A network anomaly detection method, device, model training method and electronic equipment

Abstract

The present invention relates to a network anomaly detection method, device, model training method and electronic device, and belongs to the field of computer technology. The method includes: obtaining a network traffic data set to be detected; preprocessing the data in the network traffic data set to be detected to obtain a first data set; extracting features from the first data set to obtain a first feature set; fusing features of the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; inputting the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result. The present application provides more comprehensive and richer information for network anomaly detection by fusing features of different aspects of the data in the network traffic data set to be detected; and then using a multi-scale anomaly detection neural network to capture the details and features of abnormal behaviors at different scales on the fused feature set, thereby improving the accuracy of anomaly detection.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a network anomaly detection method, device, model training method and electronic equipment. Background Art

[0002] With the rapid development of Internet technology, the network has become an indispensable part of modern society. However, the popularity of the network has also brought many security issues, especially network intrusion, which not only threatens the security of personal privacy and corporate data, but also may pose a threat to national security. Therefore, developing effective network intrusion detection methods is crucial to maintaining network security.

[0003] Today, traditional network intrusion detection systems (IDS) mainly include signature detection methods that rely on signature matching technology; abnormal behavior is identified by comparing network traffic with signatures of known attack patterns; abnormal detection methods that establish a normal network behavior model and regard behaviors that deviate from the model as potential threats; detection methods that use statistical principles to analyze the characteristic distribution of network traffic and identify statistical analysis of abnormal patterns; and detection methods based on machine learning, etc. However, these methods have problems such as low data processing efficiency and high false alarm rate. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a network anomaly detection method, device, model training method and electronic device to improve the problems of low data processing efficiency and high false alarm rate in current network intrusion detection methods.

[0005] The embodiment of the present application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a network anomaly detection method, comprising: obtaining a network traffic data set to be detected; preprocessing data in the network traffic data set to be detected to obtain a first data set; extracting features from the first data set to obtain a first feature set;

[0007] Performing feature fusion on the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; inputting the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result.

[0008] In the above embodiment, preprocessing the data in the network traffic data set to be detected can remove noise and irrelevant information, reduce the complexity of the data, and make subsequent feature extraction and anomaly detection more efficient; then extracting and fusing the preprocessed data set can more accurately capture the abnormal pattern in the network traffic, especially feature fusion, which can analyze the network traffic from multiple perspectives by combining time series features and interactive features (such as topological features), which helps to distinguish normal traffic from abnormal traffic, so that the multi-scale anomaly detection neural network can better adapt to different network environments and attack modes, and more comprehensively understand and analyze network traffic, thereby improving the stability, effectiveness and accuracy of detection. Using a multi-scale anomaly detection neural network to perform anomaly detection on the fused feature set can capture the details and features of the abnormal pattern at different scales, and by fusing multi-scale information, provide more comprehensive and rich information for anomaly detection, thereby improving the accuracy of detection.

[0009] In combination with the first aspect embodiment, in a possible implementation manner, obtaining the network traffic data set to be detected includes: sampling the data of the network nodes according to a preset security policy to obtain a first network traffic data set, wherein the preset security policy is used to adjust the frequency and range of sampling; removing irrelevant data in the first network traffic data set to obtain the network traffic data set to be detected.

[0010] In the above embodiment, the sampling frequency and range are adjusted according to the preset security policy, and sampling can be performed for specific network nodes and behavior patterns, reducing unnecessary data collection and avoiding full analysis of all network traffic, thereby improving the efficiency of network anomaly detection; the preset security policy can be combined with a variety of matching conditions, such as users, terminal devices, time periods, etc., to more accurately identify potential threats and abnormal behaviors, and the preset security policy can be continuously updated to adapt to new network environment changes to ensure the timeliness and effectiveness of detection. Removing irrelevant data from the first network traffic data set can reduce the complexity and redundancy of the data, and can also help identify and filter out normal traffic that does not conform to the abnormal pattern, thereby improving the accuracy and efficiency of detection.

[0011] In combination with the first aspect embodiment, in a possible implementation manner, the data in the network traffic data set to be detected is preprocessed to obtain a first data set, including: performing data cleaning and unified tensor format conversion on the data in the network traffic data set to be detected in sequence to obtain a unified data set; and detecting and correcting outliers in the unified data set to obtain the first data set.

[0012] In the above embodiment, data cleaning is performed on the data in the network traffic data set to be detected, which can remove noise, duplicate data, abnormal data, irrelevant data, etc., thereby improving data quality and ensuring that the data in the network traffic data set to be detected is clean and consistent; converting the data into a unified tensor format can ensure the consistency and efficiency of the data in the entire anomaly detection, thereby improving the efficiency of detection. Outlier detection and correction can prevent the model from being affected by abnormal data, improve the generalization ability of the model, and thus improve the accuracy of detection.

[0013] In combination with the embodiment of the first aspect, in a possible implementation manner, feature extraction is performed on the first data set to obtain a first feature set, including: expanding the data of rare attack samples in the first data set to obtain an expanded first data set; feature extraction is performed on the expanded first data set, and multi-layer nonlinear changes are performed on the extracted features to obtain the first feature set.

[0014] In the above embodiment, before extracting features from the first data set, the data of rare attack samples in the first data set is first expanded to increase the chances of the model coming into contact with rare attack samples, thereby improving the model's ability to identify rare attack samples; it can also reduce the impact of the imbalance between normal traffic and abnormal traffic, so that the model pays more attention to abnormal traffic and improves detection efficiency. After extracting features from the expanded first data set, the extracted features are subjected to multi-layer nonlinear changes, which can extract deeper features, increase the dimension and complexity of the features, thereby improving the accuracy of detection and reducing false positives and false negatives.

[0015] In combination with the first aspect embodiment, in a possible implementation manner, the feature extraction of the first data set to obtain the first feature set includes: applying a preset multi-resolution time window analysis module to perform multi-scale time series feature extraction on the first data set; applying a preset graph neural network to perform structured feature extraction on the first data set; and combining the multi-scale time series features and the structured features to form the first feature set.

[0016] In the above embodiment, multi-scale time series features can capture patterns and trends at different time scales. Extracting multi-scale time series features is conducive to identifying abnormal behaviors at different time scales, thereby improving the accuracy of detection; structured features usually contain topological information and metadata in network traffic. Extracting structured features helps the model understand the organizational structure and interrelationships of network traffic; by combining multi-scale time series features and structured features, more abundant information can be provided for anomaly detection, thereby improving the accuracy of detection.

[0017] In combination with the first aspect embodiment, in a possible implementation manner, the feature extraction of the first data set to obtain the first feature set also includes: i. extracting features from the first data set to obtain traffic statistical features, protocol behavior features and content semantic features, and fusing the traffic statistical features, the protocol behavior features and the content semantic features to obtain optimized features; and / or ii. applying a preset long short-term memory network with a self-attention mechanism to extract long-term dependency features from the time series data in the first data set, wherein the long-term dependency features are features of attack patterns or abnormal behaviors that change over time in a long time series; and the multi-scale time series features and the structured features as well as the optimized features and / or the long-term dependency features form the first feature set.

[0018] In the above embodiment, on the basis of extracting multi-scale time series features and structured features, at least one feature of optimization features and long-term dependency features can also be extracted for anomaly detection, which can provide richer and more comprehensive information and significantly improve the accuracy and efficiency of detection. Traffic statistics features usually include packet size, transmission rate, number of connections, etc. Traffic statistics features can provide a macro view of network traffic; protocol behavior features involve the usage pattern of network protocols; content semantic features focus on the semantic information of packet content; fusion of these features can provide a more comprehensive view of network traffic and capture more subtle abnormal patterns, thereby improving the accuracy of detection and reducing false positives and false negatives. Extracting long-term dependency features is conducive to identifying abnormal behaviors that show specific patterns in time series, and helps to more accurately distinguish correct traffic from abnormal traffic, thereby improving the accuracy of detection; and understanding the natural changes in network traffic during detection, reducing false positives and false negatives caused by short-term fluctuations.

