Network attack tracing method and system based on deep learning

Abstract

The invention relates to a network attack tracing method and system based on deep learning, and the method comprises the steps: carrying out the real-time monitoring of network flow through a neural network model, recognizing the network flow which is not consistent with a normal behavior mode, and outputting an abnormal network flow data package; decoding the abnormal network traffic data packet, and extracting attack load feature information and communication mode feature information; integrating the attack load feature information and the communication mode feature information into a feature vector for representing the feature of the abnormal traffic, and generating an attack path according to the feature vector; determining an attack starting point according to the generated attack path and characteristics, and analyzing the infrastructure of an attacker; and generating a traceability analysis report which comprises an attack type, an influence range, an attack path and source information. According to the invention, the network attack can be quickly tracked and traced, so that the network attack can be effectively protected.

Description

Technical Field

[0001] The present application relates to the technical field of network attack tracing, and in particular to a network attack tracing method and system based on deep learning. Background Art

[0002] With the increasing popularity of the Internet, the attack techniques and means used by network attackers have also shown new trends. Therefore, network security issues also require network users to continue to pay attention and take effective security protection measures. The protection measures used in the existing technology can effectively deal with common network attacks by setting up firewalls and other methods. However, it is difficult to effectively protect against the continuous attacks carried out by lawless persons through network vulnerabilities with the existing methods. It is necessary to locate the source of the network attack in order to effectively protect it. Therefore, tracking and tracing the source of network attacks has become an important issue facing current network security. Summary of the invention

[0003] In order to quickly track and trace the source of network attacks and effectively protect against network attacks, the present application provides a network attack tracing method and system based on deep learning.

[0004] The above-mentioned invention objective of the present application is achieved through the following technical solutions:

[0005] A network attack tracing method based on deep learning, comprising the steps of:

[0006] Use neural network models to monitor network traffic in real time, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets;

[0007] Decode abnormal network traffic data packets and extract attack payload feature information and communication mode feature information;

[0008] Integrate the attack load feature information and the communication mode feature information into a feature vector to represent the characteristics of abnormal traffic, and generate an attack path based on the feature vector;

[0009] Based on the generated attack paths and features, determine the starting point of the attack and analyze the attacker's infrastructure;

[0010] Generate a source tracing analysis report, including attack type, impact scope, attack path, and source information.

[0011] By adopting the above technical solutions, the neural network model can be used to quickly and accurately discover potential network attacks. The attack path can be generated according to the feature vector, which can accurately track the spread and impact of the attack, determine the starting point of the attack, and analyze the attacker's infrastructure, which is helpful to locate the source of the attack and provide important basis for subsequent defense and response. The attack type, scope of impact, attack path and source information can be displayed through the source tracing analysis report, which provides an important basis for improving security strategies and preventing future attacks.

[0012] In a preferred example of the present application, the step of integrating the attack load characteristic information and the communication mode characteristic information into a characteristic vector for representing the characteristics of abnormal traffic, and generating an attack path according to the characteristic vector specifically includes the following steps:

[0013] Integrate attack payload feature information and communication mode feature information into a feature vector;

[0014] Generate a time series of attack events based on the timestamp information in the feature vector;

[0015] The feature vectors are used as attributes of nodes or edges to construct a communication graph to represent the interactions between entities in the network;

[0016] The paths from the abnormal points to other nodes are extracted in the communication graph, and the attack paths are output in combination with the time series.

[0017] By adopting the above technical solution, the attack load characteristic information and the communication mode characteristic information are integrated into a feature vector, which can more comprehensively represent the characteristics of abnormal traffic and provide an accurate data basis for subsequent reconstruction of the attack path. According to the timestamp information in the feature vector, a time series of attack events is generated, which is helpful for analyzing the occurrence sequence of attack events and the development process of the attack path. The communication diagram can intuitively display the interaction relationship between various entities in the network, and provide a clear visual reference for tracing the attack path, so as to more effectively track and analyze network attacks and provide strong support for network security.

