Automatic processing method, system and device for network security attack traffic

Abstract

The present invention belongs to the field of network security, and specifically relates to an automated processing method, system and device for network security attack traffic, aiming to solve the problems of existing network attack detection methods lacking automated processing capabilities, high resource consumption and low efficiency. The present invention includes: matching alarm data in historical network traffic through predefined rules; training a security model based on deep learning through the alarm data, and connecting the trained security model based on deep learning to the application end, and outputting the network traffic prediction result in the application end; the security model based on deep learning outputs the prediction result according to the alarm data, obtains the historical attack text through natural language processing of the prediction result, and adjusts the parameters of the security model based on deep learning according to the preset evaluation index and loss function of the historical attack text; diagnoses the attack traffic type according to the attacker characteristics and attack type, and then initiates the disposal measures corresponding to the attack traffic type.

Description

Background Art

[0002] At present, in the field of network security, in order to cope with increasingly complex network attacks, existing technical solutions mainly rely on the analysis of attack traffic data to extract the characteristics and intentions of attackers. These solutions usually involve collecting and analyzing suspicious network traffic data, and then passing this data to professionals for further manual processing. However, this method has certain limitations:

[0003] Lack of automated processing capabilities: Existing systems often cannot automatically process attack traffic data, but rely on manual intervention to determine how to respond to attacks, which limits the flexibility and response speed of the system.

[0004] High resource consumption: Since human participation is required in the processing of attack traffic data, this not only increases the time cost required for processing, but also increases the consumption of human resources.

[0005] Inefficiency: When all attack traffic data is indiscriminately submitted to staff for processing, important attacks may not be handled in a timely and effective manner, reducing the overall security protection efficiency.

[0006] Therefore, the current technical solutions have obvious shortcomings in processing network attack traffic, and a new technical means is urgently needed to overcome the above problems in order to improve the efficiency and automation level of network security protection. Summary of the invention

[0007] In order to solve the above problems in the prior art, namely, the existing network attack detection methods lack automatic processing capabilities, consume large resources and are inefficient, the present invention provides an automatic processing method for network security attack traffic, comprising:

[0008] Match alarm data in historical network traffic through predefined rules;

[0009] The deep learning-based security model is trained by the alarm data, and the trained deep learning-based security model is connected to the application end to output the network traffic prediction result in the application end; wherein,

[0010] The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text;

[0011] The network traffic prediction results include normal traffic data and attack traffic data;

[0012] The attack traffic data includes attacker characteristics and attack types;

[0013] According to the attacker characteristics and attack type, the attack traffic type is diagnosed, and then the disposal measures corresponding to the attack traffic type are initiated.

[0014] In some preferred implementations, the trained Transformer model is connected to the application end to output the network traffic prediction result in the application end.

[0015] In some preferred embodiments, the deep learning-based security model adopts the TensorFlow deep learning framework.

[0016] In some preferred implementations, the alarm data in historical network traffic is matched by a Snort system.

[0017] In some preferred embodiments, after obtaining the alarm data, the alarm data is also cleaned, denoised, filled, outliers are removed and / or deleted, and data features are extracted for deep learning-based security model training.

[0018] In some preferred implementations, the attack chain is obtained by acquiring the attack traffic data of each CDN node in the application end, and it is determined whether the behavior of each IP on the attack chain is a preset attack behavior to obtain the attacker's characteristics.

[0019] In some preferred implementations, an attack data repository is constructed by collating the alarm data and the real-time recorded attack traffic data;

[0020] Establish an association between each attack traffic type and attack traffic processing measures in the attack data repository, generate an attack traffic processing model, and use the attack traffic processing model to start the disposal measures corresponding to the current attack traffic type.

