Network threat monitoring and early warning method based on YOLO algorithm
By employing a network threat detection method based on the YOLO algorithm, which utilizes data collection, feature extraction, and deep learning model training, the problems of poor speed and accuracy in network threat detection are solved, achieving reliable and rapid detection of network threats.
Patent Information
- Application Number
- CN202411379262.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2025-01-07
AI Technical Summary
Existing technologies struggle to quickly detect intrusion behavior within massive amounts of network data, and traditional methods fail to achieve a good balance between speed and accuracy, resulting in poor reliability of network threat monitoring and analysis results.
A network threat monitoring method based on the YOLO algorithm is adopted, which identifies and warns of network threats by combining data collection, feature extraction, preprocessing, deep learning model training and real-time detection with the principle of long short-term memory network.
It improves the reliability and accuracy of network threat monitoring and analysis results, and enables high-speed security monitoring and accurate early warning of the increasing network traffic data threats.
Smart Images
Figure CN119276563A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network threat monitoring, and in particular to a network threat monitoring and early warning method based on the YOLO algorithm. Background Art
[0002] With the development and popularization of network technology, a huge amount of traffic data is generated on the Internet every day. The rapid development of Internet technology has improved people's quality of life on the one hand, but it has also brought potential network threats to individuals, enterprises and countries on the other hand. Network security issues are receiving more and more attention.
[0003] Among the massive amount of network data, some intrusion behaviors in the network may directly or indirectly attack the platform. For example, distributed denial of service attacks are a common attack method used by hackers. By consuming the resources of the attacked host, legitimate users are denied normal access to network system resources. It is difficult to prevent and poses a great threat to organizations and companies. Common network threat monitoring methods usually monitor the data flow in the network in real time to detect abnormal traffic and attack behaviors, and monitor and detect network intrusion behaviors through intrusion monitoring systems to achieve network threat monitoring and early warning.
[0004] Currently, network threats vary in types and have different ways of affecting device functions. Faced with the increasing amount of massive data information, traditional methods find it difficult to quickly detect intrusions, and cannot achieve a good balance between speed and accuracy. In addition, threat detection in network traffic data requires analysis of effective feature data, and traditional detection methods do not involve the extraction of effective feature data, resulting in poor reliability of network threat monitoring and analysis results. Summary of the invention
[0005] The purpose of the present invention is to provide a network threat monitoring and early warning method based on the YOLO algorithm to solve the following technical problems:
[0006] How to cope with the security monitoring of the ever-increasing network traffic data and ensure the reliability of network threat monitoring and analysis results.
[0007] The purpose of the present invention can be achieved through the following technical solutions:
[0008] A network threat monitoring and early warning method based on the YOLO algorithm, the method comprising:
[0009] S1: Collect network traffic data through the data acquisition module and extract valid feature data from all network traffic data;
[0010] S2: convert the obtained one-dimensional effective characteristic network traffic data into two-dimensional visualization data;
[0011] S3: Preprocess the data to determine the location information of the intrusion behavior in the two-dimensional network traffic data, add detection boxes to the threat data and classify them to form a training set and a verification set;
[0012] S4: Build a deep learning model of the YOLO algorithm, integrate the principle of long short-term memory network, input the labeled training set into the deep learning model for training, and then verify the results by inputting the validation set, and correct the model in time;
[0013] S5: Real-time detection, inputting the pre-processed network traffic data into the deep learning model to obtain information such as the type, probability, and location of the detected intrusion behavior;
[0014] S6: Compare the current result of detecting network intrusion behavior with the set threshold, determine whether the current network traffic contains intrusion behavior, and confirm and warn the intrusion behavior;
[0015] S7: Analyze the threat level of the intrusion behavior existing in the network traffic data, and obtain the threat level of the network traffic data.
