An intelligent network security protection method and system

Abstract

The present invention discloses an intelligent network security protection method, including: S1, data collection and preprocessing; S2, model prediction; S3, abnormal behavior detection; S4, alarm and response; S5, system monitoring and maintenance. By using historical behavior data to construct a user behavior model, the present invention can dynamically adapt to changes in user behavior, predict future user behavior and detect abnormal behavior. By comparing with the model prediction value, it can detect in real time whether the user's current behavior is abnormal, and give an alarm and response according to the degree of abnormality. It is applicable to real-time monitoring of user network activities, ensuring that the system can identify potential threats early and take protective measures, and can more accurately identify abnormal behavior according to the user's historical behavior, effectively reducing the false alarm rate and missed alarm rate.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and particularly to an intelligent network security protection method and system. Background Art

[0002] With the rapid development of information technology, the network has become an important part of people's daily life and enterprise operations. However, network security threats have also increased accordingly. Malware attacks, phishing, identity theft, etc. have emerged continuously, seriously affecting the stability and security of the network environment. Traditional network security protection systems usually rely on predefined rules or static security policies, and it is difficult to cope with complex and changing network attacks. These systems have limited ability to identify unknown threats, and are prone to false positives or false negatives, thus affecting the effectiveness of security protection.

[0003] In recent years, with the rapid development of big data and artificial intelligence technologies, intelligent network security protection methods have gradually become a research hotspot in the field of network security. By analyzing the historical behavior data of users, constructing user behavior patterns and predicting their future behaviors have become important means to improve the accuracy of network security protection systems. Through this prediction model, the system can detect abnormal user behaviors early, give early warnings of potential network attacks, and then take protection measures to reduce the risk of security incidents.

[0004] At present, most network security protection systems based on user behavior analysis mainly focus on behavior anomaly detection, but there is less research on how to perform behavior prediction through historical behavior data. Existing anomaly detection systems usually adopt thresholds or simple classification methods, and it is difficult to dynamically adapt to the complex behavior changes of users, which is prone to false detections. In addition, existing systems have efficiency problems when processing multi-dimensional data and cannot accurately evaluate the behavior status of users in real time. Summary of the Invention

[0005] The purpose of this part is to outline some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this part, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this part, the abstract, and the title. However, such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] To solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides an intelligent network security protection method, including:

[0008] S1. Data collection and preprocessing: Collect the behavior data of users and preprocess the data. The values of these features that are continuous in time form an input sequence X = {x1, x2,... xT};

[0009] S2. Model Prediction: Use historical behavior data to train a deep learning model to generate predicted values for each time step of the user based on the collected data;

[0010] S3. Abnormal Behavior Detection: Identify abnormal behaviors according to the collected data through abnormal detection algorithms;

[0011] S4. Alarm and Response: When abnormal behaviors are detected, send an alarm to notify the management staff and activate the automatic response mechanism to take certain measures;

[0012] S5. System Monitoring and Maintenance: Continuously monitor to ensure the stability and security of the system, and regularly update and maintain the model.

[0013] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the deep learning model trained by the historical behavior data is an LSTM model, which includes an input layer, a forgetting layer, and an output layer.

[0014] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the forgetting gate includes a forgetting layer, and its calculation formula is as follows:

[0015] f t =σ(W f ·[h t-1 , x t +b f )

[0016] where W f is the weight matrix of the forgetting gate; h t-1 is the hidden state of the previous time step; x t is the input of the current time step; b f is the bias of the forgetting gate; σ is the activation function.

[0017] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the input gate updates the memory cell state, which includes an input layer, a candidate memory cell state, and an updated memory cell state, and its calculation formula is as follows:

[0018] Input gate: i t =σ(W i ·[h t-1 , x t +b i );

[0019] Candidate memory cell state:

[0020] Updated memory cell state:

[0021] Among them, W i is the weight matrix of the input gate; W C is the weight matrix of the candidate memory unit; b i , b C are both bias terms; C t-1 is the memory unit state at the previous time step.