[0018] In a preferred example of the present application, the step of using the feature vector as the attribute of the node or edge to construct a communication graph for representing the interaction between entities in the network specifically includes the following steps:

[0019] Extract feature information from data sources such as network traffic and system logs, convert the feature information into numerical form, and combine them into feature vectors;

[0020] Define each entity in the network as a node, and define the edges between nodes based on the communication relationship between entities;

[0021] Add eigenvectors as attributes of edges and nodes;

[0022] Create an empty graph and add nodes and edges to the graph, attaching their feature vector attributes;

[0023] Output the communication diagram and send it to a graphical tool for displaying the communication diagram.

[0024] By adopting the above technical solution, adding feature vectors as attributes of edges and nodes to the communication graph can more comprehensively represent the interaction relationship between entities. By extracting feature information, defining entities and edges, adding feature vector attributes, and creating and outputting the communication graph, a communication graph that accurately reflects the network topology can be effectively constructed, providing important information support for tracing attack paths.

[0025] In a preferred example of the present application: after the steps of creating an empty graph, adding nodes and edges to the graph, and attaching their feature vector attributes, the step further includes:

[0026] Identify and remove isolated nodes that have no connection to any other nodes;

[0027] If there are multiple edges between two nodes, merge the edges.

[0028] By adopting the above technical solution, isolated nodes that are not connected to any other nodes may not be part of the attack path. Identifying and removing these nodes can simplify the communication graph, reduce unnecessary nodes, and make the graph more concise and easier to analyze. If there are multiple edges between two nodes, merging multiple edges can avoid repeated calculations and analysis, making the communication graph more accurate and efficient, more in line with the actual interaction of the network, and providing a more accurate data basis for subsequent attack path analysis.

[0029] In a preferred example of the present application, the steps of determining the starting point of the attack and analyzing the attacker's infrastructure according to the generated attack path and characteristics specifically include the following steps:

[0030] Identify the first attack event in the attack path based on the time series and mark it as the starting point of the attack;

[0031] Map attack paths onto network topology, identify network entry points exploited by attackers, and analyze attacker infrastructure;

[0032] Isolate the attack origin.

[0033] By adopting the above technical solution and mapping the attack path to the network topology, we can more intuitively understand the attacker's action trajectory in the network and identify the network entry point used by the attacker, which is helpful for analyzing the attacker's attack strategy and intrusion methods. By analyzing the attacker's infrastructure, we can gain in-depth understanding of the attacker's organizational structure, technical capabilities, attack methods and other information, providing a basis for formulating effective defense strategies. Isolating the starting point of the attack can prevent the attacker from continuing to use this point to attack and protect the security of the network.

[0034] In a preferred example of the present application: the step of isolating the attack starting point specifically includes the steps of:

[0035] Physically disconnect the network and configure firewall rules to block all traffic to or from the attack origin point;

[0036] Monitor isolated network traffic and check the status of isolated systems.

[0037] By adopting the above technical solutions, physically disconnecting the network connection and configuring firewall rules can quickly block the communication between the attack starting point and the network, preventing the attacker from further infiltrating and using this point to attack. Monitoring the isolated network traffic and checking the status of the isolated system can help ensure the effectiveness of the isolation measures and promptly discover possible bypasses or new attack activities.

[0038] The second object of the invention is achieved by the following technical solutions:

[0039] A network attack tracing system based on deep learning, including:

[0040] The network monitoring module is used to monitor network traffic in real time using a neural network model, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets;

[0041] A data analysis module is used to decode abnormal network traffic data packets and extract attack payload feature information and communication mode feature information;

[0042] A path generation module is used to integrate the attack load feature information and the communication mode feature information into a feature vector and generate an attack path according to the feature vector;

[0043] The tracing module is used to determine the starting point of the attack based on the generated attack path and characteristics, analyze the attacker's infrastructure, and generate a tracing analysis report.

[0044] By adopting the above technical solutions, the network monitoring module can monitor the network traffic in real time by using the neural network model, and can promptly discover the network traffic that does not conform to the normal behavior pattern, so as to quickly identify potential network attacks; the data analysis module decodes the abnormal network traffic data packets, extracts the attack load characteristic information and the communication mode characteristic information, which is helpful to deeply understand the details of the attack and the intention of the attacker; the path generation module integrates the attack load characteristic information and the communication mode characteristic information into a characteristic vector, and generates an attack path according to the characteristic vector, which can accurately track the spread and impact of the attack; the tracing module determines the starting point of the attack according to the generated attack path and characteristics, analyzes the attacker's infrastructure, and generates a tracing analysis report, which is helpful to locate the source of the attack and provide an important basis for subsequent defense and response.