[0016] Furthermore, the process of extracting effective feature data in S1 includes:
[0017] By formula Calculate the characteristic loss coefficient t of the xth group of network traffic data x ;
[0018] Among them, p is the total amount of all network data collected, x is any set of network traffic data among all the network data collected, cf x is the number of repeated packets of the xth group of network traffic data, cw x is the number of error packets of the xth group of network traffic data, r1 and r2 are the first weight coefficients, zsl x is the total number of packets of the xth group of network traffic data, sl x is the link rate of the xth group of network traffic data, sl y is the preset link rate, sl b for sl x The standard value, f k To define a function, if (sl y -sl x )≥1, then let f k =(sl y -sl x ), if (sl y -sl x )<1, then let f k =1,dv xis the packet size of the xth group of network traffic data, dv y is the preset data packet size, dv b For DV x The standard value of , θ is the error influence coefficient, which is set according to empirical fitting;
[0019] The process of extracting effective feature data in S1 also includes:
[0020] By taking all the characteristic loss coefficients t of the network traffic data of all groups x Respectively with the preset feature loss coefficient threshold t 01 Make a comparison;
[0021] If x >t 01 , it is determined that the feature loss of this group of network traffic data is large, and it is classified as non-valid feature data;
[0022] If x ≤t 01 , determine that the feature loss of this group of network traffic data is small, classify it as valid feature data, and extract the data.
[0023] Furthermore, the process of converting the obtained one-dimensional network traffic data into two-dimensional visualization data in S2 includes:
[0024] S21: segmenting the extracted effective characteristic network traffic data into segments with a fixed length of L, and then encoding the segmented data into a matrix Z of size m×n;
[0025] S22: normalize the matrix Z to convert the values in the matrix into a range of 0 to 1;
[0026] S23: grayscale the new matrix obtained after normalization;
[0027] S24: After processing, a matrix between 0 and 255 is obtained, forming visualized two-dimensional data and retaining its mapping relationship.
[0028] Furthermore, the process of training the data set in S3 includes:
[0029] First, find the location information of network intrusion behavior, and use traditional anomaly detection methods to find data with threatening intrusion behavior. Then, add a detection box to mark its location in the two-dimensional data through the mapping relationship to obtain the feature data set X. wide ={x1,x2,x3,...xn};
[0030] Among them, x1, x2, x3…xn are feature elements, and n is the original number in the two-dimensional data set.
[0031] Furthermore, the process of constructing the deep learning model of the YOLO algorithm in S4 includes:
[0032] Detect network threat behaviors through the YOLO deep learning model;
[0033] And through the formula Loss = Loss box +a*Loss obj +b*Loss cls Calculate and obtain the total loss coefficient;
[0034] Among them, Loss box is the predicted detection box loss, Loss cls is the predicted category loss, Loss obj is the predicted confidence loss, a and b are the descent speed weight coefficients used to adjust the loss during the gradient descent iteration process.
[0035] Furthermore, the real-time detection process in S5 includes:
[0036] First, the network traffic data flowing through the device is preprocessed to meet the input of the YOLO model and be consistent with the training set processing. Feature information is obtained through analysis, and then the one-dimensional data is converted into two-dimensional visualization data and input into the model for threat detection.
[0037] Furthermore, the determination process in S6 includes:
[0038] When the data to be detected is input and the result of intrusion behavior detection is obtained, it needs to be compared with the set probability threshold;
[0039] If it is greater than or equal to the threshold, it is determined as a certain type of intrusion behavior and an early warning is issued;
[0040] If it is less than the threshold, the probability information is retained, and the detection probability of the intrusion behavior is temporarily retained using the principle of long short-term memory network.
[0041] Furthermore, the analysis process in S7 includes:
[0042] After obtaining the network detection results, using multi-dimensional features as data, such as the type and quantity of intrusion behaviors and the network impact caused, and establishing an assessment platform through constructing an assessment model, and inputting the data into the model, we can obtain a level classification of the current network threat level.
[0043] Beneficial effects of the present invention:
[0044] (1) The present invention can ensure the reliability and accuracy of network traffic data by extracting effective feature data from the network traffic data, thereby improving the reliability of network threat monitoring and analysis results. In addition, by applying the currently mature image processing algorithm to the processing of network traffic data, a new detection method is provided for network traffic data processing. Its high-speed detection method can cope with the security monitoring of the increasing number of network traffic data threats.
