A network abnormal traffic detection method and system based on multi-source information fusion

Abstract

The present application discloses a method and system for detecting abnormal network traffic based on multi-source information fusion, which relates to the field of abnormal network traffic detection. The method includes: obtaining static data of network traffic; the network traffic includes normal traffic and abnormal traffic; using sandbox inversion technology to identify user behavior characteristics; using port scanning tools to scan network space assets to obtain network space asset characteristics; fusing the static data, the user behavior characteristics and the network space asset characteristics to obtain a fusion feature graph; training a classification model through the fusion feature graph; and detecting abnormal traffic of an actual network through the trained classification model. The present application can improve the comprehensiveness and accuracy of abnormal network traffic detection.

Description

Technical Field

[0001] The present application relates to the field of network abnormal traffic detection, and in particular to a network abnormal traffic detection method and system based on multi-source information fusion. Background Art

[0002] In terms of traffic detection, common data sets used for traffic detection algorithms include: NSL-KDD data set, ISCX VPN-nonVPN data set and USTC-TFC2016 data set. However, these data sets mainly have the following problems.

[0003] 1. In the current data set, most of the features are static, and the impact of dynamic changes in user behavior on network traffic is not considered. When faced with complex and diverse attack patterns, missed reports and false positives are prone to occur. Especially for highly concealed and cross-level attack behaviors, static data sources are difficult to provide sufficient information for effective detection.

[0004] 2. In the current dataset, the focus is on the basic characteristics of network traffic (such as connection duration, protocol type, number of packets, etc.), lacking higher-level contextual information such as user behavior characteristics and network asset characteristics, ignoring the correlation and complementarity between them. This data isolation limits the comprehensiveness and accuracy of the recognition model.

[0005] When faced with new attack methods and complex network environments, models trained with static data features often lack sufficient adaptability and robustness. Summary of the invention

[0006] The purpose of this application is to provide a method and system for network abnormal traffic detection based on multi-source information fusion, which can enrich the feature dimensions of the original data set and improve the comprehensiveness and accuracy of network abnormal traffic detection.

[0007] To achieve the above objectives, this application provides the following solutions.

[0008] In the first aspect, the present application provides a method for detecting abnormal network traffic based on multi-source information fusion, including: obtaining static data of network traffic; the network traffic includes normal traffic and abnormal traffic; using sandbox inversion technology to identify user behavior characteristics; using a port scanning tool to scan network space assets to obtain network space asset characteristics; fusing the static data, the user behavior characteristics and the network space asset characteristics to obtain a fused feature graph; training a classification model through the fused feature graph; and detecting abnormal traffic on an actual network through the trained classification model.

[0009] In the second aspect, the present application provides a network abnormal traffic detection system based on multi-source information fusion, including: a static data acquisition module, used to obtain static data of network traffic; the network traffic includes normal traffic and abnormal traffic; a user behavior feature extraction module, used to identify user behavior features using sandbox inversion technology; a network space asset feature extraction module, used to use a port scanning tool to scan network space assets to obtain network space asset features; a fusion module, used to fuse the static data, the user behavior features and the network space asset features to obtain a fusion feature map; a model training module, used to train a classification model through a fusion feature map; an abnormal traffic detection module, used to detect abnormal traffic on an actual network through a trained classification model.

[0010] According to the specific embodiments provided in this application, this application discloses the following technical effects.

[0011] (1) The specific behavior of users is identified through sandbox inversion technology, and the impact of dynamic changes in user behavior on network traffic characteristics is considered, thereby enriching the feature dimensions of the original data set.

[0012] (2) Based on static data, cyberspace asset characteristics are extracted through active measurement, the impact of cyberspace asset characteristics on identifying abnormal traffic is considered, and the feature dimensions of the original data set are enriched.

[0013] (3) Through advanced data fusion technology, user behavior characteristics, cyberspace asset characteristics and traditional network traffic characteristics (i.e. static data of network traffic) are integrated, making full use of the correlation and complementarity between data, realizing the fusion of multi-source information, and improving the comprehensiveness and accuracy of detection.

[0014] (4) The classification model is trained by fusing multi-source information, and the trained classification model is used to detect and analyze network traffic anomalies, thereby improving the detection accuracy and robustness of the classification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A flowchart of a method for detecting abnormal network traffic based on multi-source information fusion provided in an embodiment of the present application.