[0022] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the output gate determines the output of the hidden state, and the hidden state is used to be passed to the next time step, and its calculation formula is as follows:

[0023] Output layer: o t =σ(W o ·[h t-1 , x t +b o );

[0024] Hidden state: h t =o t ·tanh(C t );

[0025] Among them, W o is the weight matrix of the output gate; h t is the hidden state at the current time step; tanh(C t ) performs a non-linear transformation on the memory unit state; b o is the bias term of the output layer.

[0026] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the specific calculation formula of the predicted value of the user at each time step is as follows:

[0027]

[0028] Among them, W h is the weight matrix mapped to the predicted output; b h is the bias term mapped to the predicted output.

[0029] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the calculation formula of the anomaly detection algorithm is specifically as follows:

[0030]

[0031] Among them, λ is the attenuation coefficient; τ is the time variable, representing the span from the actual time t0 to t; h i (τ) is the hidden state of the LSTM model at the time step t, and different i corresponds to different behavioral characteristics; σi σ_i is the standard deviation of the behavioral feature i; Φ(τ) is the time weight function; N is the number of features in the LSTM model; B(t) is the user behavior pattern function, representing the overall behavior trend as a function of time t; M is the number of behavioral features used for calculating the behavioral acceleration; α is the adjustment parameter.

[0032] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the calculation formula A(t) of the anomaly detection algorithm and the predicted value of the user at each time step The specific value range division of the difference is as follows:

[0033] △A(t) = 0, which is the normal behavior state. The user behavior pattern is stable, and the behavior pattern has no significant fluctuations compared with the past, belonging to the normal behavior range;

[0034] 0 ≤ △A(t) < ∈1, which is a mild abnormal behavior, and the user behavior pattern has slight fluctuations;

[0035] ∈1 ≤ △A(t) < ∈2, which is a moderate abnormal behavior. This interval indicates that the user behavior has changed greatly;

[0036] ∈2 ≤ △A(t) < ∈3, which is a severe abnormal behavior, and the user behavior significantly deviates from the normal mode;

[0037] △A(t) ≥ ∈3, which is an extremely abnormal behavior, and the user behavior is extremely abnormal.

[0038] As a preferred solution of the intelligent network security protection method described in the present invention, wherein: the specific corresponding measures for each level of △A(t) are as follows:

[0039] Normal behavior state: No additional measures are required, only record the behavior data of the user;

[0040] Mild abnormal behavior: Remind the user to let the user know that the system has detected a slight anomaly;

[0041] Moderate abnormal behavior: Send a security reminder to the user, recommend confirming the current operation and restricting some key functions such as account modification and payment behavior, and perform multi-factor authentication until security is confirmed;

[0042] Severe abnormal behavior: Trigger a severe security protection mechanism, restrict key operations, such as account freezing and transaction freezing, and force the user to perform a comprehensive identity verification;

[0043] Extremely abnormal behavior: Activate the highest-level security mechanism, immediately freeze the account and issue a warning to the user, and wait for further operations by the user and the administrator.

[0044] In a second aspect, the embodiments of the present invention further provide an intelligent network security protection system, which specifically includes:

[0045] Data acquisition and preprocessing module: including user behavior data acquisition unit, data cleaning and filtering unit, and time series construction unit;

[0046] Model prediction module: including historical data analysis unit, deep learning model training unit, and real-time data input unit;

[0047] Abnormal behavior detection module: including abnormal detection algorithm unit, comparison unit of predicted value and actual value, and risk assessment unit;

[0048] Alarm and response module: including response strategy library unit and execution control unit;

[0049] System monitoring and maintenance module: including monitoring unit, update and maintenance unit, and security log recording unit.

[0050] Advantages of the present invention:

[0051] By using historical behavior data to construct a user behavior model, it can dynamically adapt to changes in user behavior, predict future user behavior and detect abnormal behavior. By comparing with the predicted value of the model, it can detect in real time whether the user's current behavior is abnormal, and give an alarm and response according to the degree of abnormality. It is applicable to real-time monitoring of user network activities, ensuring that the system can identify potential threats early and take protective measures, and can more accurately identify abnormal behavior based on the user's historical behavior, effectively reducing the false alarm rate and missed alarm rate. Description of the drawings

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings. Among them:

[0053] Figure 1 is the flowchart of an intelligent network security protection method proposed by the present invention;

[0054] Figure 2 is the architecture diagram of an intelligent network security protection system proposed by the present invention. Detailed implementation manners

[0055] In order to make the above objects, features and advantages of the present invention more obvious and understandable, the detailed implementation manners of the present invention will be described in detail below with reference to the drawings in the specification.