[0045] (2) The present invention calculates the characteristic loss coefficient t of all groups of network traffic data x Respectively with the preset feature loss coefficient threshold t 01 By comparing, we can make an accurate judgment and classification on whether the data is valid feature data according to the size of the feature loss coefficient of the x-th group of network traffic data, so as to facilitate the subsequent extraction of valid feature network data and ensure the network threat monitoring based on the valid feature network data, thereby improving the reliability of the monitoring and analysis results.
[0046] (3) The present invention inputs two-dimensional data into the deep learning model in real time, identifies network threat data, and obtains data detection result information. It is convenient, fast, and highly efficient, thereby achieving security monitoring to cope with the increasing threats to network traffic data. In addition, by obtaining data detection result information, an accurate judgment can be made on whether there is a threat in the data, thereby realizing an early warning function.
[0047] (4) The present invention incorporates the long short-term memory network principle into the YOLO model. Since some intrusion behaviors may affect multiple data segments, detecting only one two-dimensional data slice may not be sufficient to determine the intrusion behavior. During detection, not only the current detection result but also the detection result of the previous data segment are considered to comprehensively judge the intrusion behavior. Therefore, through such a setting, the above losses are weighted and accumulated together to form a calculation formula for the total loss function. The false alarm rate and the missed alarm rate can be calculated by the above formula. BRIEF DESCRIPTION OF THE DRAWINGS
[0048] The present invention will be further described below in conjunction with the accompanying drawings.
[0049] Figure 1 It is a flow chart of a network threat monitoring and early warning method based on the YOLO algorithm in the present invention;
[0050] Figure 2 It is a flow chart of the process of converting the obtained one-dimensional network flow data into two-dimensional visualization data in the present invention. DETAILED DESCRIPTION
[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0052] See also Figure 1 As shown, in one embodiment, the present application provides a network threat monitoring and early warning method based on the YOLO algorithm, the method comprising:
[0053] S1: Collect network traffic data through the data acquisition module and extract valid feature data from all network traffic data;
[0054] S2: convert the obtained one-dimensional effective characteristic network traffic data into two-dimensional visualization data;
[0055] S3: Preprocess the data to determine the location information of the intrusion behavior in the two-dimensional network traffic data, add detection boxes to the threat data and classify them to form a training set and a verification set;
[0056] S4: Build a deep learning model of the YOLO algorithm, integrate the principle of long short-term memory network, input the labeled training set into the deep learning model for training, and then verify the results by inputting the validation set, and correct the model in time;
[0057] S5: Real-time detection, inputting the pre-processed network traffic data into the deep learning model to obtain information such as the type, probability, and location of the detected intrusion behavior;
[0058] S6: Compare the current result of detecting network intrusion behavior with the set threshold, determine whether the current network traffic contains intrusion behavior, and confirm and warn the intrusion behavior;
[0059] S7: Analyze the threat level of the intrusion behavior existing in the network traffic data, and obtain the threat level of the network traffic data;
[0060] Through the above technical scheme, this embodiment provides a network threat monitoring and early warning method based on the YOLO algorithm. First, the network traffic data is collected through the data acquisition module, and the effective feature data in all the network traffic data is extracted, and the obtained one-dimensional effective feature network traffic data is converted into two-dimensional visualization data. Then, the data is preprocessed to determine the location information of the intrusion behavior in the two-dimensional network traffic data, and the detection frame is added to the threat data and classified to form a training set and a verification set, and a deep learning model of the YOLO algorithm is constructed, and the long short-term memory network principle is integrated. The labeled training set is input into the deep learning model for training, and then the result obtained is verified by inputting the verification set, and the model is corrected in time. In real-time detection, the preprocessed network traffic data is input into the deep learning model to obtain the type, probability, location and other information of the detected intrusion behavior, and the result of the current detection of the network intrusion behavior is compared with the set threshold to determine whether the current network traffic contains intrusion behavior, determine and warn the intrusion behavior; finally, the threat level of the intrusion behavior existing in the network traffic data can be analyzed, and the threat level of the network traffic data can be obtained;
[0061] Through such a setting, after extracting the effective feature data in the network traffic data, the reliability and accuracy of the network traffic data can be guaranteed, thereby improving the reliability of the network threat monitoring and analysis results, and by applying the currently mature image processing algorithm to the processing of network traffic data, a new detection method is brought to the network traffic data processing. Its high-speed detection method can cope with the security monitoring of the increasing network traffic data threats.
