covert communications.

[0087] (3) The present invention integrates multiple data sources such as network traffic, system logs, and user behavior, and extracts and fuses features through a deep learning model, significantly improving the comprehensiveness and accuracy of detection. This multi-dimensional data fusion method solves the limitations of traditional systems in multi-source information integration and processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0088] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0089] Figure 1 This is a flow chart of the network security detection method based on deep learning of the present invention.

[0090] Figure 2 This is a framework diagram of the network security detection system based on deep learning in the present invention. DETAILED DESCRIPTION

[0091] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0092] In one or more embodiments, Figure 1 As shown, a network security detection method based on deep learning is disclosed, and the method includes the following steps S1-S7:

[0093] S1. Deploy a self-evolving neural cryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neural cryptography module includes an encryption algorithm and a decryption cracking algorithm.

[0094] Specifically, the self-evolving neurocryptography module based on adversarial networks refers to the deployment of a physical random number generator (QRNG) based on quantum principles, among which a QRNG based on the time difference of photon arrival is selected because the random numbers it generates are highly unpredictable and are ideal for generating encryption keys, determining the initial key length L0, such as 256 bits, and the initial key update frequency f0, such as once an hour.

[0095] Furthermore, the initial key K0 is generated using QRNG and distributed to encryption modules in the network.

[0096] Monitor network traffic and attack patterns, collect data D, in order to analyze the current network security status, and dynamically adjust the key length L and update frequency f according to the monitored data. The adjustment formula is:

[0097]

[0098] Where e(t) represents the error signal at time t, which measures the difference between the current key strength and the network threat level; K p (proportional coefficient) and K i (Integral coefficient) is a controller parameter that needs to be adjusted to the optimum through initial experiments or simulations.

[0099] Among them, QRNG is used to generate a new key K according to the adjusted key length L(t) t , through a secure distribution system, the new key K t Distributed to all encryption devices and communication nodes in the network to ensure encryption strength keeps pace with the latest network security threats.

[0100] S2. Preprocess the encrypted communication data, build a deep belief model, use the preprocessed data to train the deep belief network, and analyze and identify abnormal patterns and covert communication behaviors in network traffic.

[0101] Specifically, the data source is collected from network traffic, system logs, and application logs, covering multi-dimensional data from IP packet level to user operation level, and then the collected data is standardized, such as converting IP addresses and timestamps into numerical data. Use the standardized formula:

[0102]

[0103] Where x is the original data, μ is the mean, and σ is the standard deviation.

[0104] Preferably, a deep belief network is constructed, including:

[0105] (1) Construct a multi-layer RBM (restricted Boltzmann machine) stack to form a deep belief network. Each layer of RBM is responsible for extracting higher-level features of the previous layer of data;

[0106] (2) Use the Contrastive Divergence (CD-k) algorithm to initialize the network weights and biases. The specific iterative update formula is:

[0107] Δw=∈·(<v0,h0> - <v k ,h k >) (3)

[0108] Where ∈ is the learning rate, v0 and h0 are the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h k is the state after k Gibbs samplings.

[0109] (3) The supervised learning method is used to refine the model and the top layer of the deep belief network is trained with labeled data to achieve the recognition of specific attack patterns.

[0110] (4) Introduce a dynamic learning rate adjustment mechanism to adjust the learning rate based on the model's performance on the validation set to enhance the model's generalization ability. The dynamic adjustment formula is:

[0111]

[0112] Where d is the vote reduction factor, t is the current iteration number, and T is the total iteration number. Represents real-time learning rate adjustment weights.

[0113] Preferably, the trained model is deployed in a network environment to analyze inbound and outbound traffic, as well as internal behavior patterns in real time. The output layer of the deep belief network is used to evaluate the abnormal probability of each event, and a security alert is triggered when the detected behavior pattern differs significantly from the learned normal pattern.

[0114] S3. Integrate multiple data sources and use deep learning algorithms to extract multimodal deep features; wherein the multiple data sources include network traffic data, system logs, and user behavior logs.