[0017] Figure 2The figure is a detailed flow chart of the network abnormal traffic detection method based on multi-source information fusion. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0019] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0020] In an exemplary embodiment, Figure 1-Figure 2 As shown, a method for detecting abnormal network traffic based on multi-source information fusion is provided. The method is executed by a computer device, and can be specifically executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In an embodiment of the present application, the method is applied to a server as an example for explanation, including the following steps S1 to S6.

[0021] S1: Obtain static data of network traffic; the network traffic includes normal traffic and abnormal traffic.

[0022] Static data ( ) include the following categories: basic features ( )、Content Features( )、Flow characteristics( ) and time characteristics ( ).

[0023] Basic features ( ): Describes basic information about the network connection, including duration ( )、Protocol Type( )、Service Type( )wait.

[0024] Content Features ( ): Information describing the connection, including the number of failed login attempts ( )、Whether the login is successful( )wait.

[0025] Traffic characteristics ( ): includes the number of packets sent per second ( ), the number of packets received per second ( ), the number of bytes sent per second ( )wait.

[0026] Time characteristics ( ): including the connection duration ( ), connection start time ( ) and end time ( )wait.

[0027] In order to ensure the quality and consistency of the data, first of all, this application cleans the static data, including filling in missing values ​​or deleting records with more missing values, detecting and processing outliers, such as extreme values ​​or negative values, and standardizing or normalizing the data to eliminate the influence between different feature dimensions. Next, non-numerical features (such as protocol type, IP address, etc.) are digitized. Common methods include One-Hot Encoding and Label Encoding. In addition, the representation of time features is unified, and all are converted into timestamp format in seconds.

[0028] S2: Using sandbox inversion technology to identify user behavior characteristics. Specifically, it includes: building an isolated sandbox environment; simulating various user behaviors in the sandbox environment and generating corresponding network traffic data and log data; extracting user behavior characteristics from the network traffic data and the log data.

[0029] The user behavior feature extraction method based on sandbox inversion aims to simulate and analyze user behavior through sandbox technology to extract user behavior features. These user behavior features can be further used for network traffic detection and classification to improve the accuracy and precision of detection.

[0030] First, you need to build an isolated sandbox environment to simulate real user operations and network environments. The sandbox environment can be a virtual machine or container that provides operating conditions similar to the actual environment. Secondly, simulate various user behaviors in the sandbox environment, such as browsing the web, watching videos, downloading files, sending emails, etc. Perform these operations through scripts or automation tools to generate corresponding network traffic and log data. Then, analyze the collected network traffic and log data through user behavior feature extraction models (such as K-Means or DBSCAN) to extract user behavior features.

[0031] User behavior characteristics ( ) includes the following features.

[0032] (1) Conversational features : Session duration ( ), number of packets ( ), the amount of data transferred ( )wait.

[0033] (2) Protocol characteristics ): The protocol type used is HTTP ( ), HTTPS ( ), FTP ( )、Port Number( )wait.

[0034] (3) Access mode ): The domain name visited ( )、IP address( ), the requested resource type (video ( ),text( ),picture( )etc.

[0035] (4) System behavior (G): file operation ( )、Process Start( ) and terminate ( )、Registry modification( )wait.

[0036] Finally, based on the extracted user behavior features, inversion analysis is performed using formula (1).

[0037] (1)

[0038] in: is the sandbox model function, is the weight of the conversational features, is the weight of the protocol characteristics, is the component of the access mode, is the component of the system behavior, j=1,2,...,J, j represents the sequence number of the component, and J represents the total number of components.

[0039] Formula (1) shows that the different components of the current user behavior characteristics directly affect the overall characteristics f(S, P, V, ) output.

[0040] However, in the actual simulation, there is still a certain deviation, and this application takes this deviation into account through formula (2).

[0041] (2)

[0042] Then, formula (2) is equivalent to formula (3).

[0043] (3)

[0044] In this application, represents the user behavior characteristics observed in the sandbox environment, while the deviation It reflects the difference between the model prediction and the actual observation. , we can infer the weights of the influencing factors or features in the user behavior feature extraction model. For example, if the deviation If the weight distribution of the user behavior features in the user behavior feature extraction model is large, it means that the weight distribution of the user behavior features in the user behavior feature extraction model is unreasonable. By inverting and analyzing these deviations, the present application can identify the actual weights of each user behavior feature. Based on the new weights obtained by inversion, the user behavior feature extraction model will be re-corrected and optimized, so that user behavior features can be more accurately identified and classified.