[0021] Another aspect of the present invention provides an automatic processing system for network security attack traffic, comprising:

[0022] a training data acquisition module configured to match alarm data in historical network traffic using predefined rules;

[0023] The attack identification module is configured to train a deep learning-based security model through the alarm data, connect the trained deep learning-based security model to the application end, and output the network traffic prediction result in the application end; wherein,

[0024] The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text;

[0025] The network traffic prediction results include normal traffic data and attack traffic data;

[0026] The attack traffic data includes attacker characteristics and attack types;

[0027] The automatic handling module is configured to diagnose the attack traffic type according to the attacker characteristics and attack type, and then initiate handling measures corresponding to the attack traffic type.

[0028] According to a third aspect of the present invention, an electronic device is provided, comprising:

[0029] at least one processor; and

[0030] a memory communicatively connected to at least one of the processors; wherein,

[0031] The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned automatic processing method of network security attack traffic.

[0032] In a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned method for automatically processing network security attack traffic.

[0033] Beneficial effects of the present invention:

[0034] (1) The present invention uses Snort to analyze traffic and identifies it through a deep learning-based security model, which can quickly find disposal measures according to different data types, realize automatic processing at all times, and improve real-time performance and effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0036] Figure 1 It is a flow chart of a method for automatically processing network security attack traffic in an embodiment of the present invention;

[0037] Figure 2It is a conceptual diagram of the overall method for automatically processing network security attack traffic in an embodiment of the present invention;

[0038] Figure 3 It is an overall algorithm block diagram of the automatic processing method of network security attack traffic in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0040] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0041] The present invention provides an automated processing method for network security attack traffic. The method analyzes the traffic by using Snort and identifies it through a security model based on deep learning. It can quickly find disposal measures according to different data types, realize automated processing at all times, and improve real-time performance and effectiveness.

[0042] An automatic processing method for network security attack traffic of the present invention comprises:

[0043] Match alarm data in historical network traffic through predefined rules;

[0044] The deep learning-based security model is trained by the alarm data, and the trained deep learning-based security model is connected to the application end to output the network traffic prediction result in the application end; wherein,

[0045] The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text;

[0046] The network traffic prediction results include normal traffic data and attack traffic data;

[0047] The attack traffic data includes attacker characteristics and attack types;

[0048] According to the attacker characteristics and attack type, the attack traffic type is diagnosed, and then the disposal measures corresponding to the attack traffic type are initiated.

[0049] In order to more clearly illustrate the automatic processing method of network security attack traffic of the present invention, the following is combined with Figure 1 and Figure 2 Each step in the embodiment of the present invention is described in detail.

[0050] A method for automatically processing network security attack traffic according to a first embodiment of the present invention includes steps S1 to S3, each of which is described in detail as follows:

[0051] Step S1, matching alarm data in historical network traffic by predefined rules;

[0052] The Snort system is used to match alarm data in historical network traffic.

[0053] The Snort system is an open source network intrusion detection system (IDS) and intrusion prevention system (IPS). Snort can analyze network traffic and detect potential malicious activities or security threats. It matches network packets using predefined rules to identify possible attack behaviors. It supports multiple detection methods, including signature matching: matching specific sequences in data packets based on predefined patterns. State detection: tracking session status to ensure that data packets comply with established connection specifications. Anomaly detection: identifying activities that are different from normal behavior based on statistical models.

[0054] Snort is widely used in the field of network security and can run on a variety of operating systems, such as Linux, FreeBSD, etc. It can also be expanded through plug-ins to provide more powerful functions.

[0055] This embodiment monitors network traffic in real time by deploying Snort to check data packets in network traffic, and identifies possible intrusion behaviors or security events according to predefined and customized rules. Snort matches the captured data with rules, and then stores the matched alarm data on disk and preprocesses it, including data cleaning and feature extraction; data cleaning requires removing noise data, identifying and removing unnecessary or invalid information in the data, such as blank records, duplicate data, etc., and also requires processing missing values, filling or deleting missing data, and then solving outliers, detecting and processing outliers to avoid affecting model training and prediction. The acquired data also requires data format conversion, such as converting text data into numerical data. Finally, basic feature extraction is performed, including source IP address, target IP address, protocol type, port number, etc., as input to the model.