[0115] Specifically, multiple data sources select network traffic data, system logs, and user behavior logs as input data.

[0116] Among them, feature extraction rules are defined for each type of data. For example, the source IP, destination IP, packet size, etc. are extracted from network traffic; event type, time interval, etc. are extracted from system logs; login time, operation frequency, etc. are extracted from user behavior logs. The time window synchronization method is used to align the records of all data sources in time by setting a unified time window △t to ensure time consistency.

[0117]

[0118] Where T(x) is the original timestamp, T sync (x) is the timestamp after synchronization.

[0119] Furthermore, a specific feature extraction algorithm is applied to each data source. For example, information gain is used to evaluate the contribution of each feature in network traffic data to attack identification. The features of all data sources are converted into a unified vector form and formatted using one-hot encoding or normalization.

[0120] V i =encode(f i ) (6)

[0121] Among them, f i is the original feature extracted from the data, V i is the transformed eigenvector.

[0122] Preferably, in order to more effectively integrate features from different data sources and to address special needs of network security, the present invention proposes a dynamic adaptive feature fusion network (DAFFN), which uses a data-driven weight allocation mechanism to automatically adjust the fusion weight of each feature vector.

[0123] Among them, the weight learning layer design: a deep learning network is embedded in the feature fusion process. The goal of this network is to learn the importance of each feature vector in different security threat scenarios.

[0124] Implementation: The weight of each feature vector is not statically specified but dynamically calculated through a trained neural network layer that considers the contextual information of the current network security environment.

[0125] w i =softmax(NN(V i ,C)) (7)

[0126] Among them, NN represents neural network, V i is the feature vector, C is the context information of the current network (such as attack type, network load, etc.), w i is the calculated weight, and i represents the number of eigenvectors.

[0127] According to the dynamic weight of each feature vector, the adaptive weighted fusion of feature vectors is realized, which is expressed as follows:

[0128]

[0129] This approach allows the system to flexibly adjust the feature fusion strategy according to changes in the actual network environment, improving the system's adaptability and recognition accuracy to new and complex attacks.

[0130] Preferably, for deep feature learning in network security, Benfang designed a context-aware feature encoding method to further refine and enhance the features used for threat detection.

[0131] Specifically, we develop an autoencoder structure that not only considers the underlying features from the data, but also takes the contextual state of the network as input. Combining a traditional autoencoder with an additional contextual input layer, the training process enables the network to encode and utilize contextual information in the representation of features.

[0132]

[0133] Among them, Encoder and Decoder represent encoder and decoder respectively, V fused is the fused feature, C is the context information, is the reconstructed feature representation.

[0134] Through this dynamic adaptive feature fusion network (DAFFN) and context-aware feature encoding method, the complexity and dynamics of network security data can be handled more effectively, providing strong data support and highly adaptive feature representation for network threat detection.

[0135] S4. Construct a multimodal deep learning model based on the multimodal deep features to process the multimodal deep features.

[0136] Specifically, the multimodal deep learning model uses a multiple-input multiple-output (MIMO) neural network structure, where each type of input data (network traffic, system logs, user behavior) corresponds to an input branch. Each branch is configured with a dedicated feature extraction layer, such as a convolutional layer for processing time series data and a fully connected layer for processing categorical data.

[0137] h i =f i (x i θ i ) (10)

[0138] Among them, x i is the input of the i-th data type, f i is the corresponding feature extraction function, θ i are the parameters of this layer.

[0139] Among them, an adaptive fusion layer is introduced into the multimodal deep learning model, and the features of each input branch are dynamically integrated using the learned weights.

[0140]

[0141] Among them, α i is the weight of the i-th branch obtained through learning, h i is the feature representation obtained from the corresponding branch.

[0142] According to the needs of network security, multiple output layers are designed, for example, one output layer is used for attack type classification and another output layer is used for abnormal behavior detection.

