Network traffic threat detection method based on artificial intelligence model

Abstract

The invention discloses a network flow threat detection method based on an artificial intelligence model, and belongs to the technical field of network security, and the method comprises the following steps: data collection and preprocessing: collecting network flow data, and preprocessing the collected data; feature extraction: extracting features beneficial to threat detection from the preprocessed data; and analyzing and simulating an attack process, constructing a series of attack scenes, and carrying out targeted testing on network traffic. According to the network flow threat detection method, the network flow is detected in real time through the software model or the software system created by the invention, early warning is triggered in time when abnormal flow is detected, network attacks can be effectively prevented, network safety is guaranteed, a large amount of data can be automatically processed through the network flow threat detection method based on the artificial intelligence model, the detection efficiency is greatly improved, and the detection cost is reduced. According to the invention, the workload of safety personnel is reduced, and tiny difference between normal traffic and abnormal traffic can be learned, so that the detection accuracy is improved, and false alarm and missing alarm are reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network traffic threat detection method based on an artificial intelligence model. Background Art

[0002] In recent years, many leading network security companies have been researching automatic threat traffic countermeasure models based on the artificial intelligence LLM large model, so that the model has the ability to evolve autonomously in the long term for network security attack and defense. This ability stems from the model's training and learning of network traffic in a complex attack and defense environment. It can identify and adapt to new threats, continuously train and fine-tune strategies to effectively respond to changing attack techniques, and conduct deep and complex logical reasoning based on the content of the accessed network traffic by establishing intelligent threat analysis rules and baseline deviation analysis. It not only continuously learns various attack methods, but also autonomously iterates and evolves a variety of defense strategies, thereby gradually forming diversified network traffic threat detection and response capabilities.

[0003] Some invention patents in the field of network security technology are disclosed in the prior art, among which the invention patent with application number CN114915575A discloses a network traffic detection device based on artificial intelligence, which belongs to the field of cyberspace security and computer deep learning. The invention device first extracts spatial features through the convolutional neural network in the feature extraction module and extracts sequence features through the recurrent neural network, and then fuses the extracted spatial features and sequence features through the feature fusion module to obtain a new feature set output to the classifier module to complete the network traffic classification. Compared with the traditional network traffic classification based on machine learning, the new feature set of the invention contains more network traffic features, and in the process of fusing the new feature set, the attention mechanism is used to reasonably allocate various features, which effectively improves the classification accuracy.

[0004] Currently in the network security industry, the existing traffic detection and protection products of various companies all use methods such as R&D teams setting clear protection rules (SQL injection, XSS detection table import, etc.) and Payload matching to match the incoming network traffic to generate alarms and provide response blocking actions. This method has obvious disadvantages. When the attack process is not initiated by automated scanning and penetration tools, but by attack and defense experts using advanced ideas to manually test, or based on 0Day attacks, there will be no matching and missed reports, resulting in immeasurable losses to the information assets in the enterprise's internal network.

[0005] Based on this, the present invention designs a network traffic threat detection method based on an artificial intelligence model to solve the above problems. Summary of the invention

[0006] The purpose of the present invention is to propose a network traffic threat detection method based on an artificial intelligence model to solve the problem that when the attack process is not initiated by an automated scanning and penetration tool, but by an attack and defense expert through manual testing with advanced ideas, or based on a 0Day attack, there will be no match and missed reports, resulting in immeasurable losses to the information assets in the enterprise's internal network.

[0007] In order to achieve the above object, the present invention adopts the following technical solution: a network traffic threat detection method based on an artificial intelligence model, comprising the following steps:

[0008] Data collection and preprocessing: collecting network traffic data and preprocessing the collected data;

[0009] Feature extraction, extracting features from preprocessed data that are helpful for threat detection;

[0010] Analyze and simulate the attack process, build a series of attack scenarios, and conduct targeted tests on network traffic;

[0011] Model training: Use the constructed attack scenarios to train the neural network model used to identify traffic threats, and adjust the model parameters during the training process;

[0012] Manual testing and evaluation: After the neural network model is trained, the neural network model is used to test the obtained training set data and evaluate the performance of the neural network model;

[0013] Model iteration and optimization: Based on the evaluation results of the neural network model performance, the neural network model is iteratively optimized.

[0014] As a further description of the above technical solution: the steps of iterative optimization of the model include:

[0015] a. Collect new network traffic data and expand the data set;

[0016] b. Retrain the model using new data to update the model’s parameters and weights;

[0017] c. Evaluate the performance of the model and compare it with other advanced models to determine whether the model needs to be replaced;

[0018] d. Adjust model parameters or use other techniques for optimization based on the evaluation results;

[0019] e. Repeat the above steps to achieve continuous iteration and optimization of the model.