[0056] Common Snort rules include detecting port behavior within a specific IP geological range, detecting malware download behavior, and detecting malicious worm propagation behavior; custom rules include: discovering unusual, concealed, and multi-feature attack methods through analysis of attack traffic; and custom special traffic detection: different rules need to be defined for specific methods of special attacks.

[0057] Take the detection of malware download behavior as an example:

[0058] Record the number of malicious downloads of the current software t=0, and extract the behavioral characteristics of the current software;

[0059] Match with the public behavior features. If the matching result is that the software is maliciously downloaded, set t=t+1 and repeat the behavior feature extraction of the current software;

[0060] If the current t value is greater than or equal to the set threshold, it is determined to be a malicious software download and an alarm is issued.

[0061] Behavioral feature extraction method:

[0062] Reproduce attack traffic and extract malicious behavior factors. For an attack, if multiple malicious behavior factors with a set proportion appear, it is determined to be a special attack and the special attack behavior characteristics are returned.

[0063] Otherwise, check the returned results after re-occurrence. The returned results will have different return behavior characteristics according to different attack types.

[0064] Network traffic analysis: By using Snort to analyze traffic, Snort stores the captured data packets to disk. The intrusion detection mode is the most complex and can analyze data packets, detect according to rules, and respond.

[0065] After obtaining the alarm data, it also includes data cleaning, denoising, padding, removing outliers and / or deleting the alarm data, and extracting data features for deep learning-based security model training. Step S2, training the deep learning-based security model through the alarm data, connecting the trained deep learning-based security model to the application end, and outputting the network traffic prediction result in the application end;

[0066] The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text. In this embodiment, the selected deep learning-based security model is the Transformer model, which is combined with the TensorFlow deep learning framework.

[0067] Transformer is a security model based on deep learning, which was originally designed for natural language processing tasks. It usually includes encoders, decoders and residual connections. When working, each word in the input sequence will be converted into a vector representation, and position encoding will be added to each position in the input sequence so that the model can understand the word order information, and the dependencies in the sequence will be captured through multi-head attention calculation. The output of each position is nonlinearly transformed through the feedforward network, and finally a probability distribution is generated through linear transformation and softmax function as the probability of predicting the next word, which is the characteristic of network security attack. TensorFlow deep learning framework, which provides a flexible architecture suitable for machine learning projects of all sizes to achieve efficient numerical calculations, is particularly suitable for building and training security models based on deep learning; the basis of TensorFlow deep learning framework is a data flow graph, in which nodes represent mathematical operations and edges represent data flows between multidimensional arrays; in TensorFlow, all operations are performed in a session. Sessions manage the execution of computational graphs and control the allocation of resources. Variables are data structures used to store model parameters. During training, these parameters are updated to optimize model performance. This embodiment combines the Transformer model with the TensorFlow deep learning framework and applies it to this scenario, achieving real-time network traffic monitoring and rapid identification of potential attack behaviors. Through unsupervised or semi-supervised methods, the Transformer model can identify new types of attacks that have not been seen before and trigger automated defense measures, reducing the need for manual intervention.

[0068] In this embodiment, a Transformer model that relies solely on a TensorFlow deep learning framework, any deep learning-based security model that relies solely on a TensorFlow deep learning framework, or a Transformer model that is equipped with a TensorFlow deep learning framework can be selected for prediction. Among them, the Transformer model that is not equipped with the TensorFlow deep learning framework is more flexible in the deployment environment, and can achieve the prediction and evaluation of network attack traffic without relying on a specific framework. However, in combination with TensorFlow, various components and modules in the framework can be used, including pre-trained models, tools, and optimization algorithms, which can accelerate the development process. At the same time, TensorFlow provides a variety of performance optimization tools, such as automatic differentiation, graph optimization, distributed computing, etc., which may need to be manually implemented when using Transformer alone. In addition, TensorFlow can make good use of hardware acceleration such as GPU and TPU, while using Transformer alone may require additional work to achieve the same acceleration effect.