[0019] In combination with the embodiment of the first aspect, in a possible implementation manner, the features in the first feature set are fused to obtain a fused feature set, including: evaluating the correlation between each feature in the first feature set and the preset abnormal behavior, selecting the features whose correlation is greater than a preset threshold, and obtaining a preliminary feature subset; fusing information of different dimensions of each feature in the preliminary feature subset to obtain a multi-dimensional fused feature set; and obtaining the fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0020] In the above embodiment, by evaluating the correlation between each feature in the first feature set and the preset abnormal behavior, and selecting the features with correlation greater than the preset threshold, the amount of data detected can be reduced and the efficiency of detection can be improved; by selecting the features with high correlation with the abnormal behavior, the essential characteristics of the abnormal behavior can be captured and the accuracy of detection can be improved. Fusion of information of different dimensions of each feature in the initial feature subset can reveal deeper correlations and complexities in the data, provide a more comprehensive data analysis perspective, and more finely distinguish normal and abnormal behaviors, thereby improving the accuracy of detection, reducing false positives and false negatives, and reducing the amount of data detected and improving the efficiency of detection.

[0021] In combination with the embodiment of the first aspect, in a possible implementation manner, the features in the first feature set are subjected to feature fusion to obtain a fused feature set, and the method further includes: using a target feature processing method to process the features in the preliminary feature subset to obtain a streamlined feature set, wherein the target feature processing method includes: at least one feature processing method of feature iterative elimination, feature importance evaluation, and feature weight adjustment; fusing information of different dimensions of each feature in the streamlined feature set to obtain the multi-dimensional fused feature set; and obtaining the fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0022] In the above embodiment, before the features are fused, the target features are iteratively eliminated to reduce the risk of overfitting, and the least important features are iteratively deleted through reverse selection to improve the efficiency of detection. Through feature importance evaluation and weight adjustment, more focus can be placed on the features that best reflect abnormal behavior during anomaly detection, thereby improving the accuracy of anomaly detection.

[0023] In combination with the first aspect embodiment, in a possible implementation, the method also includes: applying a preset feature knowledge graph to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fusion feature set, and adding them to the fusion feature set, wherein the long-term dependency relationship is the relationship between the attack mode or abnormal behavior changing over time in a long time series.

[0024] In the above embodiment, the semantic relationship and long-term dependency relationship between each feature are extracted to provide more comprehensive information, thereby improving the accuracy of detection; using the fused features and the semantic relationship and long-term dependency relationship between each fused feature as the input of anomaly detection can timely identify and respond to potential attacks during detection, thereby improving the efficiency of detection.

[0025] In combination with the first aspect embodiment, in a possible implementation, the preset multi-scale anomaly detection neural network includes a multi-channel convolutional neural network, a dynamic routing capsule network and a multi-task learning framework, and the fused feature set is input into the preset multi-scale anomaly detection neural network to obtain a first anomaly detection result, including: applying the multi-channel convolutional neural network to perform weighted processing on the features in the fused feature set to obtain an attention weighted feature set; applying the dynamic routing capsule network to perform hierarchical relationship modeling on each feature in the attention weighted feature set to obtain a structured feature set; applying the multi-task learning framework to perform anomaly detection, attack classification and anomaly degree estimation analysis on the structured feature set to obtain a first anomaly detection result.

[0026] In the above embodiment, when performing anomaly detection on the fused features, weighting the features in the fused feature set first can highlight the features that contribute more to anomaly detection and improve the accuracy of detection; after obtaining the attention weighted feature set, hierarchical relationship modeling is performed on the features in the attention weighted feature set, which can handle the complex nonlinear relationship between features and help improve the accuracy of detection. Anomaly detection is used to distinguish normal traffic from abnormal traffic and accurately identify abnormal phenomena in network traffic; attack classification is used to classify abnormal traffic and identify the specific type of attack; abnormality degree analysis is used to estimate the abnormality degree of abnormal traffic. Through anomaly detection, attack classification and abnormality degree estimation analysis, network attack behavior can be effectively identified and the accuracy of detection can be significantly improved.

[0027] In combination with the first aspect embodiment, in a possible implementation, the multi-channel convolutional neural network is applied to perform weighted processing on the features in the fused feature set to obtain an attention-weighted feature set, including: inputting the features in the fused feature set into the channel corresponding to the multi-channel convolutional neural network according to a preset feature type; applying the multi-channel convolutional neural network to extract the features in each of the channels to obtain a primary feature set for each channel; applying the attention mechanism in the multi-channel convolutional neural network to adjust the importance weights corresponding to the primary feature set of each channel, and performing weighted summation according to the importance weights and the corresponding channel positions to obtain the attention-weighted feature set.

[0028] In the above embodiment, the multi-channel convolutional neural network can extract features from different angles and capture complex patterns and structures in the data, so as to more comprehensively understand the normal and abnormal behaviors in the network traffic during detection and improve the accuracy of detection; the attention mechanism can pay more attention to those features that are more critical to anomaly detection, thereby improving the accuracy of detection.

[0029] In combination with the first aspect embodiment, in a possible implementation, the method also includes: applying a preset graph database to perform attack path restoration and attack target prediction on the first anomaly detection result and the anomaly data in the second anomaly detection result to obtain an attack chain analysis report, wherein the second anomaly detection result is a detection result obtained by detecting the network traffic data set to be detected according to preset rules; performing text conversion on the first anomaly detection result, the second anomaly detection result and the attack chain analysis report to obtain an anomaly detection report.

[0030] In the above embodiments, attack path restoration and attack target prediction of abnormal data can quickly respond to network intrusion events and improve the efficiency of handling network intrusion events; attack path restoration provides a detailed process of the attack, improves the transparency and traceability of network attack events; and by predicting the attack target, it helps to take measures in advance to prevent network intrusion. The first anomaly detection result, the second anomaly detection result, and the attack chain analysis report are converted into text, and the technical data is converted into a language that is easy for network security personnel to understand, which improves the readability of the report and enables network security personnel to quickly identify network intrusion behaviors and take actions.

[0031] In a second aspect, an embodiment of the present application provides a network anomaly detection model training method, including: obtaining a network traffic data training set; preprocessing the data in the network traffic data training set to obtain a first data set; performing feature extraction on the first data set to obtain a first feature set; performing feature fusion on the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; and using the fused feature set to train a multi-scale anomaly detection neural network to obtain a multi-scale anomaly detection neural network.

[0032] In a third aspect, an embodiment of the present application provides a network anomaly detection device, including: a data acquisition module, a data preprocessing module, a feature extraction module, a feature fusion module and a network anomaly detection module; the data acquisition module is used to acquire a network traffic data set to be detected; the data preprocessing module is used to preprocess the data in the network traffic data set to be detected to obtain a first data set; the feature extraction module is used to extract features from the first data set to obtain a first feature set; the feature fusion module is used to fuse features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; the network anomaly detection module is used to input the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result.

[0033] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, the memory being connected to the processor; the memory being used to store programs; and the processor being used to call the programs stored in the memory to execute the method provided by the above-mentioned first aspect embodiment and / or any one of the implementation modes in combination with the first aspect embodiment, or the method provided by the above-mentioned second aspect embodiment.

[0034] Other features and advantages of the present application will be described in the following description. The purpose and other advantages of the present application can be realized and obtained through the structures specifically pointed out in the written description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings. The above and other purposes, features and advantages of the present application will be more clearly shown in the drawings.

[0036] Figure 1 A flow chart of a network anomaly detection method provided in an embodiment of the present application is shown.

[0037] Figure 2 A flow chart of another network anomaly detection method provided in an embodiment of the present application is shown.

