Intelligent network security protection method and system

Abstract

The invention discloses an intelligent network security protection method. The method comprises the following steps: S1, data acquisition and preprocessing; s2, model prediction; s3, abnormal behavior detection; s4, alarming and responding; and S5, monitoring and maintaining the system. According to the method, the user behavior model is constructed by using the historical behavior data, the change of the user behavior can be dynamically adapted, the future user behavior is predicted, the abnormal behavior is detected, whether the current behavior of the user is abnormal or not is detected in real time through comparison with the model predicted value, and alarming and response are performed according to the abnormal degree. The method is suitable for monitoring the network activity of the user in real time, ensures that the system can recognize potential threats as early as possible and take protective measures, can recognize abnormal behaviors more accurately according to historical behaviors of the user, and effectively reduces the false alarm rate and the missing report rate.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to an intelligent network security protection method and system. Background Art

[0002] With the rapid development of information technology, the Internet has become an important part of people's daily lives and business operations. However, network security threats have also increased, such as malware attacks, phishing, identity theft, etc., which have seriously affected the stability and security of the network environment. Traditional network security protection systems usually rely on predefined rules or static security policies, which are difficult to deal with complex and changing network attacks. These systems have limited ability to identify unknown threats, which can easily cause false positives or false negatives, thus affecting the effectiveness of security protection.

[0003] In recent years, with the rapid development of big data and artificial intelligence technologies, intelligent network security protection methods have gradually become a research hotspot in the field of network security. By analyzing the user's historical behavior data, building user behavior patterns and predicting their future behavior, it has become an important means to improve the accuracy of network security protection systems. Through this prediction model, the system can detect abnormal user behavior early, warn of potential network attacks in advance, and then take protective measures to reduce the risk of security incidents.

[0004] At present, most network security protection systems based on user behavior analysis focus on behavioral anomaly detection, but there is little research on how to predict behavior through historical behavior data. Existing anomaly detection systems usually use thresholds or simple classification methods, which are difficult to dynamically adapt to the complex behavior changes of users and easily lead to false detection. In addition, existing systems have efficiency problems when processing multi-dimensional data and cannot make accurate assessments of user behavior status in real time. Summary of the invention

[0005] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides an intelligent network security protection method, including:

[0008] S1. Data collection and preprocessing: Collect user behavior data and preprocess the data. The continuous values ​​of these features in time constitute the input sequence X = {x1, x2, ..., xT};

[0009] S2, model prediction: Use historical behavior data to train the deep learning model to generate prediction values ​​for each time step of the user based on the collected data;

[0010] S3, abnormal behavior detection: identify abnormal behaviors through anomaly detection algorithms based on the collected data;

[0011] S4, Alarm and Response: When abnormal behavior is detected, an alarm is issued to notify the management personnel, and the automatic response mechanism is activated to take certain measures;

[0012] S5. System monitoring and maintenance: Continuous monitoring to ensure system stability and security, and regular updates and maintenance of models.

[0013] As a preferred solution of the intelligent network security protection method described in the present invention, the historical behavior data training deep learning model is an LSTM model, which includes an input layer, a forgetting layer and an output layer.

[0014] As a preferred solution of the intelligent network security protection method described in the present invention, the forget gate includes a forget layer, and its calculation formula is as follows:

[0015] f t =σ(W f ·[h t-1 , x t ]+b f )

[0016] Where W f is the weight matrix of the forget gate; h t-1 is the hidden state of the previous time step; x t is the input of the current time step; b f is the bias of the forget gate; σ is the activation function.

[0017] As a preferred solution of the intelligent network security protection method described in the present invention, the input gate updates the memory unit state, which includes the input layer, the candidate memory unit state and the updated memory unit state, and the calculation formula is as follows:

[0018] Input gate: i t =σ(W i ·[h t-1 , x t ]+b i );

[0019] Candidate memory cell status:

[0020] Update the memory cell status:

[0021] Where W i is the weight matrix of the input gate; W C is the weight matrix of the candidate memory unit; b i , b C All are bias terms; C t-1 is the memory cell state at the previous time step.