[0056] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, the present invention may be practiced in other ways than those specifically described herein, and those skilled in the art can make similar extensions without departing from the spirit of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0057] Secondly, as used herein, "an embodiment" or "embodiments" refer to specific features, structures, or characteristics that may be included in at least one implementation of the present invention. The appearances of "in one embodiment" in different places in this specification do not all refer to the same embodiment, nor are they separate or alternative embodiments that are mutually exclusive of other embodiments.

[0058] Referring Figure 1-2 , the present invention provides an intelligent network security protection method, including:

[0059] S1. Data collection and preprocessing: Collect the behavior data of users, including but not limited to login time, operation frequency, accessed resources, etc., and perform preprocessing on the data, including normalization, denoising, and feature extraction. The continuously valued features in time constitute the input sequence X = {1, x2,..., x T};

[0060] S2. Model prediction: Use historical behavior data to train a deep learning model to generate predicted values for each time step of the user based on the collected data;

[0061] S3. Abnormal behavior detection: Identify abnormal behaviors according to the collected data through an anomaly detection algorithm;

[0062] S4. Alarm and response: When an abnormal behavior is detected, send an alarm to notify the administrator, and start an automatic response mechanism to take certain measures, such as isolating suspicious accounts and restricting access permissions;

[0063] S5. System monitoring and maintenance: Continuously monitor to ensure the stability and security of the system, and regularly update and maintain the model to ensure that it can adapt to new user behavior patterns and attack strategies.

[0064] Among them, the deep learning model trained with historical behavior data is an LSTM model, which includes an input layer, a forgetting layer, and an output layer.

[0065] Furthermore, the forgetting gate includes a forgetting layer, and its calculation formula is as follows:

[0066] f t = σ(W f ·[h t-1 , x t +b f )

[0067] Where Wf is the weight matrix of the forget gate; h t-1 is the hidden state at the previous time step; x t is the input at the current time step; b f is the bias of the forget gate; σ is the activation function, which is the Sigmoid function. The forget gate determines how much of the memory cell state from the previous time step should be retained.

[0068] Furthermore, the input gate updates the memory cell state, which includes an input layer, a candidate memory cell state, and an updated memory cell state. Its calculation formula is as follows:

[0069] Input gate: i t = σ(W i · [h t-1 , x t + b i );

[0070] Candidate memory cell state:

[0071] Updated memory cell state:

[0072] where W i is the weight matrix of the input gate; W C is the weight matrix of the candidate memory cell; b i , b C are both bias terms; C t-1 is the memory cell state at the previous time step, which updates the current memory cell state and stores the user's behavior pattern.

[0073] Furthermore, the output gate determines the output of the hidden state, and the hidden state is used to be passed to the next time step. Its calculation formula is as follows:

[0074] Output layer: o t = σ(W o · [h t-1 , x t + b o );

[0075] Hidden state: h t = o t · tanh(C t );

[0076] where W o is the weight matrix of the output gate; h t is the hidden state at the current time step; tanh(C t ) performs a non-linear transformation on the memory cell state; b ois the bias term of the output layer, and the hidden state h of the current time step is generated through the output layer t , which is used as the output for predicting the behavior pattern.

[0077] Furthermore, the specific calculation formula for the predicted value of the user at each time step is as follows:

[0078]

[0079] where W h is the weight matrix mapped to the predicted output; b h is the bias term mapped to the predicted output.

[0080] Furthermore, the specific calculation formula for the anomaly detection algorithm is as follows:

[0081]

[0082] where λ is the decay coefficient, which controls the influence of the past time period on the current time point; τ is the time variable, representing the span from the starting time t0 to t, and is used to represent the change in the behavior pattern within the past time period; h i (τ) is the hidden state of the LSTM model at time step t, and different i correspond to different behavior characteristics; σ i is the standard deviation of behavior characteristic i, which is used to normalize the hidden state h i (τ) to eliminate the magnitude difference between different characteristics; Φ(τ) is the time weight function, which represents the importance of the current behavior characteristic at time point τ; N is the number of characteristics in the LSTM model, that is, the dimension of the behavior characteristics extracted by the model; B(t) is the user behavior pattern function, representing the overall behavior trend, as a function of time t; M is the number of behavior characteristics used for calculating the behavior acceleration, representing the number of characteristics involved in the analysis of the behavior change rate; α is the adjustment parameter.