[0038] Figure 3 A flow chart of a network anomaly detection model training method provided in an embodiment of the present application is shown.

[0039] Figure 4 A module schematic diagram of a network anomaly detection device provided in an embodiment of the present application is shown.

[0040] Figure 5 A module schematic diagram of another network anomaly detection device provided in an embodiment of the present application is shown.

[0041] Figure 6 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The following embodiments can be used as examples to more clearly illustrate the technical solutions of the present application, and cannot be used to limit the scope of protection of the present application. It will be appreciated by those skilled in the art that, in the absence of conflict, the features in the following embodiments and embodiments can be combined with each other.

[0043] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of this application, relational terms such as "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0044] Furthermore, the term "and / or" in this application is merely a term used to describe the association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B may represent three situations: A exists alone, A and B exist at the same time, and B exists alone.

[0045] The embodiment of the present application provides a network anomaly detection method, which obtains a fused feature set by preprocessing, feature extraction, and feature fusion of the data in the network traffic data set to be detected, and then uses a multi-scale anomaly detection neural network to capture the details and features of abnormal behaviors at different scales on the fused feature set, thereby improving the accuracy of anomaly detection. Among them, noise, irrelevant data, and duplicate data in the data are removed by preprocessing, reducing data redundancy. Through feature fusion, the network traffic data is analyzed from multiple perspectives, and the features of different aspects of the network traffic data are integrated, providing more comprehensive and richer information for network anomaly detection.

[0046] For ease of understanding, the following Figure 1 The flowchart shown illustrates the principle of the network anomaly detection method provided in the embodiment of the present application. The network anomaly detection method provided in the embodiment of the present application comprises the following steps:

[0047] Step S100: Obtain a network traffic data set to be detected.

[0048] In a possible implementation, obtaining a network traffic data set to be detected includes: sampling data of a network node according to a preset security policy to obtain a first network traffic data set, and then removing irrelevant data from the first network traffic data set to obtain a network traffic data set to be detected. The preset security policy is used to adjust the frequency and range of sampling.

[0049] In the above embodiment, by updating the security policy to adjust the frequency and range of sampling, it is possible to adapt to different application scenarios, reduce unnecessary data collection, and sample specific network nodes and behavior patterns, which can improve the efficiency of data processing and the accuracy of detection. Removing irrelevant data from the first network traffic data set can reduce the complexity and redundancy of the data and improve the efficiency and accuracy of detection.

[0050] The collected data may be data from the same source or data from different sources. If the collected data are data from different sources, the data types of the data may be different, that is, the data structure, storage format, access method, etc. of the data may be different.

[0051] In one possible implementation, if the collected data is from different sources, time synchronization technology needs to be applied to the collected data to synchronize the data and ensure the time consistency of the collected data. For example, a high-precision time synchronization protocol, such as the IEEE 1588 standard (IEEE 1588 Precision Clock Synchronization Protocol, a precision clock synchronization protocol standard for network measurement and control systems), can be used to implement sub-microsecond time calibration of the collected data, so that the data collected by each network node can be accurately timestamped, thereby ensuring the time consistency of the data.

[0052] The accuracy of time synchronization can be quantified by the following formula:

[0053]

[0054] In the above formula, ClockPrecision represents the accuracy of the clock, TimeUnit represents the time unit of time synchronization, and SyncAccuracy represents the accuracy of time synchronization between different nodes.

[0055] In the above embodiments, network nodes include network key nodes and non-network key nodes. Network key nodes refer to nodes with important status and influence in complex networks, such as servers, gateways, data centers, etc.; non-network key nodes refer to nodes that will not cause significant changes in system functions or structures after being deleted or destroyed in the network. And the data of network nodes can be sampled using methods such as reconfigurable FPGA data acquisition probes, high-speed network packet capture software, and Thunderbolt interface data transmission technology.

[0056] The preset security policy is used to adjust the frequency and range of sampling. In the embodiment of the present application, software-defined networking (SDN) technology can be used to adjust the frequency and range of sampling. SDN can dynamically adjust the frequency and range of data collection according to the characteristics of real-time network traffic and preset security policies. The formula corresponding to the dynamic adjustment of the sampling frequency and range by SDN is:

[0057] SamplingRate= (TrafficVolume, TrafficVariation, SecurityPolicy)

[0058] In the above formula, It is a function that takes into account the traffic volume, traffic change rate, and security policy, and is used to dynamically adjust the sampling rate; TrafficVolume represents the size or amount of network traffic; TrafficVariation represents the degree or rate of change of network traffic; SecurityPolicy represents the currently applied security policy. For example, when an abnormal peak in network traffic is detected, SDN increases the sampling rate to capture more data.

[0059] Step S200: pre-processing the data in the network traffic data set to be detected to obtain a first data set.

[0060] In one possible implementation, the data in the network traffic data set to be detected are preprocessed to obtain a first data set, including: sequentially performing data cleaning and unified tensor format conversion on the data in the network traffic data set to be detected to obtain a unified data set; and detecting and correcting outliers in the unified data set to obtain the first data set. By sequentially performing data cleaning, unified tensor format conversion, and outlier detection and correction on the data in the network traffic data set to be detected, noise, duplicate data, abnormal data, irrelevant data, etc. can be removed to ensure data consistency and avoid being affected by abnormal data during detection, thereby improving the accuracy of anomaly detection.

[0061] In one possible implementation, preprocessing the data in the network traffic data set to be detected to obtain the first data set may only include: sequentially performing data cleaning and unified tensor format conversion on the data in the network traffic data set to be detected to obtain the first data set.

[0062] In the above embodiment, data cleaning may include noise removal, duplicate data elimination, protocol parsing and other processes. Data cleaning of the data in the network traffic data set to be detected includes at least one of noise removal, duplicate data elimination and protocol parsing. For example, digital signal processing technology (low-pass filter, band-stop filter, band-pass filter, etc.) can be used to remove high-frequency noise in the time series data in the network traffic data set to be detected; hash functions and data indexing technology can be used to identify and remove duplicate data packets; protocol analysis tools can be used to analyze the data and extract key information from the data, such as source IP, port number, protocol type, etc. Through data cleaning, errors and inconsistencies in the data can be identified and corrected to improve the quality of the data, thereby improving the accuracy of network anomaly detection.

[0063] The cleaned data is standardized and converted into a unified tensor format to ensure the numerical consistency of the data. The minimum-maximum normalization method can be used to standardize the cleaned data.

[0064] In the above embodiment, a distributed data quality assessment system can be applied to detect and correct outliers in a unified data set. The system can automatically detect outliers or inconsistencies in a data set and correct them. For example, the Z-Score method is used in the system to identify statistical outliers and correct outliers through appropriate digital correction methods, such as mean regression or truncation. The Z-Score formula is:

[0065]

[0066] In the above formula, Z is the Z-Score, x is the data point, μ is the mean of the data set, and σ is the standard deviation. When performing outlier detection, if the Z-Score of a data point exceeds a preset threshold (such as 3 or -3), it may be considered an outlier.

[0067] Step S300: extracting features from a first data set to obtain a first feature set.

[0068] In the above step S300, when performing feature extraction on the first data set, feature extraction can be performed directly, or the data of rare attack samples in the first data set can be expanded first and then feature extraction can be performed. This can increase the data of rare attack samples, increase the chances of the rare attack sample data coming into contact with the network anomaly detection model, and reduce the impact of the category imbalance between normal traffic and abnormal traffic (because normal traffic usually accounts for a larger proportion, while abnormal traffic accounts for a smaller proportion), thereby improving the accuracy of anomaly detection.

[0069] In one implementation manner, feature extraction is performed on the first data set to obtain a first feature set, including:

[0070] The data of the rare attack samples in the first data set are expanded to obtain an expanded first data set; features are extracted from the expanded first data set, and multi-layer nonlinear changes are performed on the extracted features to obtain a first feature set.