[0143] Y k =g k (H fused ; φ k ) (12)

[0144] Among them, g k is the function of the kth output task, φ k are the parameters of the output layer.

[0145] Furthermore, a combined loss function is adopted to optimize the performance of multiple output tasks simultaneously.

[0146]

[0147] Among them, L k is the loss function of the kth task, λ k is the corresponding weight, which is used to adjust the contribution of each task in the total loss.

[0148] Furthermore, the model parameters are optimized using back propagation and gradient descent algorithms to ensure that the losses of all tasks are minimized.

[0149] S5. Introduce an online learning mechanism to adaptively adjust the learning rate so that the multimodal deep learning model can be dynamically updated according to new data.

[0150] Specifically, the system is configured to receive data in real time from multiple data sources such as network traffic, system logs, etc. Lightweight preprocessing is performed on the real-time data, such as format normalization and necessary data cleaning, to ensure data quality.

[0151] Furthermore, using online learning algorithms, such as online gradient descent, allows the model to update its parameters instantly when receiving new data, thereby adapting to the new data distribution, as shown below:

[0152]

[0153] Among them, θ t is the model parameter at time t, η is the learning rate, is the gradient of the loss function L with respect to the parameters, x t and t They are the data and labels currently being processed.

[0154] At the same time, based on model performance feedback, such as error rate and recognition accuracy, key parameters such as learning rate and model structure parameters are dynamically adjusted.

[0155] η t+1 =Adjust(η t ,performance t ) (15)

[0156] Among them, Adjust is based on performance indicators t Adjust the learning rate η t This may involve increasing or decreasing the learning rate to adapt to the model's learning progress and changing data characteristics.

[0157] Preferably, a real-time monitoring mechanism is established to track key performance indicators during the learning process, such as model loss and accuracy, to ensure the stability and reliability of the system. At the same time, the model's responsiveness to emerging threats is regularly evaluated to ensure its effectiveness and accuracy in the actual network environment.

[0158] S6 uses a multimodal deep learning model that introduces an online learning mechanism combined with data analysis and machine learning to monitor the network in real time and identify threats; if a threat exists, it implements an automated protection strategy and automatically triggers defense measures.

[0159] Specifically, the system is configured to receive network traffic data and logs from network devices and security devices (such as firewalls, IDS) in real time. Perform time synchronization and preliminary cleaning on the received data to ensure data quality. Use minimal processing to reduce latency, such as fast format conversion and basic data validation. Extract key features from each data packet or transaction record, such as IP address, port number, protocol type, load size, etc. Analyze patterns and abnormal behaviors in data streams in real time, use sliding window technology to process data streams, and extract time series features.

[0160] f dynamic =windowfunc(f current ,W) (16)

[0161] where f current is the feature value of the current observation, W is the defined time window size, and window_func is the function used to extract features from the data within the window.

[0162] Preferably, a pre-trained machine learning model is deployed in the system for real-time analysis and identification of potential threats. A classification or anomaly detection model based on deep learning is used to evaluate in real time whether network behavior poses a potential threat.

[0163] y predicted =MLmodel(F combined ) (17)

[0164] Among them, F combined It represents the feature set extracted and synthesized from real-time data, and ML_model is the machine learning model used for threat identification.

[0165] Preferably, when the model predicts that a certain behavior or traffic is a potential threat, an alarm is automatically triggered, and predefined response measures are automatically executed based on the type and severity of the threat, such as isolating the attack source, restricting access to the affected port, etc.

[0166] Response(y predicted ) (18)

[0167] Where Response is the prediction result y according to the model predicted The defined response function determines the security measures to be taken.

[0168] Furthermore, in order to improve the efficiency of automated response to network threats, the present invention can automatically execute defense measures and adjust strategies according to the development of threats through dynamic analysis and response strategies.

[0169] Specifically, the system automatically assesses the threat level based on the model prediction results and related metadata, as shown below:

[0170] L=R(y,m) (19)

[0171] Where L represents the threat level, y represents the predicted threat type, and m represents metadata related to the threat, such as the time and location of occurrence. R is the rule engine function used to calculate L based on y and m.