[0022] As a preferred solution of the intelligent network security protection method described in the present invention, the output gate determines the output of the hidden state, and the hidden state is used to pass to the next time step. The calculation formula is as follows:

[0023] Output layer: o t =σ(W o ·[h t-1 , x t ]+b o );

[0024] Hidden state: h t =o t tanh(C t );

[0025] Where W o is the weight matrix of the output gate; h t is the hidden state of the current time step; tanh(C t ) Perform nonlinear transformation on the memory cell state; b o is the bias term of the output layer.

[0026] As a preferred solution of the intelligent network security protection method described in the present invention, the specific calculation formula of the predicted value of each time step of the user is as follows:

[0027]

[0028] Where W h The weight matrix mapped to the predicted output; b h is the bias term mapped to the predicted output.

[0029] As a preferred solution of the intelligent network security protection method described in the present invention, the calculation formula of the anomaly detection algorithm is as follows:

[0030]

[0031] Where λ is the attenuation coefficient; τ is the time variable, which represents the span from the actual time t0 to t; h i (τ) is the hidden state of the LSTM model at time step t, and different i corresponds to different behavioral characteristics; σi is the standard deviation of behavior feature i; Φ(τ) is the time weight function; N is the number of features in the LSTM model; B(t) is the user behavior pattern function, representing the overall behavior trend as a function of time t; M is the number of behavior features used for behavior acceleration calculation; α is the adjustment parameter.

[0032] As a preferred solution of the intelligent network security protection method described in the present invention, the anomaly detection algorithm calculation formula A(t) and the predicted value of each time step of the user The specific value range of the difference is divided as follows:

[0033] △A(t) = 0, which is the normal behavior state. The user's behavior pattern is stable and there is no significant fluctuation compared with the past, which is within the normal behavior range;

[0034] 0≤△A(t)<∈1, it is a mild abnormal behavior, and the user behavior pattern fluctuates slightly;

[0035] ∈1≤△A(t)<∈2, moderate abnormal behavior, this interval indicates a significant change in user behavior;

[0036] ∈2≤△A(t)<∈3, it is a serious abnormal behavior, and the user's behavior deviates significantly from the normal pattern;

[0037] △A(t)≥∈3, which is extremely abnormal behavior, and the user behavior is extremely abnormal.

[0038] As a preferred solution of the intelligent network security protection method described in the present invention, the specific corresponding measures for each level of ΔA(t) are as follows:

[0039] Normal behavior state: no additional measures are required, only the device behavior data is recorded;

[0040] Mild abnormal behavior: alerts the user to let the user know that the system has detected a minor abnormality;

[0041] Moderate abnormal behavior: Send security reminders to users, suggest confirming current operations and restricting some key functions such as account modification and payment behaviors, and perform multi-factor authentication until security is confirmed;

[0042] Severe abnormal behavior: triggering severe security protection mechanisms, restricting key operations, such as account freezing, transaction freezing, and forcing users to undergo comprehensive identity verification;

[0043] Extremely abnormal behavior: Activate the highest level of security mechanism, immediately freeze the account and issue a warning to the user, waiting for further actions from the user and administrator.

[0044] In a second aspect, an embodiment of the present invention further provides an intelligent network security protection system, which specifically includes:

[0045] Data collection and preprocessing module: including user behavior data collection unit, data cleaning and filtering unit and time series construction unit;

[0046] Model prediction module: including historical data analysis unit, deep learning model training unit and real-time data input unit;

[0047] Abnormal behavior detection module: including anomaly detection algorithm unit, predicted value and actual value comparison unit and risk assessment unit;

[0048] Alarm and response module: including response strategy library unit and execution control unit;

[0049] System monitoring and maintenance module: includes monitoring unit, update maintenance unit and security log recording unit.