[0071] In the above embodiment, a variational autoencoder can be applied to expand the data of rare attack samples. The variational autoencoder consists of an encoder and a decoder, which can generate new data points to expand the data of rare attack samples. The reparameterization technique of the variational autoencoder can randomly sample new encoding values ​​from the latent space, and generate new samples that are similar to but not exactly the same as the original data distribution through the decoder. This generation method not only retains the key features of the original data, but also introduces new changes and combinations, making the generated samples more diverse. The reparameterization technique can be expressed as:

[0072]

[0073] In the above formula, is the encoded latent variable, and are the mean and log-variance of the latent space, is the reconstructed input, Encoder and Decoder are the encoder and decoder networks of the variational autoencoder, respectively, and x is the data before sample enhancement.

[0074] In the above embodiment, a hierarchical feature combination module can be applied to perform multi-layer nonlinear changes on the extracted features, learn high-order interactions between features, and extract richer and more abstract features. These features can capture complex patterns and potential abnormal behaviors in network traffic, thereby providing more comprehensive information for network anomaly detection and improving detection accuracy. Among them, the hierarchical feature combination module generally refers to the combination of features in a deep learning model by stacking multiple levels of fully connected layers (also called dense layers or linear layers) and activation functions. The formula corresponding to the process of applying the hierarchical feature combination module to perform multi-layer nonlinear changes on the extracted features is:

[0075]

[0076] In the above formula, is the enhanced feature set; and are the weights and biases of the fully connected layer; Activation is the activation function, such as ReLU (Rectified Linear Unit) or Sigmoid (S-type function); are the features extracted previously.

[0077] In the above step S300, when extracting features from the first data set, the extracted features may include only multi-scale temporal features and structured features; in some implementations, the extracted features may include both multi-scale temporal features and structured features, and optimization features; in some implementations, the extracted features may include both multi-scale temporal features and structured features, and long-term dependency features; in some other implementations, the extracted features may include both multi-scale temporal features and structured features, and optimization features and long-term dependency features. The specific feature extraction method is as follows:

[0078] In one implementation, feature extraction is performed on a first data set to obtain a first feature set, including: applying a preset multi-resolution time window analysis module to perform multi-scale time series feature extraction on the first data set; applying a preset graph neural network to perform structured feature extraction on the first data set; and combining multi-scale time series features and structured features into a first feature set.

[0079] In one implementation, after extracting multi-scale time series features and structured features, at least one of the following feature extractions may be performed: i. Extracting features from the first data set to obtain traffic statistics features, protocol behavior features, and content semantic features, and fusing the traffic statistics features, protocol behavior features, and content semantic features to obtain optimized features; ii. Applying a preset long short-term memory network with a self-attention mechanism to extract long-term dependency features from the time series data in the first data set, wherein the long-term dependency features are features of the change of attack patterns or abnormal behaviors over time in a long time series. The obtained optimized features and / or long-term dependency features are combined with the multi-scale time series features and structured features to form a first feature set.

[0080] In the above embodiment, applying a preset multi-resolution time window analysis module to extract multi-scale time series features refers to applying a multi-resolution time window analysis module to capture traffic patterns at different time scales. This module can sample the first data set by setting time windows of different sizes, and extract traffic change features from the sampled data in each time window to obtain multi-scale time series features. The multi-resolution time window analysis module can extract multi-scale time series features using methods such as wavelet transform, Fourier transform, and time series decomposition. For example, when using wavelet transform to perform multi-scale decomposition on the data in the first data set, the formula corresponding to capturing traffic changes at different time frequencies is:

[0081]

[0082] In the above formula, are the coefficients of the wavelet transform, is the original signal, is a wavelet function, a and b are scale and location parameters respectively. By adjusting a and b, traffic patterns can be analyzed at different time and frequency scales.

[0083] In the above embodiment, the structured features are obtained by processing the network topology information in the first data set using a preset graph neural network. The graph neural network extracts structured features through the connection relationship between nodes. The key mechanism in the graph neural network, the graph convolution operation, enables the network to learn high-level feature representations of nodes, which encode the attribute information of the nodes and the structural information of the graph. In this way, the graph neural network can effectively process and analyze graph structure data. The mathematical formula corresponding to the graph convolution operation is expressed as:

[0084]

[0085] In the above formula, It is The node characteristics of the layer, is the adjacency matrix, is the degree matrix, is the weight matrix, is the activation function. In this way, the complex relationship between nodes and edges in the network can be captured, where nodes usually represent devices in the network (such as servers and routers) and edges represent connections or interactions between devices.

[0086] In the above embodiment, feature extraction is performed on the first data set to obtain traffic statistical features, protocol behavior features and content semantic features, and the traffic statistical features, protocol behavior features and content semantic features are integrated to obtain the optimized features. The specific process is as follows: first, feature extraction is performed on the first data set to obtain traffic statistical features, protocol behavior features and content semantic features; second, each type of feature is standardized to ensure that features of different scales can be compared fairly; third, PCA (Principal Component Analysis) is applied to each type of standardized features to reduce the dimension of the data and extract the main components, and an integration method such as a random forest or a gradient boosting tree is used to evaluate the importance of each type of feature, and then a weight is assigned to each type of feature according to the feature importance evaluation result, and then the weighted features are merged to form a merged feature set, and then a recursive feature elimination (RFE) algorithm is applied to the merged feature set to select the most important features to obtain the optimized features.

[0087] In the above embodiment, the long-term dependency feature is the feature of the attack mode or abnormal behavior changing over time in a long time series. The long short-term memory network with self-attention mechanism can dynamically focus on the key time points in the time data, and flexibly focus on the features that are still relevant at a longer distance in the time series, thereby effectively extracting the long-term dependency feature.

[0088] Step S400: performing feature fusion on the features in the first feature set to obtain a fused feature set, wherein feature fusion includes fusing information of different dimensions of the same feature.

[0089] In one possible implementation, features in the first feature set are fused to obtain a fused feature set, including: evaluating the correlation between each feature in the first feature set and the preset abnormal behavior, selecting features whose correlation is greater than a preset threshold, and obtaining a preliminary feature subset; fusing information of different dimensions of each feature in the preliminary feature subset to obtain a multi-dimensional fused feature set; and obtaining a fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0090] In the above embodiment, the correlation between each feature and the preset abnormal behavior can be quantified by applying information gain and mutual information algorithms, so as to select features whose correlation is greater than a preset threshold. Among them, information gain is a commonly used feature selection method in decision tree algorithms, which can measure the reduction of uncertainty of features at different levels (i.e., different decision points), and can be expressed by the following formula:

[0091] Information Gain

[0092] In the above formula, It is a dataset The entropy of It is a dataset The subset of that belongs to category i, is the number of categories, and are the number of samples in the subset and the data set, respectively. The greater the information gain, the higher the correlation between feature A and the preset abnormal behavior. The mutual information algorithm evaluates the correlation between the feature and the target variable by calculating the mutual information value between them. This method can help identify features that are highly correlated with the target variable. The formula of the mutual information algorithm is:

[0093] Mutual Information

[0094] in, and The variables are and The entropy of is their joint entropy. The larger the mutual information, the closer the relationship between the feature and the target variable, that is, the larger the mutual information, the higher the correlation between the feature and the preset abnormal behavior.

[0095] In the above embodiment, a multi-view feature fusion algorithm can be applied to fuse the information of different dimensions of each feature in the preliminary feature subset, that is, comprehensively consider the information of different aspects of each feature, such as the statistical characteristics, pattern recognition, semantic information, etc. of the feature, to obtain a multi-dimensional fusion feature set. For example, by using the weighted summation method, different weights are assigned to the information of different dimensions of the same feature, and then the information of different dimensions is added to integrate the information. Among them, the weight is dynamically adjusted according to the importance of the feature and the real-time detection effect.