[0045] S3: Use port scanning tools to scan cyberspace assets and obtain cyberspace asset characteristics.

[0046] Use port scanning tools (such as Nmap) to scan network space assets and obtain information about open ports. The scan can include common ports and all ports to ensure comprehensiveness. During the port scanning process, collect port information related to each network space asset. Including but not limited to open port number (service type, version (HTTP, HTTPS, FTP, SSH, etc.)), port status (open, closed, filtered), protocol type (TCP, UDP). This application analyzes the port opening characteristics of devices in different industries to identify and infer the industry attribution information contained in the traffic ( In addition, the operating system can be inferred based on the port information ( )、Application Services( ), network device type ( )、Network topology( ) and equipment manufacturers ( ) and model ( ) and other cyberspace asset information. Finally, the extracted port features (i.e., cyberspace asset features) are vectorized to form cyberspace asset features. .

[0047] S4: Fusing the static data, the user behavior features and the network space asset features to obtain a fusion feature graph, which specifically includes steps S41 to S44.

[0048] S41: splicing the static data, the user behavior characteristics and the network space asset characteristics to obtain spliced ​​data.

[0049] User behavior characteristics ( )、Cyberspace asset characteristics( ) and static data ( ) splicing, the formula is as follows.

[0050] (4)

[0051] in, Represents concatenated data.

[0052] The spliced ​​data is standardized or normalized to ensure that different features are at the same scale, which facilitates the training of subsequent classification models.

[0053] S42: Extract the feature map in the concatenated data through a two-dimensional convolutional layer to obtain the original feature map.

[0054] In order to make the features in the spliced ​​data clearer, the effect is more ideal, and obtain better accuracy, this application uses the channel fusion module and the spatial fusion module to enhance the classification model's vector representation of key data and minimize the interference of low-correlation information on recognition. Figure 2 As shown, first, the data is spliced Send in one In the two-dimensional convolutional layer, the feature maps of static data, user behavior features, and network asset features in the global features are extracted to obtain the original feature maps.

[0055] S43: Split the original feature map into two identical feature sub-maps, and input the two feature sub-maps into a channel fusion module and a spatial fusion module respectively to obtain a channel attention feature map and a spatial attention feature map.

[0056] This application converts the original feature map Split into two identical feature subgraphs , , respectively, and sent to two different fusion modules.

[0057] (1) Channel fusion module.

[0058] like Figure 2 As shown, the fusion module can be used to input feature subgraphs Weighing is performed to select useful feature graphs. Perform global average pooling and global maximum pooling to extract global information, generate query vectors and key vectors, and combine them with the input feature subgraph Generate a channel attention map and compare it with the feature sub-map Perform element-level multiplication operations so that the channel attention feature map contains both global important information and retains certain original features. This process can effectively enhance the feature sub-map The important information in the classification can ultimately improve the classification performance of the classification model.

[0059] First, channel fusion channel block pairs feature sub-graph Perform global maximum pooling and global average pooling in the spatial dimension to compress the spatial size and obtain two 1×1×C feature maps; assume that the feature submap , where C is the number of channels, H is the height, and W is the width. By performing global average pooling through formula (5) and global maximum pooling through formula (6), we can get two vectors and , each of their elements , Indicates the mean and maximum value of each channel.

[0060] (5)

[0061] (6)

[0062] in, is the pixel value at the feature sub-image channel c, height i, and width n, and the feature sub-image The vector obtained by global average pooling and global maximum pooling and As query vectors (query) and key vector (key), this is because these two pooling operations can extract feature subgraphs The global average pooling can capture the feature sub-graph The average information in reflects the mean of the overall features; while the global maximum pooling can capture the feature sub-graph The most significant feature in the feature subgraph By using these two types of global information as query vectors and key vectors, these global information can be effectively fused in the attention mechanism to calculate the channel attention map , and the value vector is the input feature subgraph , this is because the value vector needs to contain the feature subgraph All the information in can be weighted in the attention mechanism to generate the final channel attention map . A channel attention map fused in the channel dimension is calculated by formula (7) .