[0062] The process of extracting effective feature data in S1 includes:
[0063] By formula Calculate the characteristic loss coefficient t of the xth group of network traffic data x ;
[0064] Among them, p is the total amount of all network data collected, x is any set of network traffic data among all the network data collected, cf x is the number of repeated packets of the xth group of network traffic data, cw x is the number of error packets of the xth group of network traffic data, r1 and r2 are the first weight coefficients, zsl x is the total number of packets of the xth group of network traffic data, sl x is the link rate of the xth group of network traffic data, sl y is the preset link rate, sl b for sl x The standard value, f k To define a function, if (sly -sl x )≥1, then let f k =(sl y -sl x ), if (sl y -sl x )<1, then let f k =1,dv x is the packet size of the xth group of network traffic data, dv y is the preset data packet size, dv b For DV x The standard value of , θ is the error influence coefficient, which is set according to empirical fitting;
[0065] The process of extracting effective feature data in S1 also includes:
[0066] By taking all the characteristic loss coefficients t of the network traffic data of all groups x Respectively with the preset feature loss coefficient threshold t 01 Make a comparison;
[0067] If x >t 01 , it is determined that the feature loss of this group of network traffic data is large, and it is classified as non-valid feature data;
[0068] If x ≤t 01 , determine that the feature loss of the group of network traffic data is small, classify it as valid feature data, and extract the data;
[0069] Through the above technical solution, this embodiment provides the characteristic loss coefficient t of the xth group of network traffic data x , can be obtained by formula It is calculated that, obviously, when the number of duplicate data packets and error data packets in the x-th group of network traffic data is more, the link rate of the network traffic data is higher, and the size of the data packet differs more from the preset data packet size, then the characteristic loss amount of the group is greater; conversely, when the number of duplicate data packets and error data packets in the x-th group of network traffic data is less, the link rate of the network traffic data is lower, and the size of the data packet differs less from the preset data packet size, then the characteristic loss amount of the group is smaller;
[0070] And by taking the characteristic loss coefficient t of all groups of network traffic data x Respectively with the preset feature loss coefficient threshold t 01By comparing, we can make an accurate judgment and classification on whether the data is valid feature data according to the size of the feature loss coefficient of the x-th group of network traffic data, so as to facilitate the subsequent extraction of valid feature network data and ensure the network threat monitoring based on the valid feature network data, thereby improving the reliability of the monitoring and analysis results.
[0071] See also Figure 2 As shown, the process of converting the obtained one-dimensional network traffic data into two-dimensional visualization data in S2 includes:
[0072] S21: segmenting the extracted effective characteristic network traffic data into segments with a fixed length of L, and then encoding the segmented data into a matrix Z of size m×n;
[0073] S22: normalize the matrix Z to convert the values in the matrix into a range of 0 to 1;
[0074] S23: grayscale the new matrix obtained after normalization;
[0075] S24: After processing, a matrix between 0 and 255 is obtained, forming visualized two-dimensional data and retaining its mapping relationship;
[0076] Through the above technical solution, this embodiment provides a process of converting the obtained one-dimensional network traffic data into two-dimensional visualization data. First, the extracted effective feature network traffic data is segmented with a fixed length of L, and then the segmented data is encoded into a matrix Z of size m×n, as shown in the following formula:
[0077] L = m*n;
[0078] Then the matrix Z is normalized to convert the values in the matrix to the range of 0 to 1. The conversion formula is as follows:
[0079]
[0080] After that, the new matrix will be normalized and grayscaled:
[0081] A image =Z(t) norm *255;
[0082] With such settings, a matrix between 0 and 255 is obtained after processing, forming visual two-dimensional data and retaining its mapping relationship. When extracting data, the intrusion behavior data can be quickly found through the mapping relationship, and then grayscale processing is performed to convert it into image data, thereby improving the speed of data analysis.