[0096] After obtaining the multi-dimensional fusion feature set, the first feature set and the multi-dimensional fusion feature set are combined to obtain a fusion feature set. This makes the features in the fusion feature set more comprehensive, and can enhance the capture of complex patterns and potential abnormal behaviors in network traffic during detection, thereby improving the accuracy of network anomaly detection.

[0097] In one possible implementation, after obtaining a preliminary feature subset, the features in the preliminary feature subset are processed using a target feature processing method to obtain a streamlined feature set, and then the information of different dimensions of each feature in the streamlined feature set is fused to obtain a multi-dimensional fused feature set; based on the first feature set and the multi-dimensional fused feature set, a fused feature set is obtained.

[0098] Among them, the target feature processing method includes: at least one feature processing method selected from iterative feature elimination, feature importance evaluation, and feature weight adjustment. Iterative feature elimination can iteratively optimize the features in the preliminary feature subset by applying the Recursive Feature Elimination (RFE) algorithm, recursively removing the least important features until the preset number of features or performance indicators are reached. That is, in each iteration, the RFE algorithm calculates the importance scores of all current features, and then deletes one or more features with the lowest scores. This process is repeated until the preset number of features is reached or a certain performance indicator is reached. Among them, the feature importance score is a comprehensive consideration of multiple feature importance indicators, including but not limited to information gain, mutual information, etc., to calculate the comprehensive importance score of each feature.

[0099] The feature importance evaluation can be achieved by applying an evaluation model based on Shapley value, that is, the correlation between each feature and the preset abnormal behavior is quantified by Shapley value, where the calculation formula of Shapley value is:

[0100]

[0101] In the above formula, is the feature set, is the i-th feature in the feature set, yes All possible subsets of (excluding ), is the prediction function of the model. The higher the Shapley value, the better the feature The greater the importance, the more important the feature is, thus obtaining the order of feature importance according to the Shapley value.

[0102] Feature weight adjustment is to adjust the feature weight according to the real-time evaluation results of feature performance. For example, if a feature shows high accuracy in actual detection, its weight is increased, otherwise it is reduced.

[0103] In one possible implementation, after obtaining the multidimensional fusion feature set and the first feature set, the network anomaly detection method also includes: applying a preset feature knowledge graph to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multidimensional fusion feature set, and adding them to the fusion feature set.

[0104] Among them, the long-term dependency is the relationship between the attack mode or abnormal behavior over time in a long time series. Each node in the feature knowledge graph represents a feature, and the edge represents the relationship between the features. By applying the preset feature knowledge graph to analyze each feature in the first feature set and the multi-dimensional fusion feature set, the potential connection between the features can be discovered.

[0105] Step S500: inputting the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result.

[0106] Among them, the preset multi-scale anomaly detection neural network includes a multi-channel convolutional neural network, a dynamic routing capsule network and a multi-task learning framework. In addition to the multi-channel convolutional neural network, the dynamic routing capsule network and the multi-task learning framework, the multi-scale anomaly detection neural network can also include an adaptive learning module, in which the hierarchical Boosting algorithm, concept drift detection, knowledge distillation framework, etc. can be applied to improve the performance of the multi-scale anomaly detection neural network.

[0107] In one implementation mode, the fused feature set is input into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result, including: applying a multi-channel convolutional neural network to weightedly process the features in the fused feature set to obtain an attention-weighted feature set; applying a dynamic routing capsule network to perform hierarchical relationship modeling on the features in the attention-weighted feature set to obtain a structured feature set; applying a multi-task learning framework to perform anomaly detection, attack classification, and anomaly degree estimation analysis on the structured feature set to obtain a first anomaly detection result.

[0108] In one implementation, the fused feature set is input into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result, including: applying a multi-channel convolutional neural network to weightedly process the features in the fused feature set to obtain an attention-weighted feature set; applying a multi-task learning framework to perform anomaly detection, attack classification, and anomaly degree estimation analysis on the attention-weighted feature set to obtain a first anomaly detection result.

[0109] In one implementation, a multi-channel convolutional neural network is used to perform weighted processing on the features in the fused feature set to obtain an attention-weighted feature set. The specific process is as follows: the features in the fused feature set are input into the corresponding channels of the multi-channel convolutional neural network according to preset feature types; the multi-channel convolutional neural network is used to extract the features in each channel to obtain a primary feature set for each channel; the attention mechanism in the multi-channel convolutional neural network is used to adjust the importance weights corresponding to the primary feature set of each channel, and a weighted sum is performed according to the importance weights and the positions of the corresponding channels to obtain an attention-weighted feature set.

[0110] The above attention mechanism has multiple levels, each of which works on a different time scale. The attention mechanism can focus on key information (information with relatively high weights), calculate the importance weight of each feature, and perform weighted summation based on the importance weight and the position of the corresponding channel to obtain an attention-weighted feature set. The attention weight can be calculated using the following formula:

[0111]

[0112] In the above formula, It's location The attention weight, is the original value of the feature map, It means to sum the indexed values ​​of all positions, m and n are the indices of all positions, and i and j refer specifically to the position where the attention weight is being calculated.

[0113] In one implementation, the multi-channel convolutional neural network also includes a gated skip connection structure, which can optimize the gradient flow. The gated skip connection structure is introduced to control the flow of information between different layers of the attention mechanism. The corresponding formula is:

[0114]

[0115] In the above formula, is the state of the unit, Represents the output of the current time step t, which is the final output of the gating unit and is used to pass to the next layer of the network or the next time step. represents the input at the current time step t, is the output of the previous time step, are the current input weight, the previous output weight, and the unit state weight, respectively. are the bias terms, and They are the sigmoid function and the hyperbolic tangent activation function respectively.

[0116] By applying the dynamic routing capsule network to model the hierarchical relationship of each feature in the attention weighted feature set, a structured feature set can be obtained. In the dynamic routing capsule network, the dynamic routing algorithm is used to optimize the transmission of features. The dynamic routing process is expressed by the following formula:

[0117]

[0118] In the above formula, It is from Units to The routing weight of a capsule, is the weight matrix connecting the i-th unit and the j-th capsule, It is The output vector of each unit, is the weight matrix connecting the kth low-level unit and the jth high-level capsule, is the output vector of the kth low-level unit, i and k are used to traverse the low-level units, and j represents a specific high-level capsule.

[0119] The multi-task learning framework can simultaneously perform anomaly detection, attack classification, and anomaly degree estimation analysis on the structured feature set. Among them, anomaly detection refers to determining whether the network traffic is abnormal; attack classification refers to determining what type of attack the abnormal traffic belongs to. The types of attacks include: Distributed Denial of Service (DDoS), SQL Injection, Cross-Site Scripting (XSS), buffer overflow, network scanning and detection, malware propagation, man-in-the-middle attacks, password cracking attempts, etc. Anomaly degree estimation analysis is to evaluate the abnormal degree of abnormal behavior, which is reflected by probability scores, deviation metrics, composite indicators, sorting, and grading.

[0120] Among them, the probability score refers to outputting a score between 0 and 1, indicating the possibility of traffic anomaly; the higher the score, the greater the degree of anomaly. Deviation measurement refers to calculating the degree of deviation between the observed behavior and the expected normal behavior; the greater the deviation, the greater the degree of anomaly. Composite indicators refer to combining multiple factors, such as traffic size, duration, impact range, etc., to construct a comprehensive abnormality degree indicator. Sorting refers to sorting among all detected abnormal behaviors. Grading refers to dividing the degree of anomaly into multiple levels, such as low, medium, high, and severe.