[0045] The third objective of the present application is achieved through the following technical solutions:

[0046] A computer device comprises a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned network attack tracing method based on deep learning are implemented.

[0047] The fourth objective of the present application is achieved through the following technical solutions:

[0048] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned deep learning-based network attack tracing method.

[0049] In summary, the present application includes at least one of the following beneficial technical effects:

[0050] 1. The neural network model can quickly and accurately discover potential network attacks. The attack path is generated based on the feature vector, which can accurately track the spread and impact of the attack, determine the starting point of the attack, analyze the attacker's infrastructure, help locate the source of the attack, and provide an important basis for subsequent defense and response. The source tracing analysis report shows the attack type, impact range, attack path and source information, which provides an important basis for improving security strategies and preventing future attacks;

[0051] 2. Integrating the attack load feature information and communication mode feature information into a feature vector can more comprehensively represent the characteristics of abnormal traffic and provide an accurate data basis for the subsequent reconstruction of the attack path. According to the timestamp information in the feature vector, the time series of attack events is generated, which is helpful for analyzing the occurrence sequence of attack events and the development process of the attack path. The communication diagram can intuitively display the interaction relationship between various entities in the network, providing a clear visual reference for tracing the attack path, thereby more effectively tracing and analyzing network attacks and providing strong support for network security;

[0052] 3. Isolated nodes that are not connected to any other nodes may not be part of the attack path. Identifying and removing these nodes can simplify the communication graph, reduce unnecessary nodes, and make the graph more concise and easier to analyze. If there are multiple edges between two nodes, merging multiple edges can avoid repeated calculations and analysis, making the communication graph more accurate and efficient, and more conducive to clearly reflecting the communication pattern between them;

[0053] 4. Physically disconnecting the network connection and configuring firewall rules can quickly block the communication between the attack starting point and the network, preventing the attacker from further infiltrating and using this point to attack. Monitoring the isolated network traffic and checking the status of the isolated system will help ensure the effectiveness of the isolation measures and promptly detect possible bypasses or new attack activities. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flow chart of an embodiment of a network attack tracing method based on deep learning in the present application;

[0055] Figure 2 This is a flowchart for implementing step S30 in an embodiment of a network attack tracing method based on deep learning in the present application;

[0056] Figure 3 This is a flowchart for implementing step S40 in an embodiment of a network attack tracing method based on deep learning in the present application;

[0057] Figure 4 This is a schematic diagram of a network attack tracing system based on deep learning in this application;

[0058] Figure 5 This is a principle block diagram of a computer device of the present application. DETAILED DESCRIPTION

[0059] The present application is further described in detail below in conjunction with the accompanying drawings.

[0060] In one embodiment, if Figure 1-3 As shown, the present application discloses a network attack tracing method based on deep learning, which specifically includes the following steps:

[0061] S10: Use the neural network model to monitor network traffic in real time, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets;

[0062] S20: Decode the abnormal network traffic data packets and extract attack payload feature information and communication mode feature information;

[0063] S30: Integrate the attack load feature information and the communication mode feature information into a feature vector to represent the characteristics of the abnormal traffic, and generate an attack path according to the feature vector;

[0064] S40: Determine the starting point of the attack based on the generated attack path and characteristics, and analyze the attacker's infrastructure;

[0065] S50: Generate a source tracing analysis report, including attack type, impact scope, attack path and source information.

[0066] In this embodiment, the attack payload characteristic information is the abnormal or suspicious character string in the payload, which may include special character sequences, commands, scripts, etc.; the communication mode characteristic information is the communication frequency in the abnormal traffic, such as the interval time for sending data packets, and the direction of the traffic, whether it is inward (attacker to target) or outward (target to attacker); the attacker's infrastructure includes C&C servers, proxy servers, etc.