[0069] Compared with traditional convolutional neural networks (CNNs) and recurrent neural networks (RNNs), Transformer does not require fixed-size inputs and can process variable-length sequence data more efficiently. Compared with sequence models such as RNNs and long short-term memory networks (LSTMs), Transformer's parallelization capabilities significantly improve training efficiency, especially when processing long sequences. Compared with other frameworks, TensorFlow provides community support and documentation resources. The TensorFlow ecosystem includes many high-level APIs and pre-trained models that are compatible with Transformer models.

[0070] The training process of the transformer model in this embodiment includes:

[0071] Step A1, obtain the alarm data as a training set and attach the attack feature label;

[0072] Step A2: input the training set into the deep learning-based security model and output the prediction result;

[0073] Step A3, continuously adjusting the parameters of the deep learning-based security model through the back propagation algorithm to minimize the loss function;

[0074] In the back propagation algorithm, the output layer error is:

[0075] ;

[0076] in, represents the error vector of the output layer, Represents the loss function for the output value The gradient of , y represents the target output, represents the derivative of the activation function of the output layer, represents the weighted input of the output layer, It means element-wise multiplication. Represents the index of the output layer;

[0077] The hidden layer error is:

[0078] ;

[0079] represents the error vector of the hidden layer, represents the index of the hidden layer, Indicates that from Layer to The weight matrix of the layer, represents the weighted input of the hidden layer, represents the derivative of the activation function of the hidden layer.

[0080] Step A4, generating historical attack texts based on the prediction results through a natural language processing model; the generation of historical attack texts enables the security model based on deep learning to have the ability to understand and generate security event descriptions;

[0081] The prediction results include the probability that the corresponding network traffic belongs to a certain attack type and the implicit attack behavior information, namely the attack characteristics and attack type; the historical attack text describing the attack behavior information is generated through natural language processing methods; the historical attack text includes preset evaluation dimensions, and each evaluation dimension has a corresponding evaluation indicator.

[0082] Subsequent disposal measures may also be generated based on the attack text in the actual testing phase.

[0083] Step A5, calculating the accuracy, recall, and F1 score indicators of the historical attack texts through the validation set and the test set;

[0084] The recall rate: The recall rate measures the ability of the model to correctly predict all positive examples;

[0085] Recall = True positives / (True positives + False negatives). Recall ranges from 0 to 1. The closer the value is to 1, the better the model performs in correctly predicting positive examples.

[0086] Among them, the F1 score is an indicator that comprehensively considers the precision and recall of the model. It is the harmonic mean of the precision and recall.

[0087] F1 score = 2 (Accuracy Recall) / (Precision + Recall)

[0088] To sum up, the automated processing method for network security attack traffic, when used, uses Snort to capture and store the traffic, uses the captured traffic to train a large model, and then connects to the application to automatically identify the attacker's characteristics and attack type, and processes the attack traffic data in an autonomous and automated manner to reduce manual intervention and time costs, and directly make decisions and participate in security incidents to complete automated processing.

[0089] Step A6, further adjust the parameters of the deep learning-based security model according to the accuracy, recall, and F1 score indicators of the historical attack text, until the input layer error, hidden layer error, and accuracy, recall, and F1 score indicators all reach the set thresholds, thereby obtaining a trained deep learning-based security model.