[0121] The multi-task learning framework includes a shared layer and a task-specific layer. The shared layer is used to extract common features, and the task-specific layer is used to learn features related to a specific task. For example, a layer is used to specifically learn features related to attack classification. The multi-task learning framework also involves a loss function, which can balance the contributions of different tasks by weighting to ensure that the model does not favor any one task. The loss function of the multi-task learning framework is expressed as:

[0122]

[0123] In the above formula, is the total loss, and They are the losses of anomaly detection, attack classification, and anomaly degree estimation analysis, respectively. is the corresponding weight coefficient. When applying the multi-task learning framework, the weight coefficient of the loss function is set in advance according to different websites.

[0124] like Figure 2 As shown, after obtaining the first anomaly detection result, the network anomaly detection method further includes: step S600 and step S700.

[0125] Step S600: Apply a preset graph database to restore the attack path and predict the attack target for the first anomaly detection result and the anomaly data in the second anomaly detection result to obtain an attack chain analysis report.

[0126] The second anomaly detection result is the detection result obtained by detecting the network traffic data set to be detected according to the preset rules. The preset rules are formulated based on historical security events and known attack patterns. Through these rules, such as IP blacklists and whitelists, abnormal traffic patterns, etc., the network traffic data set to be detected is initially screened to quickly identify potential abnormal behaviors.

[0127] The specific process of using the preset graph database in the above application to restore the attack path and predict the attack target for the abnormal data in the first anomaly detection result and the second anomaly detection result is as follows: the abnormal information and network entities (such as IP addresses, port numbers, etc.) in the first anomaly detection result and the second anomaly detection result are mapped to nodes and edges in the graph database to construct an attack graph. Among them, nodes represent abnormal information or network entities (such as IP addresses, port numbers, etc.), and edges represent the relationship between abnormal information or device entities. Then use the graph traversal algorithm to analyze the nodes and edges in the attack graph, determine the path that the attacker may take based on the connection relationship between the nodes, and restore the attack path; use graph analysis techniques, such as community detection or centrality analysis, to identify key nodes in the attack graph, which may represent the attacker's ultimate goal, so as to predict the attack target, and combine the results of attack path restoration and attack target prediction obtained by the above operations to form an attack chain analysis report.

[0128] Step S700: The first anomaly detection result, the second anomaly detection result, and the attack chain analysis report are converted into text to obtain an anomaly detection report.

[0129] Using natural language processing technology, the first anomaly detection result, the second anomaly detection result and the attack chain analysis report are converted into text, and the technical data is converted into easy-to-understand language to obtain an anomaly detection report. The anomaly detection report includes information such as abnormal behavior description, attack path, and attack target prediction.

[0130] The present application also provides a network anomaly detection model training method. Figure 3 The flowchart shown illustrates the network anomaly detection model training method.

[0131] Step S10: Obtain a network traffic data training set.

[0132] In the above step S10, the specific process of obtaining the network traffic data training set is: according to the preset security policy, the data of the network node is sampled to obtain the first network traffic data training set,

[0133] Then, irrelevant data in the first network flow data training set is removed to obtain the network flow data training set. The preset security policy is used to adjust the frequency and range of sampling.

[0134] Step S20: pre-processing the data in the network traffic data training set to obtain a first data set.

[0135] In the above step S20, the specific process of preprocessing the data in the network traffic data training set is: performing data cleaning and unified tensor format conversion on the data in the network traffic data training set in turn to obtain a unified data set; then detecting and correcting the outliers in the unified data set to obtain a first data set.

[0136] Step S30: extracting features from the first data set to obtain a first feature set.

[0137] In the above step S30, feature extraction can be performed directly on the first data set, or the data of the rare attack samples in the first data set can be expanded before feature extraction. In one implementation, the specific process of extracting features from the first data set to obtain the first feature set is: expanding the data of the rare attack samples in the first data set to obtain the expanded first data set; extracting features from the expanded first data set, and performing multi-layer nonlinear changes on the extracted features to obtain the first feature set.

[0138] In one possible implementation, the specific process of feature extraction in the above step S30 is: applying a preset multi-resolution time window analysis module to perform multi-scale time series feature extraction on the first data set; applying a preset graph neural network to perform structured feature extraction on the first data set; and combining multi-scale time series features and structured features into a first feature set.

[0139] In one possible implementation, after extracting multi-scale time series features and structured features, the above-mentioned step S30 also includes: i. performing feature extraction on the first data set to obtain traffic statistical features, protocol behavior features and content semantic features, and fusing the traffic statistical features, protocol behavior features and content semantic features to obtain optimized features; and / or ii. applying a preset long short-term memory network with a self-attention mechanism to extract long-term dependency features of the time series data in the first data set, wherein the long-term dependency features are features of the attack mode or abnormal behavior changing over time in a long time series; and forming a first feature set with multi-scale time series features and structured features as well as optimized features and / or long-term dependency features.

[0140] Step S40: performing feature fusion on the features in the first feature set to obtain a fused feature set.

[0141] Among them, feature fusion includes fusing information of different dimensions of the same feature.

[0142] In the above step S40, the specific process of feature fusion for the features in the first feature set is: evaluate the correlation between each feature in the first feature set and the preset abnormal behavior, select the features whose correlation is greater than the preset threshold, and obtain a preliminary feature subset; fuse the information of different dimensions of each feature in the preliminary feature subset to obtain a multi-dimensional fused feature set; obtain a fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0143] In one possible implementation, the process of performing feature fusion on the features in the first feature set also includes: using a target feature processing method to process the features in the preliminary feature subset to obtain a streamlined feature set, wherein the target feature processing method includes: at least one feature processing method of feature iterative elimination, feature importance evaluation, and feature weight adjustment; at this time, the process of performing feature fusion is: fusing information of different dimensions of each feature in the streamlined feature set to obtain a multi-dimensional fused feature set; and obtaining a fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0144] In a possible implementation, after obtaining the fused feature set and the first feature set, the network anomaly detection model training method provided in the embodiment of the present application further includes: applying a preset feature knowledge graph to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fused feature set and adding them to the fused feature set. Among them, the long-term dependency relationship is the relationship between the attack mode or abnormal behavior over time in a long time series.

[0145] Step S50: training the multi-scale anomaly detection neural network to be trained using the fusion feature set to obtain a multi-scale anomaly detection neural network.

[0146] The network anomaly detection model training method provided in the embodiment of the present application has the same implementation principle and technical effects as those in the aforementioned network anomaly detection method embodiment. For the sake of brief description, for matters not mentioned in the embodiment of the network anomaly detection model training method, reference may be made to the corresponding contents in the aforementioned network anomaly detection method embodiment.

[0147] The embodiment of the present application also provides a network anomaly detection model training device, which at least includes an acquisition module, a preprocessing module, a feature extraction module, a feature fusion module, and a training module.

[0148] The acquisition module is used to obtain the network traffic data training set.

[0149] The preprocessing module is used to preprocess the data in the network flow data training set to obtain a first data set.

[0150] The feature extraction module is used to extract features from the first data set to obtain a first feature set.

[0151] The feature fusion module is used to perform feature fusion on the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature.

[0152] The training module is used to train the multi-scale anomaly detection neural network to be trained by using the fusion feature set to obtain the multi-scale anomaly detection neural network.

[0153] like Figure 4 As shown, Figure 4 The module schematic diagram of a network anomaly detection device 10 provided in an embodiment of the present application is shown. The device 10 comprises: a data acquisition module 11, a data preprocessing module 12, a feature extraction module 13, a feature fusion module 14 and a network anomaly detection module 15.

[0154] The data acquisition module 11 is used to acquire the network traffic data set to be detected.

[0155] In a possible implementation, the data acquisition module 11 is specifically used to sample the data of the network nodes according to a preset security policy to obtain a first network traffic data set; remove irrelevant data in the first network traffic data set to obtain a network traffic data set to be detected. The preset security policy is used to adjust the frequency and range of sampling.

[0156] The data preprocessing module 12 is used to preprocess the data in the network traffic data set to be detected to obtain a first data set.