[0020] As a further description of the above technical solution: the network traffic data includes normal and abnormal traffic, and the data covers various network protocols, ports, IP addresses and other information. The data comes from intrusion detection systems, security detection systems and log files.

[0021] As a further description of the above technical solution: the data preprocessing includes data cleaning and data conversion;

[0022] Data cleaning includes removing duplicate data, missing value processing and outlier processing in network traffic data;

[0023] Data conversion is used to convert data into a format suitable for model processing, including converting classified data into numerical data and normalization.

[0024] As a further description of the above technical solution: the attack scenarios include common attack types and attacks against specific systems and applications. Common attack types include DDOS attacks and SQL injections.

[0025] As a further description of the above technical solution: the attack process analysis simulation specifically includes the following steps:

[0026] Determine the target of the attack: First, clarify the target of the attack. The target of the attack is a specific system, network service or network device;

[0027] Select attack means: Select appropriate attack means according to the attack target;

[0028] Generate attack traffic: Generate corresponding attack traffic according to the selected attack method;

[0029] Simulate the attack process: In a safe environment, simulate the attack process and record the detailed information of the attack;

[0030] Analyze the attack effect: evaluate the impact of the attack on the target system or network;

[0031] Adjust the attack scenario: adjust the parameters of the attack scenario based on the test results;

[0032] Repeat the test: Repeat the above steps multiple times to ensure the reliability and stability of the attack scenario.

[0033] As a further description of the above technical solution: the detailed information of the simulated attack process includes attack traffic, attack path, and attack time.

[0034] As a further description of the above technical solution: the feature extraction uses a principal component analysis method to perform feature extraction operations on network traffic data, and the dimension of the data can be reduced after feature extraction.

[0035] As a further description of the above technical solution: the data preprocessing also includes noise reduction processing, using a cluster analysis method to process the traffic data and remove outliers outside the cluster.

[0036] As a further description of the above technical solution: the neural network model establishment training steps are specifically as follows:

[0037] First, according to the dimension of the image feature vector, the input layer node n, hidden layer node m, and output layer node 1 of the neural network are initialized. The number of hidden layer nodes is selected according to the number of input and output nodes, and then the network weight p is initialized. ij and p jk , and initialize the hidden layer threshold c and the output layer threshold d at the same time, giving the relevant parameters and functions in network training;

[0038] According to the input feature vector, network weight p ij And the hidden layer threshold c, calculate the output q of the hidden layer;

[0039]

[0040] In the above formula, f is the hidden layer activation function, specifically:

[0041]

[0042] According to the output q of the hidden layer j , network weight p jk and the output layer threshold d, to calculate the predicted output O of the network;

[0043]

[0044] Estimate the network's prediction error e based on the predicted output O and expected output Y calculated above;

[0045] e k =Y k -O k ;

[0046] According to the network prediction error e, the network weight p ij and p jk Update them separately;

[0047]

[0048] p jk =p jk +ηq j e k j=1,2,…,m

[0049] η is the learning rate parameter in the network;

[0050] Update the thresholds c and d of the network nodes according to the prediction error e of the network;

[0051]

[0052] d k =d k +e k

[0053] The number of output layer nodes k is specifically 1.

[0054] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0055] In the present invention, by integrating the software model or software system created by the present invention, it is mounted on the hardware server, deployed in series or in bypass in the enterprise's network link, and after accessing the traffic of the upstream device, the traffic data is processed in real time, and the detailed content of the data packet is disassembled and correlated to check whether there are attack payloads and other potential threats based on known CVE vulnerabilities, and the network traffic is detected in real time. When abnormal traffic is detected, an early warning is triggered in time, which can effectively prevent network attacks and ensure network security. The network traffic threat detection method of the artificial intelligence model can automatically process a large amount of data, greatly improve the detection efficiency, reduce the workload of security personnel, and can learn the slight differences between normal traffic and abnormal traffic, thereby improving detection accuracy and reducing false positives and missed reports;

[0056] By building an artificial intelligence model, the deep learning method adopted is a neural network model. The neural network simulates the way the human brain processes information, and the model is deeply trained with data from multiple scenarios, ultimately achieving results that exceed the traditional policy-matching detection method, integrating network traffic threat detection and artificial intelligence models for intelligent identification; using artificial intelligence to improve recognition efficiency and accuracy; the network security traffic threat detection model trained by the artificial intelligence model can significantly and effectively improve the recognition rate of various commercial hardware products for non-standardized traffic attacks in the domestic network security industry, so as to improve the protection level of various industries such as government, finance, energy, and operators, and ensure the protection effect of enterprises against Internet attacks during daily security operations, and meet the high-standard protection requirements under the severe situation of international network security today. With the continuous updating of network attack methods, the detection method based on the artificial intelligence model can continuously learn and optimize to adapt to new attack methods and improve detection capabilities;