[0172] Preferably, the automated response strategy is configured according to the threat level.

[0173] A=S(L) (20)

[0174] Where A is a determined action or measure, S is a policy configuration function, and the corresponding action is selected according to the threat level L.

[0175] The system automatically executes the corresponding defense measures, Execute (A). After implementation, the system monitors the effectiveness of the measures and provides feedback, as shown below:

[0176] F(A,E) (21)

[0177] Where E represents the actual effect of the measure, which is used to adjust the future strategy. F is the feedback function, which is used to update the system behavior based on the action A and the effect E.

[0178] Preferably, the response strategy is dynamically adjusted based on the feedback results.

[0179] Adjust(F) (22)

[0180] The adjustment strategy function Adjust updates the response strategy according to the feedback F.

[0181] S7. Establish a closed-loop mechanism of continuous learning and self-optimization to optimize the network security detection method, including:

[0182] Regularly collect key performance indicators, such as threat detection accuracy, response time, system resource utilization, etc.; implement automated scripts and monitoring tools to record the above indicators in real time and store them in the performance database.

[0183] P(t)={p1(t), p2(t),...,p n (t)} (23)

[0184] Where p(t) represents the performance data set collected at time t, p i (t) represents the value of the i-th performance indicator;

[0185] Use statistical analysis and machine learning models to perform trend analysis and pattern recognition on performance data to identify potential system bottlenecks or causes of efficiency degradation, as shown below:

[0186] θ new=optimize(θ old , ΔM) (25)

[0187] Among them, θ old and θ new They are the system parameters before and after adjustment, and ΔM is the system parameter from the feedback model M feedback The resulting suggestions for improvement;

[0188] According to the recognition results, the detection parameters and response strategies are dynamically adjusted, and then the improved response strategies are incorporated into the real-time monitoring and evaluation again, forming a closed-loop optimization process, which is expressed as follows:

[0189] feedback_loop(θ new ) (26)

[0190] Using the new system parameters θ new Continue to monitor performance and collect data to provide data support for the next round of optimization.

[0191] In one or more embodiments, Figure 2 As shown, a network security detection system based on deep learning is disclosed, and the system includes:

[0192] The encrypted communication device 101 is used to deploy a self-evolving neurocryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neurocryptography module includes an encryption algorithm and a decryption cracking algorithm; at the same time, the encrypted communication data is preprocessed to construct a deep belief model, and the deep belief network is trained using the preprocessed data to analyze and identify abnormal patterns and covert communication behaviors in network traffic;

[0193] A data integration device 102, used to integrate multiple data sources and extract multimodal deep features using a deep learning algorithm; wherein the multiple data sources include network traffic data, system logs, and user behavior logs;

[0194] The safety detection device 103 is used to construct a multimodal deep learning model according to the multimodal deep features to process the multimodal deep features; wherein the loss function L of the multimodal deep learning model is:

[0195]

[0196] Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output;

[0197] Dynamic update and alarm device 104, used to introduce an online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model is dynamically updated according to new data; the multimodal deep learning model introduced with the online learning mechanism is used in combination with data analysis and machine learning to monitor the network in real time and identify threats; if there is a threat, an automated protection strategy is implemented to automatically trigger defense measures;

[0198] Wherein, constructing a deep belief model includes:

[0199] Construct a multi-layer RBM stack to form a deep belief network, where each layer of RBM is responsible for extracting the features of the previous layer of data;

[0200] The network weights and biases are initialized using the contrastive divergence algorithm; the update iteration formula is as follows:

[0201] Δw=∈·(〈v0,h0)- <v k ,h k >)

[0202] Among them, ∈ represents the learning rate, v0 and h0 represent the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h k They represent the states of the visible layer and the hidden layer after k Gibbs samplings respectively; Δw represents the weight deviation;

[0203] The supervised learning method is used to train the deep belief model. The top layer of the deep belief model is trained with labeled data to realize the recognition of specific attack patterns. At the same time, a dynamic learning rate adjustment mechanism is introduced to dynamically adjust the learning rate according to the performance of the deep belief model on the validation set to enhance the generalization ability of the model. The formula for the dynamic adjustment is expressed as:

[0204]

[0205] Among them, ∈(t+1) represents the updated learning rate, t is the current iteration number, T is the total iteration number, Represents real-time learning rate adjustment weights.