[0157] In a possible implementation, the data preprocessing module 12 is specifically used to perform data cleaning and unified tensor format conversion on the data in the network traffic data set to be detected in sequence to obtain a unified data set; and detect and correct outliers in the unified data set to obtain a first data set.

[0158] The feature extraction module 13 is used to extract features from the first data set to obtain a first feature set.

[0159] In a possible implementation, the feature extraction module 13 is specifically used to expand the data of rare attack samples in the first data set to obtain an expanded first data set; perform feature extraction on the expanded first data set, and perform multi-layer nonlinear changes on the extracted features to obtain a first feature set.

[0160] Optionally, the feature extraction module 13 includes: a multi-resolution time window analysis module and a graph neural network. The feature extraction module 13 is specifically used to apply a preset multi-resolution time window analysis module to perform multi-scale time series feature extraction on the first data set; apply a preset graph neural network to perform structured feature extraction on the first data set; and combine the multi-scale time series features and the structured features into a first feature set.

[0161] In a possible implementation, the feature extraction module 13 is specifically used to extract features from the first data set to obtain traffic statistical features, protocol behavior features, and content semantic features, and to fuse the traffic statistical features, protocol behavior features, and content semantic features to obtain optimized features.

[0162] In a possible implementation, optionally, the feature extraction module 13 may also include: a long short-term memory network with a self-attention mechanism; the feature extraction module 13 is specifically used to apply a preset long short-term memory network with a self-attention mechanism to perform long-term dependency feature extraction on the time series data in the first data set, wherein the long-term dependency feature is a feature of the attack mode or abnormal behavior changing over time in a long time series; and the multi-scale time series features and structured features as well as the optimization features and / or long-term dependency features form a first feature set.

[0163] The feature fusion module 14 is used to fuse the features in the first feature set to obtain a fused feature set.

[0164] In a possible implementation, the feature fusion module 14 is specifically used to evaluate the correlation between each feature in the first feature set and the preset abnormal behavior, select the features whose correlation is greater than a preset threshold, and obtain a preliminary feature subset; fuse the information of different dimensions of each feature in the preliminary feature subset to obtain a multi-dimensional fused feature set; and obtain a fused feature set based on the first feature set and the multi-dimensional fused feature set.

[0165] In a possible implementation, the feature fusion module 14 is specifically used to process the features in the preliminary feature subset using the target feature processing method to obtain a simplified feature set; fuse the information of different dimensions of each feature in the simplified feature set to obtain a multi-dimensional fused feature set; and obtain a fused feature set based on the first feature set and the multi-dimensional fused feature set. The target feature processing method includes at least one feature processing method selected from feature iterative elimination, feature importance evaluation, and feature weight adjustment.

[0166] Optionally, the feature fusion module 14 includes a feature knowledge graph. The feature fusion module 14 is specifically used to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fusion feature set using a preset feature knowledge graph and add them to the fusion feature set. Among them, the long-term dependency relationship is the relationship between the attack mode or abnormal behavior over time in a long time series.

[0167] The network anomaly detection module 15 is used to input the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result.

[0168] Optionally, the network anomaly detection module 15 includes a multi-scale anomaly detection neural network; the multi-scale anomaly detection neural network includes a multi-channel convolutional neural network, a dynamic routing capsule network and a multi-task learning framework. The network anomaly detection module 15 is specifically used to apply a multi-channel convolutional neural network to perform weighted processing on the features in the fusion feature set to obtain an attention weighted feature set; apply a dynamic routing capsule network to perform hierarchical relationship modeling on each feature in the attention weighted feature set to obtain a structured feature set; apply a multi-task learning framework to perform anomaly detection, attack classification and anomaly degree estimation analysis on the structured feature set to obtain a first anomaly detection result.

[0169] In a possible implementation, the network anomaly detection module 15 is specifically used to input the features in the fusion feature set into the channels corresponding to the multi-channel convolutional neural network according to the preset feature types;

[0170] A multi-channel convolutional neural network is applied to extract the features in each channel to obtain a primary feature set for each channel. Optionally, the multi-channel convolutional neural network includes an attention mechanism. The network anomaly detection module 15 is specifically used to apply the attention mechanism in the multi-channel convolutional neural network to adjust the importance weight corresponding to the primary feature set of each channel, and perform weighted summation according to the importance weight and the position of the corresponding channel to obtain an attention weighted feature set.

[0171] like Figure 5 As shown, a network anomaly detection device 10 provided in an embodiment of the present application may further include an attack chain analysis module 16 and a semantic analysis module 17 .

[0172] Optionally, the attack chain analysis module 16 includes a graph database; the attack chain analysis module 16 is used to apply a preset graph database to perform attack path restoration and attack target prediction on the first anomaly detection result and the anomaly data in the second anomaly detection result to obtain an attack chain analysis report, wherein the second anomaly detection result is a detection result obtained by detecting the network traffic data set to be detected according to preset rules.

[0173] The semantic analysis module 17 is used to perform text conversion on the first anomaly detection result, the second anomaly detection result and the attack chain analysis report to obtain an anomaly detection report.

[0174] The network anomaly detection device 10 provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned network anomaly detection method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned network anomaly detection method embodiment.

[0175] like Figure 6 As shown, Figure 6 The structure block diagram of an electronic device 20 provided in an embodiment of the present application is shown. The electronic device 20 includes: a processor 21 and a memory 22. The electronic device 20 can be a network monitoring device, a managed industrial switch, etc.

[0176] It should be noted that Figure 6 The components and structures of the electronic device 20 shown are merely exemplary and non-limiting. The electronic device 20 may also have other components and structures as required.

[0177] The processor 21, the memory 22, and other components that may appear in the electronic device 20 are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, the processor 21, the memory 22, and other components that may appear may be electrically connected to each other via one or more communication buses or signal lines.

[0178] The memory 22 is used to store programs, for example, a program corresponding to the network anomaly detection method mentioned above, a program corresponding to the network anomaly detection model training method, or a network anomaly detection device mentioned above. Optionally, when the network anomaly detection device is stored in the memory 22, the network anomaly detection device includes at least one software function module that can be stored in the memory 22 in the form of software or firmware.

[0179] The processor 21 is used to execute the executable modules stored in the memory 22, for example, to execute the software function modules or computer programs included in the network anomaly detection device, so as to perform the above-mentioned network anomaly detection method.

[0180] Of course, the method disclosed in any embodiment of the present application can be applied to the processor 21, or implemented by the processor 21.

[0181] Among them, the memory 22 can be, but is not limited to, a random access memory (Random Access Memory, RAM), a read only memory (Read Only Memory, ROM), a programmable read-only memory (Programmable Read-Only Memory, PROM), an erasable programmable read-only memory (Erasable Programmable Read-Only Memory, EPROM), an electrically erasable read-only memory (Electric Erasable Programmable Read-Only Memory, EEPROM), etc.

[0182] The processor 21 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), a graphics processor (GPU), an accelerated processing unit (Accelerated Processing Unit), a multimedia application processor (MAP), a microprocessor, etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application may be implemented or executed. Or the processor 21 may also be any conventional processor, etc.

[0183] An embodiment of the present application also provides a non-volatile computer-readable storage medium (hereinafter referred to as storage medium), on which a computer program is stored. When the computer program is run by a computer such as the above-mentioned electronic device 20, the method disclosed in any of the above-mentioned embodiments is executed.