[0050] Beneficial effects of the present invention:

[0051] By using historical behavior data to build a user behavior model, it can dynamically adapt to changes in user behavior, predict future user behavior and detect abnormal behavior. By comparing with the model prediction value, it can detect in real time whether the user's current behavior is abnormal, and issue an alarm and respond according to the degree of abnormality. It is suitable for real-time monitoring of user network activities to ensure that the system can identify potential threats early and take protective measures. It can more accurately identify abnormal behavior based on the user's historical behavior, effectively reducing false positives and false negatives. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0053] Figure 1 A flow chart of an intelligent network security protection method proposed by the present invention;

[0054] Figure 2 This is an architecture diagram of an intelligent network security protection system proposed by the present invention. DETAILED DESCRIPTION

[0055] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0056] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0057] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0058] Reference Figure 1-2 The present invention provides an intelligent network security protection method, comprising:

[0059] S1. Data collection and preprocessing: Collect user behavior data, including but not limited to login time, operation frequency, resources visited, etc., and preprocess the data, including normalization, denoising and feature extraction. The continuous values ​​of these features in time constitute the input sequence X = {1, x2, ..., x T};

[0060] S2, model prediction: Use historical behavior data to train the deep learning model to generate prediction values ​​for each time step of the user based on the collected data;

[0061] S3, abnormal behavior detection: identify abnormal behaviors through anomaly detection algorithms based on the collected data;

[0062] S4, Alert and Response: When abnormal behavior is detected, an alert is issued to notify the management personnel, and an automatic response mechanism is activated to take certain measures, such as isolating suspicious accounts and restricting access rights;

[0063] S5. System monitoring and maintenance: Continuously monitor to ensure the stability and security of the system, and regularly update and maintain the model to ensure that it can adapt to new user behavior patterns and attack strategies.

[0064] Among them, the deep learning model for historical behavior data training is an LSTM model, which includes an input layer, a forgetting layer and an output layer.

[0065] Furthermore, the forget gate includes a forget layer, and its calculation formula is as follows:

[0066] f t =σ(W f ·[h t-1 , x t ]+b f )

[0067] Where Wf is the weight matrix of the forget gate; h t-1 is the hidden state of the previous time step; x t is the input of the current time step; b f is the bias of the forget gate; σ is the activation function, is the Sigmoid function, and the forget gate determines how much memory unit state from the previous time step should be retained.

[0068] Furthermore, the input gate updates the memory cell state, which includes the input layer, the candidate memory cell state, and the updated memory cell state. The calculation formula is as follows:

[0069] Input gate: i t =σ(W i ·[h t-1 , x t ]+b i );

[0070] Candidate memory cell status:

[0071] Update the memory cell status:

[0072] Where W i is the weight matrix of the input gate; W C is the weight matrix of the candidate memory unit; b i , b C All are bias terms; C t-1 The memory unit state of the previous time step is updated to the current memory unit state and store the user's behavior pattern.

[0073] Furthermore, the output gate determines the output of the hidden state, which is used to pass to the next time step. The calculation formula is as follows:

[0074] Output layer: o t =σ(W o ·[h t-1 , x t ]+b o );

[0075] Hidden state: h t =o t tanh(C t );

[0076] Where W o is the weight matrix of the output gate; h t is the hidden state of the current time step; tanh(C t ) Perform nonlinear transformation on the memory cell state; b ois the bias term of the output layer, which generates the hidden state h of the current time step through the output layer t , as the output of the predicted behavior pattern.

[0077] Furthermore, the specific calculation formula for the predicted value of the user at each time step is as follows:

[0078]

[0079] Where W h The weight matrix mapped to the predicted output; b h is the bias term mapped to the predicted output.

[0080] Furthermore, the calculation formula of the anomaly detection algorithm is as follows:

[0081]

[0082] Where λ is the attenuation coefficient, which controls the influence of the past time period on the current time point; τ is the time variable, which represents the span from the actual time t0 to t, and is used to represent the change of behavior pattern in the past time period; h i (τ) is the hidden state of the LSTM model at time step t, and different i corresponds to different behavioral characteristics; σ i is the standard deviation of the behavior feature i, used to normalize the hidden state h i (τ) is used to eliminate the magnitude differences between different features; Φ(τ) is the time weight function, which indicates the importance of the current behavior feature at time point τ; N is the number of features in the LSTM model, that is, the dimension of the behavior feature extracted by the model; B(t) is the user behavior pattern function, which represents the overall behavior trend as a function of time t; M is the number of behavior features used for behavior acceleration calculation, which indicates the number of features involved in the behavior change rate analysis; α is the adjustment parameter.