[0057] By simulating the thinking of attack and defense experts, we can conduct intelligent analysis on traffic that seems normal but actually generates attack behaviors, thereby generating alarms and blocking threats. Using artificial intelligence models for network traffic threat detection can reduce dependence on security experts and reduce labor costs. Artificial intelligence models can quickly process large amounts of data and quickly trigger warnings when abnormal traffic is detected, which can improve security response speed and reduce potential losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of a network traffic threat detection method based on an artificial intelligence model proposed by the present invention;

[0059] Figure 2 A schematic diagram of an attack process analysis simulation process of a network traffic threat detection method based on an artificial intelligence model proposed by the present invention;

[0060] Figure 3 A neural network flow diagram of a network traffic threat detection method based on an artificial intelligence model proposed in the present invention. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Please see attached Figure 1 -Attached Figure 3 The present invention provides a technical solution: a network traffic threat detection method based on an artificial intelligence model, comprising the following steps:

[0063] Data collection and preprocessing: collecting network traffic data and preprocessing the collected data;

[0064] Feature extraction, extracting features from preprocessed data that are helpful for threat detection;

[0065] Analyze and simulate the attack process, build a series of attack scenarios, and conduct targeted tests on network traffic;

[0066] Model training: Use the constructed attack scenarios to train the neural network model used to identify traffic threats, and adjust the model parameters during the training process;

[0067] Manual testing and evaluation: After the neural network model is trained, the neural network model is used to test the obtained training set data and evaluate the performance of the neural network model;

[0068] Model iteration and optimization: Based on the evaluation results of the neural network model performance, the neural network model is iteratively optimized.

[0069] The steps of iterative model optimization include:

[0070] a. Collect new network traffic data and expand the data set;

[0071] b. Retrain the model using new data to update the model’s parameters and weights;

[0072] c. Evaluate the performance of the model and compare it with other advanced models to determine whether the model needs to be replaced;

[0073] d. Adjust model parameters or use other techniques for optimization based on the evaluation results;

[0074] e. Repeat the above steps to achieve continuous iteration and optimization of the model.

[0075] Network traffic data, including normal and abnormal traffic, covers various network protocols, ports, IP addresses and other information. The data comes from intrusion detection systems, security detection systems and log files.

[0076] Data preprocessing includes data cleaning and data conversion;

[0077] Data cleaning includes removing duplicate data, missing value processing and outlier processing in network traffic data;

[0078] Data conversion is used to convert data into a format suitable for model processing, including converting classified data into numerical data and normalization.

[0079] Attack scenarios include common attack types and attacks against specific systems and applications. Common attack types include DDOS attacks and SQL injections.

[0080] The attack process analysis simulation specifically includes the following steps:

[0081] Determine the target of the attack: First, clarify the target of the attack. The target of the attack is a specific system, network service or network device;

[0082] Select attack means: Select appropriate attack means according to the attack target;

[0083] Generate attack traffic: Generate corresponding attack traffic according to the selected attack method;

[0084] Simulate the attack process: In a safe environment, simulate the attack process and record the detailed information of the attack;

[0085] Analyze the attack effect: evaluate the impact of the attack on the target system or network;

[0086] Adjust the attack scenario: adjust the parameters of the attack scenario based on the test results;

[0087] Repeat the test: Repeat the above steps multiple times to ensure the reliability and stability of the attack scenario.

[0088] The detailed information of the simulated attack process includes attack traffic, attack path, and attack time.

[0089] Feature extraction uses principal component analysis to extract features from network traffic data, which can reduce the dimension of the data.

[0090] Data preprocessing also includes noise reduction, which uses cluster analysis methods to process traffic data and remove outliers outside the cluster.

[0091] The specific steps for establishing and training the neural network model are as follows:

[0092] First, according to the dimension of the image feature vector, the input layer node n, hidden layer node m, and output layer node 1 of the neural network are initialized. The number of hidden layer nodes is selected according to the number of input and output nodes, and then the network weight p is initialized. ij and p jk , and initialize the hidden layer threshold c and the output layer threshold d at the same time, giving the relevant parameters and functions in network training;

[0093] According to the input feature vector, network weight p ij And the hidden layer threshold c, calculate the output q of the hidden layer;

[0094]

[0095] In the above formula, f is the hidden layer activation function, specifically:

[0096]

[0097] According to the output q of the hidden layer j , network weight p jk and the output layer threshold d, to calculate the predicted output O of the network;

[0098]

[0099] Estimate the network's prediction error e based on the predicted output O and expected output Y calculated above;

[0100] e k =Y k -O k ;

[0101] According to the network prediction error e, the network weight p ij and p jk Update them separately;

[0102]

[0103] p jk =p jk +ηq j e k j=1,2,…,m

[0104] η is the learning rate parameter in the network;

[0105] Update the thresholds c and d of the network nodes according to the prediction error e of the network;

[0106]

[0107] d k =d k +e k

[0108] The number of output layer nodes k is specifically 1.