[0090] The natural language processing model is implemented using ChatGLM-6B, which is an open source conversational language model that supports both Chinese and English. It is based on the General Language Model (GLM) architecture and has 6.2 billion parameters. The ChatGLM natural language processing model is used to process the prediction results of the security model and generate historical attack texts. The parameters of the security model based on deep learning are adjusted according to the preset evaluation indicators of the historical attack texts until the loss function is lower than the set threshold and meets the preset evaluation indicators of the historical attack texts. For each identified prediction result, especially the attack traffic data, the natural language processing model will generate a description and judgment of the corresponding attack traffic data, namely the historical attack text;

[0091] Take the trained deep learning-based security model outputting two prediction results as an example:

[0092] Prediction result 1: Attacker characteristics: IP frequency is γ2 times within γ1 minute, requesting URL with parameters is γ3 times, sensitive functions Float(), Left(), EXP() are γ4 times, the prediction result (attack type) is SQL injection attack, the result probability is γ5%, and the attack type is data theft or privilege escalation.

[0093] Prediction result 2: Attacker characteristics: IP frequency is γ7 times within γ6 minutes, requesting URL with parameters is γ8 times, sensitive function is 0 times, the prediction result (attack type) is HTTP-CC attack, the result probability is γ9%, and the attack type is consuming system traffic resources.

[0094] The natural language model interprets the security model to generate historical attack text descriptions as follows:

[0095] In the γ10 time, the comprehensive probability of SQL injection is less than the preset value of 50%, and the comprehensive probability of HTTP-CC attack is greater than the preset value of 50%. It is judged that the xx system is being maliciously consumed by system bandwidth and resources, and the cc-defense-automation() function is automatically handled. Among them, γ1, γ2...γ10 are all constants.

[0096] In this embodiment, the attack chain is obtained by acquiring the attack traffic data of each CDN node in the application end, and it is determined whether the behavior of each IP on the attack chain is a preset attack behavior to obtain the attacker's characteristics.

[0097] Specifically, the trained deep learning-based security model is connected to the Internet application through the API, such as using Nginx to forward the application traffic of a certain period of time, forwarding the traffic data into the deep learning network, and automatically identifying the characteristics and attack types of attackers through the deep learning-based security model, and outputting the predicted results of the event. Attack feature acquisition: By obtaining the attack data of each CDN node, the attack traffic is aggregated and processed to obtain the attack chain in units of IP. For each IP, the attack chain based on the IP determines whether the IP meets the preset attack behavior. If it meets the attack behavior, the IP is determined as the target IP.

[0098] Attack data repository: By storing all existing traffic attack data to form a database, the database can be searched when attacked to confirm the type of data attack more quickly.

[0099] Among them, the data is summarized and recorded: the data control center establishes a long connection with the remote cloud server through the TCP / IP protocol, and then quickly uploads the operating parameters to the cloud server. The cloud server then starts the big data analysis function, summarizes and records, and completes the data collection.

[0100] An attack data repository is built by collating alarm data and real-time recorded attack traffic data;

[0101] Establish an association between each attack traffic type and attack traffic processing measures in the attack data repository, generate an attack traffic processing model, and use the attack traffic processing model to start the disposal measures corresponding to the current attack traffic type.

[0102] Step S3, diagnose the attack traffic type according to the attacker characteristics and attack type, and then initiate treatment measures corresponding to the attack traffic type.

[0103] Based on the output results of the model, the system can link with the firewall to automatically take measures, such as blocking the attacker's IP address, restricting their access rights, and accurately issuing event alerts.

[0104] Problem diagnosis: Obtain the types of all attack traffic, define corresponding attack traffic data for each type of attack traffic, and assign corresponding attack traffic processing processes to each type of attack traffic, associate the attack traffic type and the attack traffic data corresponding to the attack traffic type with the attack traffic processing process, and generate an attack traffic processing model;

[0105] By obtaining the current attack traffic data, the acquired current attack traffic data is matched with the attack traffic data in the attack traffic processing model. If the match is successful, the attack traffic type corresponding to the current attack traffic data is found through the mapping relationship, thereby completing the diagnosis of the problem.