[0083] Furthermore, the anomaly detection algorithm calculates the formula A(t) and the predicted value of the user at each time step The specific value range of the difference is divided as follows:

[0084] △A(t) = 0, which is the normal behavior state. The user's behavior pattern is stable and there is no significant fluctuation compared with the past, which is within the normal behavior range;

[0085] 0≤△A(t)<∈1, it is a mild abnormal behavior, the user's behavior pattern fluctuates slightly, and there may be unintentional abnormal or occasional behavior;

[0086] ∈1≤△A(t)<∈2, moderate abnormal behavior. This interval indicates that the user behavior has changed significantly, and there may be suspicious operations or erroneous operations.

[0087] ∈2≤△A(t)<∈3, which is a serious abnormal behavior. The user's behavior deviates significantly from the normal mode and is likely to pose a security threat.

[0088] △A(t)≥∈3 indicates extremely abnormal behavior. The user's behavior is extremely abnormal, and the system highly suspects that malicious behavior is being performed, which may be malicious operations such as hacker attacks and identity theft. (The specific results of △A(t) calculation are used to divide the behavior level. ∈1 can be set based on the behavior variance over the past period of time, ∈1=k1·Var(h t ), where k1 is the empirical coefficient, ∈2 can be defined based on suspicious behavior samples in historical data, ∈2 = k2 Var(h t ), where k2>k1, the threshold ∈3 will be set higher, ∈3=k3·Var(h t ), where k3>k2.

[0089] Furthermore, the specific corresponding measures for each level of △A(t) are as follows:

[0090] Normal behavior state: no additional measures are required, only the device behavior data is recorded;

[0091] Mild abnormal behavior: alerts the user to let the user know that the system has detected a minor abnormality;

[0092] Moderate abnormal behavior: Send security reminders to users, suggest confirming current operations and restricting some key functions such as account modification and payment behaviors, and perform multi-factor authentication until security is confirmed;

[0093] Severe abnormal behavior: triggering severe security protection mechanisms, restricting key operations, such as account freezing, transaction freezing, and forcing users to undergo comprehensive identity verification;

[0094] Extremely abnormal behavior: Activate the highest level of security mechanism, immediately freeze the account and issue a warning to the user, waiting for further actions from the user and administrator.

[0095] This embodiment also provides an intelligent network security protection system, which specifically includes:

[0096] Data collection and preprocessing module: including user behavior data collection unit, data cleaning and filtering unit and time series construction unit;

[0097] Model prediction module: including historical data analysis unit, deep learning model training unit and real-time data input unit;

[0098] Abnormal behavior detection module: including anomaly detection algorithm unit, predicted value and actual value comparison unit and risk assessment unit;

[0099] Alarm and response module: including response strategy library unit and execution control unit;

[0100] System monitoring and maintenance module: including monitoring unit, update maintenance unit and security log recording unit. Through modular design, it ensures effective detection and response to abnormal user behavior and protects network security. Each module is closely connected, and the data flow forms a closed loop from collection to response, ensuring that the system can timely and effectively prevent potential network security threats.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An intelligent network security protection method, characterized in that: include: S1. Data collection and preprocessing: Collect user behavior data and preprocess the data. The continuous values ​​of these features in time constitute the input sequence X = {x1, x2, ..., x T }; S2, model prediction: Use historical behavior data to train the deep learning model to generate prediction values ​​for each time step of the user based on the collected data; S3, abnormal behavior detection: identify abnormal behaviors through anomaly detection algorithms based on the collected data; S4, Alarm and Response: When abnormal behavior is detected, an alarm is issued to notify the management personnel, and the automatic response mechanism is activated to take certain measures; S5. System monitoring and maintenance: Continuous monitoring to ensure system stability and security, and regular updates and maintenance of models.

2. The intelligent network security protection method according to claim 1, characterized in that: The historical behavior data training deep learning model is an LSTM model, which includes an input layer, a forgetting layer and an output layer.