[0067] Specifically, the neural network model is used to monitor network traffic in real time to identify network traffic that does not conform to normal behavior patterns; the abnormal network traffic data packets are decoded to extract raw data, and the virus scanning engine is used to detect malicious code that may be contained in the data packets. The abnormal or suspicious strings in the payload are identified, which may include special character sequences, commands, scripts, etc. The communication frequency in the abnormal traffic is analyzed, such as the interval time between data packet transmissions, and the direction of the traffic is determined, whether it is inward (attacker to target) or outward (target to attacker). Check whether the communication continues to point to a specific IP address or domain name, and identify whether encrypted communication is used, which may indicate the existence of C&C communication. Identify traffic patterns that do not conform to normal communication protocols, such as HTTP requests containing non-standard headers or methods, compare the amount of data sent and received, and abnormal data volume may indicate data leakage or command transmission. The attack payload feature information and communication mode feature information are integrated into feature vectors, and the extracted features are matched with known attack patterns to identify specific attack types and generate attack paths. According to the generated attack path and features, the starting point of the attack is determined, the attacker's infrastructure is analyzed, and finally a traceability analysis report is generated, including the attack type, impact range, attack path and source information.

[0068] In one embodiment, step S30 specifically includes the following steps:

[0069] S31: Integrate the attack payload feature information and the communication mode feature information into a feature vector;

[0070] S32: Generate a time series of attack events according to the timestamp information in the feature vector;

[0071] S33: Use the feature vectors as attributes of nodes or edges to construct a communication graph to represent the interactions between entities in the network;

[0072] S34: Extract the path from the abnormal point to other nodes in the communication graph, and output the attack path in combination with the time series.

[0073] In this embodiment, the output attack path is verified by the following methods: cross-validation: using other logs and traffic data to verify the inferred attack path; expert review: security experts review the inferred path based on experience and knowledge to eliminate false positives.

[0074] Specifically, the attack payload characteristic information and the communication mode characteristic information are integrated into a feature vector. According to the timestamp information in the feature vector, the time series of the attack events is analyzed, and the order of the attacks is inferred. The association rule mining technology is used to find the correlation between the feature vectors and determine which events are interrelated. The feature vectors are used as the attributes of the nodes or edges to construct a communication graph to represent the interactions between the entities in the network. The communication graph is searched for paths from the anomaly points to other nodes. These paths may represent the propagation paths of the attack. The attack paths are displayed using visualization tools to help understand the propagation and impact of the attack.

[0075] In one embodiment, step S33 specifically includes the steps of:

[0076] S331: extracting feature information from data sources such as network traffic and system logs, converting the feature information into numerical form, and combining them into feature vectors;

[0077] S332: define each entity in the network as a node, and define edges between nodes based on the communication relationship between the entities;

[0078] S333: Add feature vectors as attributes of edges and nodes;

[0079] S334: Create an empty graph and add nodes and edges to the graph, attaching their feature vector attributes;

[0080] S335: Output the communication diagram, and send the communication diagram to a graphical tool for displaying the communication diagram.

[0081] In this embodiment, entities in the network can be IP addresses, hosts, services, etc. If there is direct communication between two IP addresses, an edge is created between them; feature vectors are used as attributes of nodes, which may include node type, operating system, open ports, etc.; feature vectors are used as attributes of edges, which may include communication frequency, data transmission volume, communication protocol, etc.; graphical tools may be Gephi, Cytoscape, Matplotlib, etc.

[0082] Specifically, extract features from data sources such as network traffic and system logs, such as IP addresses, port numbers, communication protocols, timestamps, and packet sizes, convert these features into numerical forms, and combine them into feature vectors. For example, use one-hot encoding to process categorical features and standardize numerical features. Add feature vectors as attributes of nodes, use graph theory libraries (such as NetworkX and Graphviz) to create empty graphs, add prepared nodes and edges to the graph, and attach their feature vector attributes. Use graphical tools to display communication graphs, and set the color, size, shape, and edge width of nodes to better display feature vector attributes. Finally, use graph theory algorithms (such as the shortest path algorithm and community detection algorithm) to analyze the interaction paths between entities, and display abnormal communication patterns or potential attack paths in the graph.