[0106] The automatic processing method of network security attack traffic of the present invention is as follows: Figure 3 As shown, by using Snort to analyze the traffic, including traffic capture, protocol analysis, file extraction, security event management and data visualization, Snort stores the captured data packets to disk, and the intrusion detection mode can analyze the data packets, detect according to the rules, respond and obtain attack characteristics, and then obtain the attack data of each CDN node, summarize the attack traffic, process the attack traffic, and obtain the attack chain in units of IP. For each IP, determine whether the IP meets the preset attack behavior based on the IP attack chain. If it meets the attack behavior, the IP is determined as the target IP. By storing all the existing traffic attack data, an attack data storage database is formed. When attacked, the database is searched to confirm the data attack type more quickly. The problem diagnosis: obtain the type of all attack traffic, and Each type of attack traffic defines corresponding attack traffic data, and a corresponding attack traffic processing process is assigned to each type of attack traffic. The attack traffic type and the attack traffic data corresponding to the attack traffic type are associated with the attack traffic processing process to generate an attack traffic processing model. By obtaining the current attack traffic data, the acquired current attack traffic data is matched with the attack traffic data in the attack traffic processing model. If the match is successful, the attack traffic type corresponding to the current attack traffic data is found through a mapping relationship, thereby completing the diagnosis of the problem and issuing a system alarm. The anti-virus software processing: by transmitting the diagnosed attack traffic data to the anti-virus software, the corresponding response method is found out very quickly according to different data types for processing and anti-virus, thereby completing automatic data processing and improving practicality.

[0107] Although the various steps in the above embodiment are described in the above-mentioned order, those skilled in the art can understand that in order to achieve the effect of this embodiment, different steps do not have to be executed in such an order. They can be executed simultaneously (in parallel) or in a reverse order. These simple changes are within the scope of protection of the present invention.

[0108] The second embodiment of the present invention discloses a specific implementation method; pre-customize Snort alarm rules, store logs in local disk, and output logs; after the logs are stored, establish a data format processor for cleaning data, and use python+numpy+pandasa to organize the data format to meet the data format requirements required for pre-processing, which is used to meet the model training, for example,

[0109] By using the relevant modules of the pandas and numpy libraries, the open function is used to read the log file named network_logs.log and store it in a DataFrame by line. Then, the data is cleaned and null values ​​are removed. In the feature extraction stage, regular expressions are used to extract features such as source IP, target IP, protocol type, and attack method (such as SQL injection, CSRF, etc.) from the log line, and then stored in a new column. Entering the feature engineering stage, feature engineering is performed on the data, such as one-hot encoding of the protocol type. Finally, the processed data is written to a file named processed_data.log, and confirmation information is output. ,

[0110] Use TensorFlow+Transform to train the cleaned dataset by the data format handler. Before training, the data needs to be divided, the feature selector is further constructed, and the TensorFlow data input pipeline is created. The tf.data API is used to build the data input pipeline to operate the data. The model.compile method is used to configure the training parameters of the model, and then the model.fit method is used to train the model. The cleaned data is used to evaluate the performance of the model on the evaluation set using the model.evaluate method, such as the process of using TensorFlow and Transform for data preprocessing, model training, and evaluation. First, the input_fn function is defined to load and return the dataset, and a Schema is created based on the characteristics of the dataset. Next, TensorFlow-Transform is used to analyze and preprocess the raw data, including dataset analysis and transformation. Then, the dataset is divided into training data and evaluation data as needed. Next, a Sequential model is defined, including a hidden layer of 64 neurons with a ReLU activation function and an output layer with a Sigmoid activation function. Subsequently, the model is compiled, the loss function is specified as binary cross entropy, the optimizer is Adam, and the evaluation indicator is specified as accuracy. Then, the model is trained using the training data. Finally, the model is evaluated on the evaluation data set, and the accuracy evaluation results of the model are calculated and printed out.