[0063] (7)

[0064] In the fusion channel attention map When the application considers the characteristic subgraph contains the original local and global feature information. In the fusion process, if we completely rely on the attention map to update information, some important original features may be lost. and Performing element-wise multiplication operations can retain important information in the original features, making the final channel attention feature map More comprehensive. Secondly, the channel attention map Emphasizes the characteristic subgraph The information of important channels in the matrix can be obtained by performing element-wise multiplication. The features of these important channels can be further enhanced through element-wise multiplication, so that the classification model can pay more attention to these key features in the subsequent processing and improve the classification performance. The operation can effectively suppress the interference of unimportant channels. Channel attention map The smaller weights in will further weaken the influence of the corresponding channels in the multiplication operation, thereby reducing the interference of noise features on the final output and improving the quality of feature representation.

[0065] (8)

[0066] (2) Spatial fusion module.

[0067] Spatial fusion module for feature subgraphs Perform global maximum pooling and global average pooling in the channel dimension, compress the channel dimension size, and obtain two H×W×1 feature maps. Use formulas (9) and (10) to derive the feature sub-maps. Perform global average pooling and global maximum pooling to obtain two vectors and .

[0068] (9)

[0069] (10)

[0070] in, , are the global maximum pooling vector and the global average pooling vector when the feature sub-image height is i and width is n, respectively. is the pixel value of the feature sub-image with channel c, height i, and width n.

[0071] As with the channel fusion module, the feature subgraph The vector obtained by global average pooling and global maximum pooling and As query vectors and key vector , and the value vector The characteristic subgraph , a spatial attention map fused in the spatial dimension is calculated by formula (11) .

[0072] (11)

[0073] In order to make the fused spatial feature map It can also retain certain original features. This application refers to the method of retaining the original features in channel fusion and converts the feature sub-graph into With spatial attention map We perform an element-wise multiplication to obtain the spatial attention feature map. .

[0074] (12).

[0075] S44: The channel attention feature map, the spatial attention feature map and the original feature map are fused and spliced ​​through a convolutional layer to obtain a fused feature map.

[0076] The channel fusion module and spatial fusion module of this application enhance the feature map in the channel dimension and spatial dimension respectively. Channel attention feature map The important channel information in the feature map is emphasized, while the spatial attention feature map The important spatial information in the feature map is emphasized. Due to the inconsistency between the two attention feature maps in size, this application adopts The convolutional layers are fused and spliced. The fused feature map can integrate global and local information, making the expression of the feature map more comprehensive. In order to improve the robustness and accuracy of the classification model, the original feature map X is also added to the attention feature map during the fusion process. The purpose of this is to retain the information in the original features and prevent the loss of important information in the original features during the attention processing. In this way, the final output fused feature map It includes the original features and enhances the important features. The formula is as follows.

[0077] (13).

[0078] S5: Train the classification model by fusing feature maps.

[0079] Since network traffic data not only has conventional feature information but also has time series characteristics, this application uses a CNN (convolutional neural network) + LSTM (long short-term memory network) classification model to train the fused feature map. CNN is responsible for extracting feature information in the fused feature map, and LSTM is responsible for extracting feature information about time series in the fused feature map.

[0080] Fusion feature map , then the size of the fused feature map input to the classification model is First, when the fused feature map passes through multiple convolution layers, this application sets the size of each convolution kernel to .

[0081] The convolution output is then used as the input of the pooling layer to reduce the size of the fused feature map, that is, the width (W) dimension is reduced by half to reduce the complexity of the calculation, enhance the ability to extract important features, and enhance the robustness of the features.

[0082] After multiple convolutional layers, the calculated feature maps are sent to LSTM to further extract temporal features. First, the output feature map of the convolutional layer Flatten or sequence into , D is the feature dimension of each time step. Each LSTM unit can be represented by formula (14).

[0083] (14)

[0084] : Data input to the LSTM unit at time t.

[0085] : The hidden state of the LSTM unit at time t-1, also known as the output of the previous hidden layer.

[0086] : The output value of the Forget Gate in the LSTM unit at time t is used to determine how much memory at time t-1 needs to be forgotten.

[0087] and is the weight matrix and bias of the forget gate.

[0088] (15)

[0089] in, It is the output value of the input gate in the LSTM unit at time t, which is used to determine the amount of information input at time t. and is the weight matrix and bias of the input gate.

[0090] (16)

[0091] in, , are the memory cell states of the LSTM unit at time t and time t-1, respectively, which are updated by the control of the forget gate and the input gate. and are the weight matrices and biases of the candidate states.