[0206] It is worth noting that the specific workflow of the deep learning-based network security detection system provided in the embodiment of the present invention is the same as the workflow of the deep learning-based network security detection method described in the above embodiment, and will not be repeated here.

[0207] Compared with the prior art, the network security detection system based on deep learning provided by the embodiment of the present invention deploys a self-evolving neural cryptography module based on an adversarial network for adversarial learning to obtain encrypted communication data; wherein the self-evolving neural cryptography module includes an encryption algorithm and a decryption cracking algorithm; the encrypted communication data is preprocessed to construct a deep belief model, and the deep belief network is trained using the preprocessed data to analyze and identify abnormal patterns and covert communication behaviors in network traffic; multiple data sources are integrated and multi-modal deep features are extracted using a deep learning algorithm; wherein the multiple data sources include network traffic data, system logs, and user behavior logs; a multi-modal deep learning model is constructed based on the multi-modal deep features to process the multi-modal deep features; wherein the loss function L of the multi-modal deep learning model is:

[0208]

[0209] Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output; introduces an online learning mechanism to adaptively adjust the learning rate so that the multimodal deep learning model can be dynamically updated according to new data; uses the multimodal deep learning model that introduces the online learning mechanism in combination with data analysis and machine learning to monitor the network in real time and identify threats; if there is a threat, implements an automated protection strategy and automatically triggers defense measures.

[0210] The embodiment of the present invention also provides a network security detection device based on deep learning, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the steps in the embodiment of the network security detection method based on deep learning are implemented, for example Figure 1 or, the processor implements the functions of each module in the above-mentioned system embodiments when executing the computer program.

[0211] Exemplarily, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the deep learning-based network security detection device.

[0212] The network security detection device based on deep learning can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The network security detection device based on deep learning can include, but is not limited to, a processor and a memory. Those skilled in the art can understand that the network security detection device based on deep learning can also include input and output devices, network access devices, buses, etc.

[0213] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASAC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the network security detection device based on deep learning, and various interfaces and lines are used to connect the various parts of the entire network security detection device based on deep learning.

[0214] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the network security detection device based on deep learning by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the operation of the air-conditioning controller, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMedaaCard, SMC), a secure digital (SecureDagatal, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0215] Wherein, if the module integrated in the network security detection device based on deep learning is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0216] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0217] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network security detection method based on deep learning, characterized in that: The following steps are involved: Deploy a self-evolving neural cryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neural cryptography module includes an encryption algorithm and a decryption cracking algorithm; Preprocess the encrypted communication data, build a deep belief model, use the preprocessed data to train the deep belief network, analyze and identify abnormal patterns and covert communication behaviors in network traffic; Integrate multiple data sources and use deep learning algorithms to extract multimodal deep features; wherein the multiple data sources include network traffic data, system logs, and user behavior logs; A multimodal deep learning model is constructed according to the multimodal deep features to process the multimodal deep features; wherein the loss function L of the multimodal deep learning model is: Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output; Introducing an online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model can be dynamically updated according to new data; Use a multimodal deep learning model that introduces an online learning mechanism, combined with data analysis and machine learning, to monitor the network in real time and identify threats; if a threat exists, implement automated protection strategies and automatically trigger defense measures; Wherein, constructing a deep belief model includes: Construct a multi-layer RBM stack to form a deep belief network, where each layer of RBM is responsible for extracting the features of the previous layer of data; The network weights and biases are initialized using the contrastive divergence algorithm; the update iteration formula is as follows: Δw=∈·(<v0,h0>-<v k ,h k >) Among them, ∈ represents the learning rate, v0 and h0 represent the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h k They represent the states of the visible layer and the hidden layer after k Gibbs samplings respectively; Δw represents the weight deviation; The supervised learning method is used to train the deep belief model. The top layer of the deep belief model is trained with labeled data to realize the recognition of specific attack patterns. At the same time, a dynamic learning rate adjustment mechanism is introduced to dynamically adjust the learning rate according to the performance of the deep belief model on the validation set to enhance the generalization ability of the model. The formula for the dynamic adjustment is expressed as: Among them, ∈(t+1) represents the updated learning rate, t is the current iteration number, T is the total iteration number, Represents real-time learning rate adjustment weights.