[0111] Then you need to call the trained TensorFlow model through the API and use it to automatically handle network security attacks. You can use the tf.keras.models.load_model method to directly call the saved model, and then create a prediction function that accepts network security traffic data as input, uses the loaded model for prediction, and returns the prediction result. Then, use the python-Flask framework to create a webhook to receive global attack traffic, call the prediction function, and return the prediction result. At the same time, use the API to interact with existing security devices, set up automated scripts and logic to handle alarms, and block suspicious traffic and IPs.

[0112] Linkage automatic disposal implementation logic: Use Flask to build a simple API service to load the trained neural network model and predict the incoming data. First, import the Flask, request, and jsonify modules, as well as the numpy library from the Flask library. Then, use the load_model function to load the pre-trained model, and the model file path is 'path_to_my_model'. Next, define a preprocess_data function to preprocess the incoming data and return a processed NumPy array. In the predict_traffic_alert_api function, set a route ' / predict' and specify the request method as POST. When a POST request is received, get the JSON data in the request, preprocess the data, predict it through the loaded model, and return the prediction result in JSON format. Finally, in the __main__ block, run the Flask application, listen for requests from any host, and then use the Bash script to combine the API service and the machine learning model to perform network traffic detection, attack prediction, and firewall blocking processes. First, define the URL of the model API, the URL of the firewall API, and the necessary information such as the firewall API key. Then, define the detect_traffic() function to simulate the detection of network traffic and obtain data, and store the obtained traffic data in the traffic_data variable. Next, call the model API through the call_model_api() function, pass the network traffic data for prediction, and return the prediction result. Subsequently, call the custom function analyze_prediction() to analyze the prediction result. If the model predicts "attack", the operation of blocking the IP is executed, and the firewall API is called to perform the blocking operation. Finally, the above functions are called through the main logic part to realize the complete process of network traffic detection, model prediction, attack analysis and firewall blocking. The overall script combines machine learning models and network security technologies to realize an automated network security defense mechanism.

[0113] The automatic processing system for network security attack traffic according to the third embodiment of the present invention includes:

[0114] a training data acquisition module configured to match alarm data in historical network traffic using predefined rules;

[0115] The attack identification module is configured to train a deep learning-based security model through the alarm data, connect the trained deep learning-based security model to the application end, and output the network traffic prediction result in the application end; wherein,

[0116] The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text;

[0117] The network traffic prediction results include normal traffic data and attack traffic data;

[0118] The attack traffic data includes attacker characteristics and attack types;

[0119] The automatic handling module is configured to diagnose the attack traffic type according to the attacker characteristics and attack type, and then initiate handling measures corresponding to the attack traffic type.

[0120] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0121] It should be noted that the above embodiment provides an automated processing system for network security attack traffic, and only uses the division of the above functional modules as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the modules or steps in the embodiments of the present invention can be decomposed or combined. For example, the modules in the above embodiments can be combined into one module, or further divided into multiple sub-modules to complete all or part of the functions described above. The names of the modules and steps involved in the embodiments of the present invention are only for distinguishing the modules or steps, and are not regarded as improper limitations of the present invention.

[0122] An electronic device according to a fourth embodiment of the present invention includes:

[0123] at least one processor; and

[0124] a memory communicatively connected to at least one of the processors; wherein,

[0125] The memory stores instructions that can be executed by the processor, and the instructions are used to be executed by the processor to implement the above-mentioned automatic processing method of network security attack traffic.

[0126] A fifth embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the above-mentioned method for automatically processing network security attack traffic.

[0127] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process and related instructions of the storage device and processing device described above can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0128] Those skilled in the art should be able to appreciate that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two, and the programs corresponding to the software modules and method steps can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field. In order to clearly illustrate the interchangeability of electronic hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in electronic hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0129] The terms "first", "second", etc. are used to distinguish similar objects rather than to describe or indicate a particular order or sequence.

[0130] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus / device.