[0092] (17)

[0093] in, It is the output value of the output gate in the LSTM unit at time t, which is used to determine how much information about the current memory cell state to output. and is the weight matrix and bias of the output gate.

[0094] (18)

[0095] in, represents the hyperbolic tangent activation function.

[0096] The hidden state of the LSTM unit at time t As the input of the fully connected layer, it outputs the multi-classification result y.

[0097] (19)

[0098] in, , where x is the number of hidden units of the LSTM and m is the number of categories. is the bias vector.

[0099] S6: Detect abnormal traffic in the actual network through the trained classification model.

[0100] After the classification model is trained, it is applied to abnormal traffic detection in the actual network environment. This process can be divided into the following key steps.

[0101] (1) Traffic data preprocessing: Traffic data in the actual network must first be preprocessed. This includes capturing, extracting features, and standardizing traffic data to ensure that the format of the input data is consistent with the features during training. This step ensures that the classification model can accurately identify feature information and improve detection accuracy.

[0102] (2) Real-time traffic monitoring: The preprocessed traffic data will be input into the trained classification model in real time. The classification model first extracts the spatial features in the traffic data through the convolution layer and identifies static information such as various communication behaviors and protocol features. Then, the LSTM layer extracts the temporal features in the traffic data to capture the dynamic changes of traffic behavior in the time dimension.

[0103] (3) Classification and anomaly detection: For the input traffic data, the classification model will output a classification result, indicating whether the traffic data belongs to normal traffic or abnormal traffic. Specifically, the output result of the classification model is a multi-classification probability distribution, in which the classification result with the highest probability is regarded as the label of the traffic. If the traffic is classified as abnormal, it will be marked and further processed.

[0104] (4) Threshold setting and alarm mechanism: In order to improve the sensitivity and accuracy of anomaly detection, an anomaly threshold can be set. When the probability of abnormal traffic in the classification results of the classification model exceeds the preset threshold, the system will trigger the alarm mechanism to notify the administrator for further analysis and processing. This threshold setting can be adjusted according to different network environments and security requirements to adapt to different application scenarios.

[0105] (5) Continuous learning and model updating: The network environment and attack patterns are changing dynamically. In order to maintain the detection capability of the classification model, this application can use new traffic data to continuously learn and update the classification model. Through regular retraining and fine-tuning, the classification model can adapt to new threats and behavior patterns and maintain its high efficiency in abnormal traffic detection.

[0106] (6) Feedback and Improvement: Each abnormal traffic detected will be recorded and used for subsequent analysis. These recorded data can be used as new training samples to further improve the detection ability of the classification model. At the same time, the administrator's feedback can also be used to improve the classification model, optimize the parameters and structure of the classification model, and further improve the accuracy and response speed of detection.

[0107] Based on the same inventive concept, the embodiment of the present application also provides a system for implementing the above-mentioned network abnormal traffic detection method based on multi-source information fusion. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more embodiments of the network abnormal traffic detection system based on multi-source information fusion provided below can refer to the above limitations on the network abnormal traffic detection method based on multi-source information fusion, which will not be repeated here.

[0108] In an exemplary embodiment, a network abnormal traffic detection system based on multi-source information fusion is provided, including the following modules.

[0109] The static data acquisition module is used to acquire static data of network traffic; the network traffic includes normal traffic and abnormal traffic.

[0110] The user behavior feature extraction module is used to identify user behavior features using sandbox inversion technology.

[0111] The cyberspace asset feature extraction module is used to scan cyberspace assets using port scanning tools to obtain cyberspace asset features.

[0112] The fusion module is used to fuse the static data, the user behavior characteristics and the network space asset characteristics to obtain a fusion feature graph.

[0113] Model training module, used to train the classification model by fusing feature maps;

[0114] The abnormal traffic detection module is used to detect abnormal traffic in the actual network through the trained classification model.