[0083] In one embodiment, step S334 further includes the following steps:

[0084] S3341: Identify and remove isolated nodes that have no connection to any other nodes;

[0085] S3342: If there are multiple edges between two nodes, merge the multiple edges.

[0086] In this embodiment, removing isolated nodes and merging duplicate edges can simplify the communication graph, making it clearer and easier to analyze. Merging duplicate edges helps to more accurately reflect the actual communication pattern between entities, avoid repeated calculations and analysis, optimize the communication graph to make it more consistent with the actual interaction of the network, and provide a more accurate data basis for subsequent attack path analysis.

[0087] Specifically, in the constructed communication graph, check whether each node has direct or indirect connections with other nodes, and whether there are multiple edges between two nodes. If a node is not connected to other nodes, that is, there is no edge pointing to or coming from the node, then it may not be part of the attack path, and it will be removed from the graph. If there are multiple edges between two nodes, indicating that these edges represent the same or similar communication patterns, then these edges are merged, only one edge is retained, and the number of edges before the merge is recorded so that this factor can be considered in subsequent analysis.

[0088] In one embodiment, step S40 specifically includes the steps of:

[0089] S41: Identify the first attack event in the attack path according to the time series and mark it as the starting point of the attack;

[0090] S42: Map the attack path onto the network topology, identify the network entry points exploited by the attacker, and analyze the attacker's infrastructure;

[0091] S43: Isolate the attack starting point.

[0092] In this embodiment, the starting point is verified in the following ways: checking the logs of related systems to confirm that the activities of the starting point are consistent with the behavior of the attacker; deeply analyzing the network traffic of the starting point to find the tools, techniques and procedures of the attacker; performing forensic analysis on the starting point system to find traces left by the attack.

[0093] Specifically, based on the timestamp information in the feature vector, a timeline of events is constructed, the first attack event in the attack path is identified and marked as the starting point of the attack, which may be an IP address, host, service or application; the attack path is mapped to the network topology, the network entry points that the attacker may exploit are identified, and the vulnerabilities in the network are analyzed, such as unpatched servers, improperly configured firewall rules, etc., to determine the point where the attacker initially contacts the network, such as through phishing emails, social engineering, or attacks on a certain service. The determined attack starting point is recorded, including relevant features, time, affected systems and possible attack vectors, and a report is generated. Finally, the attack starting point is isolated to prevent further infiltration by the attacker and to repair related security vulnerabilities.

[0094] In one embodiment, step S43 specifically includes the steps of:

[0095] S431: Physically disconnect the network connection and configure firewall rules to block all traffic from or to the attack origin point;

[0096] S432: Monitor the isolated network traffic and check the status of the isolated system.

[0097] In this embodiment, if the starting point is a network device, such as a switch or a router, it is necessary to physically disconnect the network connection or implement logical isolation through configuration; if the starting point is a service, the service needs to be temporarily shut down. In extreme cases, if the starting point is a physical device, the power supply may need to be disconnected; if it is a virtual machine in a virtual environment, it can be isolated on the virtualization management platform.

[0098] Specifically, evaluate the impact that isolation operations may have on business operations, develop an isolation strategy, including the specific method, schedule, and responsible person for isolation, physically disconnect the network connection, and configure firewall rules to block all traffic from or to the attack starting point, monitor the isolated network traffic to ensure that there is no traffic from the attack starting point, check the status of the isolated system to ensure that it has not been reused, and perform necessary repair measures on the isolated system, such as installing security patches, removing malware, and fixing configuration errors. Finally, while ensuring safety, gradually restore the isolated services or systems.

[0099] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0100] In one embodiment, a network attack tracing system based on deep learning is provided, which corresponds one-to-one to a network attack tracing method based on deep learning in the above embodiment. Figure 4 As shown, the system includes:

[0101] The network monitoring module is used to monitor network traffic in real time using a neural network model, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets;

[0102] A data analysis module is used to decode abnormal network traffic data packets and extract attack payload feature information and communication mode feature information;

[0103] A path generation module is used to integrate the attack load feature information and the communication mode feature information into a feature vector and generate an attack path according to the feature vector;

[0104] The tracing module is used to determine the starting point of the attack based on the generated attack path and characteristics, analyze the attacker's infrastructure, and generate a tracing analysis report.