[0131] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for automatically processing network security attack traffic, characterized in that: include: Matching alarm data in historical network traffic through predefined rules; the predefined rules include the Snort system; The deep learning-based security model is trained by using the alarm data, and the trained deep learning-based security model is connected to the application end to output the network traffic prediction result in the application end; The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text; The network traffic prediction results include normal traffic data and attack traffic data; The attack traffic data includes attacker characteristics and attack types; wherein the method for obtaining the attacker characteristics is: obtaining the attack chain by obtaining the attack traffic data of each CDN node in the application end, determining whether the behavior of each IP on the attack chain is a preset attack behavior, and obtaining the attacker characteristics; When the deep learning-based security model is a Transformer model, the calculation method of the output layer error of the Transformer model during the training process is: ； in, represents the error vector of the output layer, Represents the loss function for the output value The gradient of , y represents the target output, represents the derivative of the activation function of the output layer, represents the weighted input of the output layer, It means element-wise multiplication. Represents the index of the output layer; The hidden layer error is calculated as: ； in, represents the error vector of the hidden layer, represents the index of the hidden layer, Indicates that from Layer to The weight matrix of the layer, represents the weighted input of the hidden layer, represents the derivative of the activation function of the hidden layer; According to the attacker characteristics and attack type, the attack traffic type is diagnosed, and then the disposal measures corresponding to the attack traffic type are initiated.

2. The method for automatically processing network security attack traffic according to claim 1, characterized in that: The deep learning-based security model adopts the TensorFlow deep learning framework.

3. The method for automatically processing network security attack traffic according to claim 1, characterized in that: After obtaining the alarm data, it also includes data cleaning, denoising, padding, removal of outliers and / or deletion, and data feature extraction for deep learning-based security model training.

4. The method for automatically processing network security attack traffic according to claim 1, characterized in that: An attack data repository is built by collating alarm data and real-time recorded attack traffic data; Establish an association between each attack traffic type and attack traffic processing measures in the attack data repository, generate an attack traffic processing model, and use the attack traffic processing model to start the disposal measures corresponding to the current attack traffic type.

5. An automated processing system for network security attack traffic, characterized in that: include: A training data acquisition module configured to match alarm data in historical network traffic using predefined rules; the predefined rules include a Snort system; The attack identification module is configured to train a deep learning-based security model through the alarm data, connect the trained deep learning-based security model to the application end, and output the network traffic prediction result in the application end; wherein, The deep learning-based security model outputs a prediction result according to the alarm data, obtains a historical attack text by natural language processing the prediction result, and adjusts the deep learning-based security model parameters according to the preset evaluation index and loss function of the historical attack text until the loss function is lower than the set threshold and meets the preset evaluation index of the historical attack text; The network traffic prediction results include normal traffic data and attack traffic data; The attack traffic data includes attacker characteristics and attack types; wherein the method for obtaining the attacker characteristics is: obtaining the attack chain by obtaining the attack traffic data of each CDN node in the application end, determining whether the behavior of each IP on the attack chain is a preset attack behavior, and obtaining the attacker characteristics; When the deep learning-based security model is a Transformer model, the calculation method of the output layer error of the Transformer model during the training process is: ； in, represents the error vector of the output layer, Represents the loss function for the output value The gradient of , y represents the target output, represents the derivative of the activation function of the output layer, represents the weighted input of the output layer, It means element-wise multiplication. Represents the index of the output layer; The hidden layer error is calculated as: ； in, represents the error vector of the hidden layer, represents the index of the hidden layer, Indicates that from Layer to The weight matrix of the layer, represents the weighted input of the hidden layer, represents the derivative of the activation function of the hidden layer; The automatic handling module is configured to diagnose the attack traffic type according to the attacker characteristics and attack type, and then initiate handling measures corresponding to the attack traffic type.

6. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to at least one of the processors; wherein, The memory stores instructions executable by the processor, and the instructions are used to be executed by the processor to implement an automated processing method for network security attack traffic as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to be executed by the computer to implement the automatic processing method for network security attack traffic according to any one of claims 1 to 4.

Images