2. The network security detection method based on deep learning according to claim 1, characterized in that: The method further comprises: Establish a closed-loop mechanism of continuous learning and self-optimization to optimize the network security detection method, including: Collect key performance indicators regularly, implement automated scripts and monitoring tools to record key performance indicators, and store them in the performance database; Use statistical analysis and machine learning models to identify patterns in data in performance databases; Based on the recognition results, the detection parameters and response strategies are dynamically adjusted, and then the improved response strategies are incorporated into the real-time monitoring and evaluation again, forming a closed-loop optimization process.

3. The network security detection method based on deep learning according to claim 1, characterized in that: The deployment of the self-evolving neurocryptography module based on the adversarial network specifically includes the following steps: Deploy a physical random number generator based on quantum principles to determine the initial key length and generate the initial key, which is then published to the communication nodes and encryption devices of the network; Monitor network traffic and attack patterns, collect data, and dynamically adjust key length and update frequency based on the monitored data; A new key is generated based on the adjusted key length using a physical random number generator based on quantum principles and republished to the communication nodes and encryption devices of the network.

4. The network security detection method based on deep learning according to claim 1, characterized in that: The analysis and identification of abnormal patterns and covert communication behaviors in network traffic includes: The trained deep belief model is deployed in the network environment to analyze inbound and outbound traffic, as well as internal behavior patterns in real time. At the same time, the output layer of the deep belief network evaluates the abnormal probability of each event. When the detected behavior pattern is different from the learned normal pattern, a security alarm is triggered.

5. The network security detection method based on deep learning according to claim 1, characterized in that: The method integrates multiple data sources and uses deep learning algorithms to extract multimodal deep features, including: Define feature extraction rules for each type of data and use time window synchronization method to process data consistency; Apply a specific feature extraction algorithm to each data source, and then convert the features of all data sources into a unified vector form; A data-driven dynamic adaptive feature fusion network is constructed to automatically adjust the fusion weight of each feature vector for adaptive fusion. A context-aware autoencoder structure is constructed to take the context state as input. Then, through training, the dynamic adaptive feature fusion network can encode and utilize context information in the representation of features. The adaptive fusion is expressed as follows: Among them, V fused represents the fused features, w i represents the fusion weight, V i represents the eigenvector, i represents the number of eigenvectors; The context-aware autoencoder is represented as follows: Among them, Encoder and Decoder represent encoder and decoder respectively, V fused represents the fused features, C represents the context information, Represents the reconstructed feature representation.

6. The network security detection method based on deep learning according to claim 1, characterized in that: The structure of the multimodal deep learning model is a multi-input and multi-output neural network structure, in which each input data corresponds to an input branch, which is expressed as follows: h i =f i (X i ;θ i ) Among them, X i Represents the input of the i-th data type, f i represents the corresponding feature extraction function, θ i Represents the parameters of this layer; At the same time, an adaptive fusion layer is introduced to dynamically integrate the features of each input branch using the learned weights, as shown below: Among them, α i represents the weight of the i-th branch obtained through learning, h i represents the feature representation obtained from the corresponding branch; According to the multi-input of the multimodal deep learning model, multiple output layers are designed, which are expressed as follows: Y k =g k (H fused ;φ k ) Among them, g k represents the function of the kth output task, φ k Represents the parameters of the output layer.