[0105] For the specific definition of a network attack tracing system based on deep learning, please refer to the definition of a network attack tracing method based on deep learning above, which will not be repeated here. Each module in the above-mentioned network attack tracing system based on deep learning can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0106] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. When the computer program is executed by the processor, a network attack tracing method based on deep learning is implemented.

[0107] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a network attack tracing method based on deep learning is implemented;

[0108] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, a network attack tracing method based on deep learning is implemented;

[0109] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0110] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0111] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network attack tracing method based on deep learning, It is characterized in that Includes steps: Use neural network models to monitor network traffic in real time, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets; Decode abnormal network traffic data packets and extract attack payload feature information and communication mode feature information; Integrate the attack load feature information and the communication mode feature information into a feature vector to represent the characteristics of abnormal traffic, and generate an attack path based on the feature vector; Based on the generated attack paths and features, determine the starting point of the attack and analyze the attacker's infrastructure; Generate a source tracing analysis report, including attack type, impact scope, attack path, and source information.

2. According to the deep learning-based network attack tracing method of claim 1, It is characterized in that The step of integrating the attack load characteristic information and the communication mode characteristic information into a characteristic vector for representing the characteristics of abnormal traffic, and generating an attack path according to the characteristic vector specifically includes the following steps: Integrate attack payload feature information and communication mode feature information into a feature vector; Generate a time series of attack events based on the timestamp information in the feature vector; The feature vectors are used as attributes of nodes or edges to construct a communication graph to represent the interactions between entities in the network; The paths from the abnormal points to other nodes are extracted in the communication graph, and the attack paths are output in combination with the time series.

3. According to the method for tracing the source of network attacks based on deep learning in claim 2, It is characterized in that The step of using the feature vector as the attribute of the node or edge to construct a communication graph for representing the interaction between entities in the network specifically includes the following steps: Extract feature information from data sources such as network traffic and system logs, convert the feature information into numerical form, and combine them into feature vectors; Define each entity in the network as a node, and define the edges between nodes based on the communication relationship between entities; Add eigenvectors as attributes of edges and nodes; Create an empty graph and add nodes and edges to the graph, attaching their feature vector attributes; Output the communication diagram and send it to a graphical tool for displaying the communication diagram.

4. According to the method for tracing the source of network attacks based on deep learning in claim 3, It is characterized in that After the steps of creating an empty graph and adding nodes and edges to the graph and attaching their feature vector attributes, the following steps are also included: Identify and remove isolated nodes that have no connection to any other nodes; If there are multiple edges between two nodes, merge the edges.

5. According to the deep learning-based network attack tracing method of claim 1, It is characterized in that The step of determining the starting point of the attack and analyzing the attacker's infrastructure according to the generated attack path and characteristics specifically includes the following steps: Identify the first attack event in the attack path based on the time series and mark it as the starting point of the attack; Map attack paths onto network topology, identify network entry points exploited by attackers, and analyze attacker infrastructure; Isolate the attack origin.

6. According to claim 5, a network attack tracing method based on deep learning, It is characterized in that The step of isolating the attack starting point specifically includes the steps of: Physically disconnect the network and configure firewall rules to block all traffic to or from the attack origin point; Monitor isolated network traffic and check the status of isolated systems.

7. A network attack tracing system based on deep learning, It is characterized in that include: The network monitoring module is used to monitor network traffic in real time using a neural network model, identify network traffic that does not conform to normal behavior patterns, and output abnormal network traffic data packets; A data analysis module is used to decode abnormal network traffic data packets and extract attack payload feature information and communication mode feature information; A path generation module is used to integrate the attack load feature information and the communication mode feature information into a feature vector and generate an attack path according to the feature vector; The tracing module is used to determine the starting point of the attack based on the generated attack path and characteristics, analyze the attacker's infrastructure, and generate a tracing analysis report.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, It is characterized in that When the processor executes the computer program, the steps of a network attack tracing method based on deep learning as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program. It is characterized in that When the computer program is executed by a processor, the steps of a network attack tracing method based on deep learning as described in any one of claims 1 to 6 are implemented.

Images