[0083] Furthermore, the difference between the calculation formula A(t) of the anomaly detection algorithm and the predicted value of the user at each time step is specifically divided as follows:

[0084] △A(t) = 0, which is a normal behavior state, indicating that the user's behavior pattern is stable and there is no significant fluctuation in the behavior pattern compared with the past, belonging to the normal behavior range;

[0085] 0 ≤ △A(t) < ∈1, which is a mild abnormal behavior, indicating that the user's behavior pattern fluctuates slightly, and there may be unintentional anomalies or sporadic behaviors;

[0086] ∈1 ≤ △A(t) < ∈2, which is a moderate abnormal behavior, indicating that the user's behavior has changed significantly in this interval, and there may be suspicious operations or misoperations;

[0087] ∈2 ≤ △A(t) < ∈3 indicates a serious abnormal behavior. The user's behavior significantly deviates from the normal pattern, and there is a high probability of a security threat.

[0088] △A(t) ≥ ∈3 represents an extremely abnormal behavior. The user's behavior is extremely abnormal, and the system highly suspects malicious behavior, which may be malicious operations such as hacker attacks and identity theft. (The specific results calculated by △A(t) are used to classify the behavior level. ∈1 can be set based on the behavior variance in the past period, ∈1 = k1·Var(h t ) where k1 is an empirical coefficient. ∈2 can be defined according to the suspicious behavior samples in historical data, ∈2 = k2·Var(h t ) where k2 > k1. The threshold ∈3 is set relatively high, ∈3 = k3·Var(h t ) where k3 > k2.

[0089] Furthermore, the specific corresponding measures for each level of △A(t) are as follows:

[0090] Normal behavior state: No additional measures are required, only the user's behavior data is recorded.

[0091] Mild abnormal behavior: Remind the user to let the user know that the system has detected a slight anomaly.

[0092] Moderate abnormal behavior: Send a security reminder to the user, suggest confirming the current operation and restricting some key functions such as account modification and payment behavior, and perform multi-factor authentication until security is confirmed.

[0093] Serious abnormal behavior: Trigger a serious security protection mechanism, restrict key operations such as account freezing and transaction freezing, and force the user to perform a comprehensive identity verification.

[0094] Extremely abnormal behavior: Activate the highest-level security mechanism, immediately freeze the account and issue a warning to the user, and wait for further operations from the user and the administrator.

[0095] This embodiment also provides an intelligent network security protection system, which specifically includes:

[0096] Data collection and preprocessing module: It includes a user behavior data collection unit, a data cleaning and filtering unit, and a time series construction unit.

[0097] Model prediction module: It includes a historical data analysis unit, a deep learning model training unit, and a real-time data input unit.

[0098] Abnormal behavior detection module: It includes an abnormal detection algorithm unit, a comparison unit of predicted value and actual value, and a risk assessment unit.

[0099] Alarm and Response Module: It includes a response policy library unit and an execution control unit;

[0100] System Monitoring and Maintenance Module: It includes a monitoring unit, an update and maintenance unit, and a security log recording unit. Through modular design, it ensures that it can effectively detect and respond to abnormal user behaviors and protect network security. Each module is closely connected, and the data flow forms a closed loop from collection to response, ensuring that the system can timely and effectively prevent potential network security threats.