[0115] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A network abnormal traffic detection method based on multi-source information fusion, characterized in that: include: Get static data of network traffic; The network traffic includes normal traffic and abnormal traffic; Use sandbox inversion technology to identify user behavior characteristics; The user behavior characteristics include: session characteristics, protocol characteristics, access patterns and system behaviors; Scan the network space assets using a port scanning tool to obtain network space asset characteristics; the network space asset characteristics include: industry attribution information, operating system, application service, network device type, network topology, device manufacturer and model; The static data, the user behavior characteristics and the network space asset characteristics are fused to obtain a fused feature map; specifically comprising: splicing the static data, the user behavior characteristics and the network space asset characteristics to obtain spliced ​​data; extracting the feature map in the spliced ​​data through a two-dimensional convolution layer to obtain an original feature map; splitting the original feature map into two identical feature sub-maps, and inputting the two feature sub-maps into a channel fusion module and a spatial fusion module respectively to obtain a channel attention feature map and a spatial attention feature map; fusing and splicing the channel attention feature map, the spatial attention feature map and the original feature map through a convolution layer to obtain a fused feature map; Train the classification model by fusing feature maps; The trained classification model is used to detect abnormal traffic in the actual network.

2. The method for detecting abnormal network traffic based on multi-source information fusion according to claim 1 is characterized in that: The static data includes basic characteristics, content characteristics, flow characteristics and time characteristics; The basic characteristics are used to describe basic information of the network connection, and the basic characteristics include duration, protocol type and service type; The content feature is used to describe information about the network connection content, and the content feature includes the number of login failures and whether the login is successful; The traffic characteristics include the number of packets sent per second, the number of packets received per second, and the number of bytes sent per second; The time characteristics include connection duration, connection start time and connection end time.

3. The method for detecting abnormal network traffic based on multi-source information fusion according to claim 1 is characterized in that: Use sandbox inversion technology to identify user behavior characteristics, including: Build an isolated sandbox environment; Simulate various user behaviors in a sandbox environment and generate corresponding network traffic data and log data; User behavior features are extracted from the network traffic data and the log data.

4. The method for detecting abnormal network traffic based on multi-source information fusion according to claim 1 is characterized in that: The expression of the channel attention feature map is: ； ； in, is the channel attention feature map, is the channel attention map, is the feature subgraph input to the channel fusion module, is element-wise multiplication, is the query vector, is the key vector, is the activation function, is the feature dimension, is a value vector, is the feature subgraph The vector obtained after global average pooling is is the feature subgraph The vector obtained after global maximum pooling, T represents transposition, , are the global maximum pooling vector and the global average pooling vector when the feature sub-image height is i and width is n, respectively. is the pixel value of the feature sub-image with channel c, height i, and width n.

5. The method for detecting abnormal network traffic based on multi-source information fusion according to claim 1 is characterized in that: The expression of the spatial attention feature map is: ； ； in, is the spatial attention feature map, is the spatial attention map, is the feature subgraph input to the spatial fusion module, is element-wise multiplication, is the query vector, is the key vector, is the activation function, is the feature dimension, is a value vector, is the feature subgraph The vector obtained after global average pooling is is the feature subgraph The vector obtained after global maximum pooling, T represents transposition, , are the global maximum pooling vector and the global average pooling vector when the feature sub-image height is i and width is n, respectively. is the pixel value of the feature sub-image with channel c, height i, and width n.

6. The method for detecting abnormal network traffic based on multi-source information fusion according to claim 1 is characterized in that: The classification model includes a convolutional neural network and a long short-term memory network.

7. A network abnormal traffic detection system based on multi-source information fusion, characterized in that: include: Static data acquisition module, used to acquire static data of network traffic; The network traffic includes normal traffic and abnormal traffic; User behavior feature extraction module, used to identify user behavior features using sandbox inversion technology; The user behavior characteristics include: session characteristics, protocol characteristics, access patterns and system behaviors; A network space asset feature extraction module is used to scan network space assets using a port scanning tool to obtain network space asset features; the network space asset features include: industry attribution information, operating system, application service, network device type, network topology, device manufacturer and model; A fusion module is used to fuse the static data, the user behavior characteristics and the network space asset characteristics to obtain a fused feature map; specifically comprising: splicing the static data, the user behavior characteristics and the network space asset characteristics to obtain spliced ​​data; extracting the feature map in the spliced ​​data through a two-dimensional convolution layer to obtain an original feature map; splitting the original feature map into two identical feature sub-maps, and inputting the two feature sub-maps into a channel fusion module and a space fusion module respectively to obtain a channel attention feature map and a space attention feature map; fusing and splicing the channel attention feature map, the space attention feature map and the original feature map through a convolution layer to obtain a fused feature map; Model training module, used to train the classification model by fusing feature maps; The abnormal traffic detection module is used to detect abnormal traffic in the actual network through the trained classification model.

Images