[0109] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A network traffic threat detection method based on an artificial intelligence model, characterized in that: The following steps are involved: Data collection and preprocessing: collecting network traffic data and preprocessing the collected data; Feature extraction, extracting features from preprocessed data that are helpful for threat detection; Analyze and simulate the attack process, build a series of attack scenarios, and conduct targeted tests on network traffic; Model training: Use the constructed attack scenarios to train the neural network model used to identify traffic threats, and adjust the model parameters during the training process; Manual testing and evaluation: After the neural network model is trained, the neural network model is used to test the obtained training set data and evaluate the performance of the neural network model; Model iteration and optimization: Based on the evaluation results of the neural network model performance, the neural network model is iteratively optimized.

2. According to the network traffic threat detection method based on artificial intelligence model in claim 1, it is characterized in that: The steps of iterative optimization of the model include: a. Collect new network traffic data and expand the data set; b. Retrain the model using new data to update the model’s parameters and weights; c. Evaluate the performance of the model and compare it with other advanced models to determine whether the model needs to be replaced; d. Adjust model parameters or use other techniques for optimization based on the evaluation results; e. Repeat the above steps to achieve continuous iteration and optimization of the model.

3. According to the network traffic threat detection method based on artificial intelligence model in claim 1, it is characterized in that: The network traffic data includes normal and abnormal traffic, and the data covers various network protocols, ports, IP addresses and other information. The data comes from intrusion detection systems, security detection systems and log files.

4. According to the network traffic threat detection method based on artificial intelligence model in claim 1, it is characterized in that: The data preprocessing includes data cleaning and data conversion; Data cleaning includes removing duplicate data, missing value processing and outlier processing in network traffic data; Data conversion is used to convert data into a format suitable for model processing, including converting classified data into numerical data and normalization.

5. According to the network traffic threat detection method based on artificial intelligence model in claim 1, it is characterized in that: The attack scenarios include common attack types and attacks against specific systems and applications. Common attack types include DDOS attacks and SQL injections.

6. The network traffic threat detection method based on artificial intelligence model according to claim 1 is characterized in that: The attack process analysis simulation specifically includes the following steps: Determine the target of the attack: First, clarify the target of the attack. The target of the attack is a specific system, network service or network device; Select attack means: Select appropriate attack means according to the attack target; Generate attack traffic: Generate corresponding attack traffic according to the selected attack method; Simulate the attack process: In a safe environment, simulate the attack process and record the detailed information of the attack; Analyze the attack effect: evaluate the impact of the attack on the target system or network; Adjust the attack scenario: adjust the parameters of the attack scenario based on the test results; Repeat the test: Repeat the above steps multiple times to ensure the reliability and stability of the attack scenario.

7. The network traffic threat detection method based on an artificial intelligence model according to claim 6 is characterized in that: The detailed information of the simulated attack process includes attack traffic, attack path, and attack time.

8. The network traffic threat detection method based on artificial intelligence model according to claim 1 is characterized in that: The feature extraction uses a principal component analysis method to perform feature extraction operations on network traffic data, and the dimension of the data can be reduced after feature extraction.

9. The network traffic threat detection method based on artificial intelligence model according to claim 1 is characterized in that: The data preprocessing also includes noise reduction processing, which uses a cluster analysis method to process the traffic data and remove abnormal values ​​outside the cluster.

10. The network traffic threat detection method based on artificial intelligence model according to claim 1 is characterized in that: The neural network model establishment training steps are specifically as follows: First, according to the dimension of the image feature vector, the input layer node n, hidden layer node m, and output layer node 1 of the neural network are initialized. The number of hidden layer nodes is selected according to the number of input and output nodes, and then the network weight p is initialized. ij and p jk , and initialize the hidden layer threshold c and the output layer threshold d at the same time, giving the relevant parameters and functions in network training; According to the input feature vector, network weight p ij And the hidden layer threshold c, calculate the output q of the hidden layer; In the above formula, f is the hidden layer activation function, specifically: According to the output q of the hidden layer j , network weight p jk and the output layer threshold d, to calculate the predicted output O of the network; Estimate the network's prediction error e based on the predicted output O and expected output Y calculated above; and k =And k -EITHER k ; According to the network prediction error e, the network weight p ij and p jk Update them separately; p jk =p jk +ηq j from k j=1,2,…,m η is the learning rate parameter in the network; Update the thresholds c and d of the network nodes according to the prediction error e of the network; d k =d k +e k The number of output layer nodes k is specifically 1.

Images