[0101] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

Claims

1. An intelligent network security protection method, characterized in that: Including: S1. Data collection and preprocessing: Collect the user's behavior data and preprocess the data. The continuously valued features over time form the input sequence ; S2. Model Prediction: Use historical behavior data to train a deep learning model to generate predicted values for each time step of the user based on the collected data ; S3. Abnormal behavior detection: Detect abnormal behavior based on the collected data through abnormal detection algorithms Identify abnormal behavior; S4, Alarm and Response: When detecting abnormal behavior, an alarm is sent to notify the management staff, and an automatic response mechanism is initiated to take certain measures. S5, System Monitoring and Maintenance: Continuously monitor to ensure the stability and security of the system, and regularly update and maintain the model. The specific calculation formula of the abnormal detection algorithm is as follows: where is the attenuation coefficient; is the time variable, representing the span from the actual time to ; is the hidden state of the LSTM model at time step , and different correspond to different behavioral characteristics; is the standard deviation of the behavioral characteristic ; is the time weight function; is the number of features in the LSTM model; is the user behavior pattern function, representing the overall behavior trend, as a function of time ; is the number of behavioral characteristics used for calculating behavioral acceleration; is the adjustment parameter; The calculation formula of the anomaly detection algorithm The difference from the predicted value of the user at each time step is specifically divided into the following value ranges: , is the normal behavior state. The user behavior pattern is stable, and there is no significant fluctuation compared with the past, belonging to the normal behavior range; , which is a mild abnormal behavior with slight fluctuations in the user's behavior pattern; , which is moderately abnormal behavior. This interval indicates a significant change in the user's behavior; , which is a serious abnormal behavior, indicates that the user's behavior significantly deviates from the normal pattern; , which is extremely abnormal behavior, and the user's behavior is extremely abnormal.

2. The intelligent network security protection method according to claim 1, wherein: The historical behavior data is used to train a deep learning model, which is an LSTM model, including an input gate, a forget gate, and an output gate.

3. The intelligent network security protection method according to claim 2, wherein: The forget gate includes a forget layer, and its calculation formula is as follows: where is the weight matrix of the forget gate; is the hidden state at the previous time step; is the input at the current time step; is the bias of the forget gate; is the activation function.

4. An intelligent network security protection method according to claim 3, characterized in that: The input gate updates the memory cell state, including an input layer, a candidate memory cell state, and an updated memory cell state, and its calculation formula is as follows: Input gate: ; Candidate memory cell state: Update the state of the memory cell: wherein is the weight matrix of the input gate; is the weight matrix of the candidate memory cell; , are both bias terms; is the state of the memory cell at the previous time step.

5. The intelligent network security protection method according to claim 4, characterized in that: The output gate determines the output of the hidden state, and the hidden state is used to be passed to the next time step, and its calculation formula is as follows: Output layer: ; Hidden state: ; where is the weight matrix of the output gate; is the hidden state at the current time step; performs a non-linear transformation on the memory cell state; is the bias term of the output layer.

6. An intelligent network security protection method according to claim 5, characterized in that: The specific calculation formula of the predicted value of the user at each time step is as follows: Among them The weight matrix mapped to the predicted output; Is the bias term mapped to the predicted output.

7. An intelligent network security protection method according to claim 6, characterized in that: The Specific corresponding measures for each level are as follows: Normal Behavior State: No additional measures are required, only the behavior data is recorded. Mild Abnormal Behavior: Remind the user to let the user know that the system has detected a slight abnormality. Moderate Abnormal Behavior: Send a security reminder to the user, recommend confirming the current operation and restricting some key functions, and perform multi-factor authentication until security is confirmed. Severe Abnormal Behavior: Trigger a severe security protection mechanism, restrict critical operations, and force the user to perform a full authentication. Extremely Abnormal Behavior: Activate the highest-level security mechanism, immediately freeze the account and issue a warning to the user, waiting for further operations from the user and the administrator.

8. An intelligent network security protection system, based on the intelligent network security protection method according to any one of claims 1-7, characterized in that: Specifically including: Data Acquisition and Preprocessing Module: Includes a user behavior data acquisition unit, a data cleaning and filtering unit, and a time series construction unit. Model Prediction Module: Includes a historical data analysis unit, a deep learning model training unit, and a real-time data input unit. Abnormal Behavior Detection Module: Includes an abnormal detection algorithm unit, a comparison unit for predicted value and actual value, and a risk assessment unit. Alarm and Response Module: Includes a response strategy library unit and an execution control unit. System Monitoring and Maintenance Module: Includes a monitoring unit, an update and maintenance unit, and a security log recording unit.

Images