3. The intelligent network security protection method according to claim 2, characterized in that: The forget gate includes a forget layer, and its calculation formula is as follows: f t =σ(W f ·[h t-1 ,x t ]+b f ) Where W f is the weight matrix of the forget gate; h t-1 is the hidden state of the previous time step; x t is the input of the current time step; b f is the bias of the forget gate; σ is the activation function.

4. The intelligent network security protection method according to claim 3 is characterized by: The input gate updates the memory cell state, which includes the input layer, the candidate memory cell state and the updated memory cell state. The calculation formula is as follows: Input gate: i t =σ(W i ·[h t-1 , x t ]+b i ); Candidate memory cell status: Update the memory cell status: Where W i is the weight matrix of the input gate; W C is the weight matrix of the candidate memory unit; b i 、b C All are bias terms; C t-1 is the memory cell state at the previous time step.

5. An intelligent network security protection method according to claim 4, characterized in that: The output gate determines the output of the hidden state, which is used to pass to the next time step. The calculation formula is as follows: Output layer: o t =σ(W o ·[h t-1 , x t ]+b o ); Hidden state: h t =o t tanh(C t ); Where W o is the weight matrix of the output gate; h t is the hidden state of the current time step; tanh(C t ) Perform nonlinear transformation on the memory cell state; b o is the bias term of the output layer.

6. An intelligent network security protection method according to claim 5, characterized in that: The specific calculation formula of the predicted value of the user at each time step is as follows: Where W h The weight matrix mapped to the predicted output; b h is the bias term mapped to the predicted output.

7. An intelligent network security protection method according to claim 6, characterized in that: The calculation formula of the anomaly detection algorithm is as follows: Where λ is the attenuation coefficient; τ is the time variable, which represents the span from the actual time t0 to t; h i (τ) is the hidden state of the LSTM model at time step t, and different i corresponds to different behavioral characteristics; σ i is the standard deviation of behavior feature i; Φ(τ) is the time weight function; N is the number of features in the LSTM model; B(t) is the user behavior pattern function, representing the overall behavior trend as a function of time t; M is the number of behavior features used for behavior acceleration calculation; α is the adjustment parameter.

8. An intelligent network security protection method according to claim 7, characterized in that: The anomaly detection algorithm calculates the formula A(t) and the predicted value of the user at each time step The specific value range of the difference is divided as follows: △A(t) = 0, which is the normal behavior state. The user's behavior pattern is stable and there is no significant fluctuation compared with the past, which is within the normal behavior range; 0≤△A(t)<∈1, it is a mild abnormal behavior, and the user behavior pattern fluctuates slightly; ∈1≤△A(t)<∈2, moderate abnormal behavior, this interval indicates a significant change in user behavior; ∈2≤△A(t)<∈3, it is a serious abnormal behavior, and the user's behavior deviates significantly from the normal pattern; △A(t)≥∈3, which is extremely abnormal behavior, and the user behavior is extremely abnormal.

9. The intelligent network security protection method according to claim 7, characterized in that: The specific corresponding measures for each level of A(t) are as follows: Normal behavior state: no additional measures are required, only the device behavior data is recorded; Mild abnormal behavior: alerts the user to let the user know that the system has detected a minor abnormality; Moderate abnormal behavior: Send security reminders to users, suggest confirming current operations and restricting some key functions such as account modification and payment behaviors, and perform multi-factor authentication until security is confirmed; Severe abnormal behavior: triggering severe security protection mechanisms, restricting key operations, such as account freezing, transaction freezing, and forcing users to undergo comprehensive identity verification; Extremely abnormal behavior: Activate the highest level of security mechanism, immediately freeze the account and issue a warning to the user, waiting for further actions from the user and administrator.

10. An intelligent network security protection system, based on an intelligent network security protection method according to any one of claims 1 to 8, characterized in that: Specifically include: Data collection and preprocessing module: including user behavior data collection unit, data cleaning and filtering unit and time series construction unit; Model prediction module: including historical data analysis unit, deep learning model training unit and real-time data input unit; Abnormal behavior detection module: including anomaly detection algorithm unit, predicted value and actual value comparison unit and risk assessment unit; Alarm and response module: including response strategy library unit and execution control unit; System monitoring and maintenance module: includes monitoring unit, update maintenance unit and security log recording unit.

Images