[0184] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0185] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0186] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0187] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for enabling a computer device (which can be a personal computer, a laptop, a server, or an electronic device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0188] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network anomaly detection method, characterized in that: include: Obtain the network traffic data set to be detected; Preprocessing the data in the network traffic data set to be detected to obtain a first data set; Performing feature extraction on the first data set to obtain a first feature set; Performing feature fusion on the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; Inputting the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result; The step of fusing the features in the first feature set to obtain a fused feature set includes: Evaluate the correlation between each feature in the first feature set and the preset abnormal behavior, select the features whose correlation is greater than a preset threshold, and obtain a preliminary feature subset; Fusing information of different dimensions of each feature in the initially selected feature subset to obtain a multi-dimensional fused feature set, wherein the information of different dimensions of each feature includes statistical characteristics, pattern recognition, and semantic information; Obtaining the fused feature set according to the first feature set and the multi-dimensional fused feature set; Wherein, the method further comprises: A preset feature knowledge graph is used to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fusion feature set, and add them to the fusion feature set, wherein the long-term dependency relationship is the relationship between the attack mode or abnormal behavior changing over time in a long time series, each node in the preset feature knowledge graph represents a feature, and the edges connecting the nodes in the preset feature knowledge graph represent the relationship between the features.

2. The method according to claim 1, characterized in that The step of obtaining a network traffic data set to be detected includes: According to a preset security policy, data of the network node is sampled to obtain a first network traffic data set, wherein the preset security policy is used to adjust the frequency and range of sampling; The irrelevant data in the first network traffic data set is removed to obtain the network traffic data set to be detected.

3. The method according to claim 1, characterized in that The preprocessing of the data in the to-be-detected network traffic data set to obtain a first data set includes: The data in the network traffic data set to be detected are sequentially cleaned and converted into a unified tensor format to obtain a unified data set; Outliers in the unified data set are detected and corrected to obtain the first data set.

4. The method according to claim 1, characterized in that: Performing feature extraction on the first data set to obtain a first feature set includes: Expanding the data of the rare attack samples in the first data set to obtain an expanded first data set; Feature extraction is performed on the expanded first data set, and multi-layer nonlinear transformation is performed on the extracted features to obtain the first feature set.

5. The method according to claim 1, characterized in that The step of extracting features from the first data set to obtain a first feature set includes: Applying a preset multi-resolution time window analysis module to perform multi-scale time series feature extraction on the first data set; Applying a preset graph neural network to perform structured feature extraction on the first data set; The multi-scale temporal features and the structural features are combined into the first feature set.

6. The method according to claim 5, characterized in that The extracting features from the first data set to obtain a first feature set further includes: i. extracting features from the first data set to obtain traffic statistics features, protocol behavior features, and content semantic features, and fusing the traffic statistics features, the protocol behavior features, and the content semantic features to obtain optimized features; and / or ii. Applying a preset long short-term memory network with a self-attention mechanism to extract long-term dependency features from the time series data in the first data set, wherein the long-term dependency features are features of the change of attack patterns or abnormal behaviors over time in a long time series; The multi-scale temporal features, the structural features, the optimization features and / or the long-term dependency features are combined into the first feature set.

7. The method according to claim 1, characterized in that The method further comprises: performing feature fusion on the features in the first feature set to obtain a fused feature set. Processing the features in the preliminarily selected feature subset using a target feature processing method to obtain a reduced feature set, wherein the target feature processing method includes: at least one feature processing method of feature iterative elimination, feature importance evaluation, and feature weight adjustment; Fusing information of different dimensions of each feature in the simplified feature set to obtain the multi-dimensional fused feature set; The fused feature set is obtained according to the first feature set and the multi-dimensional fused feature set.

8. The method according to claim 1, characterized in that: The preset multi-scale anomaly detection neural network includes a multi-channel convolutional neural network, a dynamic routing capsule network and a multi-task learning framework, and the fusion feature set is input into the preset multi-scale anomaly detection neural network to obtain a first anomaly detection result, including: Applying the multi-channel convolutional neural network to perform weighted processing on the features in the fusion feature set to obtain an attention weighted feature set; Applying the dynamic routing capsule network to model the hierarchical relationship of each feature in the attention weighted feature set to obtain a structured feature set; The multi-task learning framework is applied to perform anomaly detection, attack classification and anomaly degree estimation analysis on the structured feature set to obtain a first anomaly detection result.

9. The method according to claim 8, characterized in that The applying the multi-channel convolutional neural network to perform weighted processing on the features in the fusion feature set to obtain an attention weighted feature set includes: Inputting the features in the fused feature set into the channels corresponding to the multi-channel convolutional neural network according to the preset feature types; Applying the multi-channel convolutional neural network to extract the features in each of the channels to obtain a primary feature set for each channel; The attention mechanism in the multi-channel convolutional neural network is applied to adjust the importance weight corresponding to the primary feature set of each channel, and a weighted sum is performed according to the importance weight and the corresponding position of the channel to obtain the attention weighted feature set.

10. The method according to claim 1, characterized in that The method further comprises: Applying a preset graph database to restore the attack path and predict the attack target for the first anomaly detection result and the anomaly data in the second anomaly detection result, to obtain an attack chain analysis report, wherein the second anomaly detection result is a detection result obtained by detecting the network traffic data set to be detected according to a preset rule; The first anomaly detection result, the second anomaly detection result, and the attack chain analysis report are converted into text to obtain an anomaly detection report.

11. A network anomaly detection model training method, characterized in that: include: Obtain a training set of network traffic data; Preprocessing the data in the network traffic data training set to obtain a first data set; Performing feature extraction on the first data set to obtain a first feature set; Performing feature fusion on the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; The multi-scale anomaly detection neural network to be trained is trained by using the fusion feature set to obtain a multi-scale anomaly detection neural network; The step of fusing the features in the first feature set to obtain a fused feature set includes: Evaluate the correlation between each feature in the first feature set and the preset abnormal behavior, select the features whose correlation is greater than a preset threshold, and obtain a preliminary feature subset; Fusing information of different dimensions of each feature in the initially selected feature subset to obtain a multi-dimensional fused feature set, wherein the information of different dimensions of each feature includes statistical characteristics, pattern recognition, and semantic information; Obtaining the fused feature set according to the first feature set and the multi-dimensional fused feature set; Wherein, the method further comprises: A preset feature knowledge graph is used to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fusion feature set, and add them to the fusion feature set, wherein the long-term dependency relationship is the relationship between the attack mode or abnormal behavior changing over time in a long time series, each node in the preset feature knowledge graph represents a feature, and the edges connecting the nodes in the preset feature knowledge graph represent the relationship between the features.

12. A network anomaly detection device, characterized in that: include: A data acquisition module is used to acquire a network traffic data set to be detected; A data preprocessing module, used for preprocessing the data in the network traffic data set to be detected to obtain a first data set; A feature extraction module, used to extract features from the first data set to obtain a first feature set; A feature fusion module, used for fusing the features in the first feature set to obtain a fused feature set, wherein the feature fusion includes fusing information of different dimensions of the same feature; A network anomaly detection module, used for inputting the fused feature set into a preset multi-scale anomaly detection neural network to obtain a first anomaly detection result; The feature fusion module is specifically used to evaluate the correlation between each feature in the first feature set and the preset abnormal behavior, select the features whose correlation is greater than a preset threshold, and obtain a preliminary feature subset; fuse the information of different dimensions of each feature in the preliminary feature subset to obtain a multi-dimensional fused feature set, wherein the information of different dimensions of each feature includes statistical characteristics, pattern recognition, and semantic information; and obtain the fused feature set according to the first feature set and the multi-dimensional fused feature set; The feature fusion module includes a feature knowledge graph, and the feature fusion module is also used to apply a preset feature knowledge graph to extract the semantic relationship and long-term dependency relationship between the features in the first feature set and the multi-dimensional fusion feature set, and add them to the fusion feature set, wherein the long-term dependency relationship is the relationship between the attack mode or abnormal behavior changing over time in a long time series, each node in the preset feature knowledge graph represents a feature, and the edges connecting the nodes in the preset feature knowledge graph represent the relationship between the features.

13. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is connected to the processor; The memory is used to store programs; The processor is used to call the program stored in the memory to execute the method according to any one of claims 1 to 10 or the method according to claim 11.

Images