7. The network security detection method based on deep learning according to claim 1, characterized in that: The online learning mechanism is expressed as follows: Among them, θ t represents the model parameters at time t, η t represents the learning rate, represents the gradient of the loss function L with respect to the parameter, x t and t Respectively represent the data and labels currently being processed; The adaptive adjustment is expressed as follows: or t+1 =Adjust(the t ,performance t ) Among them, Adjust means based on performance indicators performance t Adjust the learning rate η t function.

8. The network security detection method based on deep learning according to claim 1, characterized in that: The multimodal deep learning model using the online learning mechanism is combined with data analysis and machine learning to monitor the network in real time, including: Collect network traffic data and logs of network devices and security devices in real time, and pre-process them to obtain pre-processed data streams; Extract key features and analyze abnormal behaviors in data streams in real time, use sliding window technology to process data streams, and extract time series features; Use machine learning models to predict whether network behavior is a threat based on time series characteristics; if a threat is present, predefined response measures are automatically executed.

9. The network security detection method based on deep learning according to claim 8, characterized in that: If there is a threat, defense measures are automatically triggered, including: The threat level is assessed based on the prediction results of the machine learning model and metadata, as shown below: L=R(y,m) Among them, L represents the threat level, y represents the predicted threat type, and m represents metadata related to the threat; Configure automated response strategies based on threat levels, automatically execute corresponding defense measures, and dynamically adjust response strategies based on feedback results.

10. A network security detection system based on deep learning, characterized in that: The system comprises: An encrypted communication device is used to deploy a self-evolving neurocryptography module based on an adversarial network to perform adversarial learning to obtain encrypted communication data; wherein the self-evolving neurocryptography module includes an encryption algorithm and a decryption cracking algorithm; at the same time, the encrypted communication data is preprocessed to construct a deep belief model, and the deep belief network is trained using the preprocessed data to analyze and identify abnormal patterns and covert communication behaviors in network traffic; A data integration device, used to integrate multiple data sources and extract multimodal deep features using a deep learning algorithm; wherein the multiple data sources include network traffic data, system logs, and user behavior logs; A safety detection device is used to construct a multimodal deep learning model based on the multimodal deep features to process the multimodal deep features; wherein the loss function L of the multimodal deep learning model is: Among them, L k represents the loss function of the kth task, λ k Represents the corresponding weight, Y k represents the real output, Represents the predicted output; Dynamic update and alarm device, used to introduce online learning mechanism to adaptively adjust the learning rate, so that the multimodal deep learning model can be dynamically updated according to new data; use the multimodal deep learning model introduced with online learning mechanism combined with data analysis and machine learning to monitor the network in real time and identify threats; if there is a threat, implement automated protection strategy and automatically trigger defense measures; Wherein, constructing a deep belief model includes: Construct a multi-layer RBM stack to form a deep belief network, where each layer of RBM is responsible for extracting the features of the previous layer of data; The network weights and biases are initialized using the contrastive divergence algorithm; the update iteration formula is as follows: Δw=∈·(<v0,h0>-<v k ,h k >) Among them, ∈ represents the learning rate, v0 and h0 represent the states of the visible layer and the hidden layer at the beginning of the data, respectively. k and h k They represent the states of the visible layer and the hidden layer after k Gibbs samplings respectively; Δw represents the weight deviation; The supervised learning method is used to train the deep belief model. The top layer of the deep belief model is trained with labeled data to realize the recognition of specific attack patterns. At the same time, a dynamic learning rate adjustment mechanism is introduced to dynamically adjust the learning rate according to the performance of the deep belief model on the validation set to enhance the generalization ability of the model. The formula for the dynamic adjustment is expressed as: Among them, ∈(t+1) represents the updated learning rate, t is the current iteration number, T is the total iteration number, Represents real-time learning rate adjustment weights.

Images