[0083] The process of training the dataset in S3 includes:
[0084] First, find the location information of network intrusion behavior, and use traditional anomaly detection methods to find data with threatening intrusion behavior. Then, add a detection box to mark its location in the two-dimensional data through the mapping relationship to obtain the feature data set X. wide ={x1,x2,x3,...xn};
[0085] Among them, x1, x2, x3…xn are feature elements, and n is the original number in the two-dimensional data set;
[0086] Through the above technical solution, this embodiment provides a process of training a data set. By annotating the data set, a traditional anomaly detection method is first used to detect network traffic data with intrusion behavior. The threat data position in the two-dimensional data is found through a mapping relationship and a detection box is added. The annotated data of the intrusion is recorded, including the coordinate position information of the two-dimensional data being processed by the current threat behavior, etc., to obtain a training set and a verification set that can be used to train the YOLO model, thereby improving the efficiency and speed of subsequent monitoring of network threats to cope with the security detection of the increasing network traffic data, wherein the data annotation may include a mark of an attack mode or a mark of a malicious behavior. The attack mode may include a DDoS attack, a port scan, etc., and the malicious behavior mark may include abnormal traffic, abnormal requests, etc. The intrusion behavior data can also be collected from an existing abnormal behavior database. Through such a setting, security monitoring of the increasing threats to network traffic data can be achieved.
[0087] The process of constructing the deep learning model of the YOLO algorithm in S4 includes:
[0088] Detect network threat behaviors through the YOLO deep learning model;
[0089] And through the formula Loss = Loss box +a*Loss obj +b*Loss cls Calculate and obtain the total loss coefficient;
[0090] Among them, Loss box is the predicted detection box loss, Loss cls is the predicted category loss, Loss obj is the predicted confidence loss, a and b are the descent speed weight coefficients used to adjust the loss during the gradient descent iteration process;
[0091] Through the above technical solution, this embodiment provides a process of building a deep learning model of the YOLO algorithm. First, the processed two-dimensional network traffic data set is input into the YOLO model for training, and a large number of data sets are used to train the network parameters for its detection. Then, the two-dimensional grayscale data is divided into S×S regions, and B bounding boxes are predicted for each region to achieve C types of target classification;
[0092] Among them, the predicted detection box loss can be obtained by formula Calculate and obtain;
[0094] The predicted category loss can be obtained by the formula Calculate and obtain;
[0095] The predicted confidence loss can be obtained by the formula Calculate and obtain;
[0096] Where i is any region, j is any bounding box, is the first control function, obj is any processing object, indicating that the grid points in the ith region that contain objects are 1, and those that do not contain objects are 0. It is used to determine whether the object falls into the ith region. is the second control function, which means that the grid points in the jth bounding box in the i-th region that contain objects are 1, and those that do not contain objects are 0. It is used to determine whether the jth bounding box in the i-th region is responsible for this object. is the third control function, which means that the grid points in the jth bounding box in the ith region that contain objects are 0, and those that do not contain objects are 1. x, y, w, and h are the coordinates of the detection box and the width and height of the box, respectively. i is the true value of the x-coordinate of the i-th detection box, is the predicted value of the x coordinate of the i-th detection box, y i is the true value of the y coordinate of the i-th detection box, is the predicted value of the y coordinate of the i-th detection box, w i is the true value of the width of the i-th detection box, is the predicted value of the width of the i-th detection box, h i is the true value of the height of the i-th detection box, The predicted value of the height of the i-th detection box, p i (C) is the target prediction value, is the predicted confidence value after the sigmoid function, C i and is whether the corresponding object has a logo, λ coord , noobj is the weight of the loss function;
[0097] The long short-term memory network principle is integrated into the YOLO model. Since some intrusion behaviors may affect multiple data segments, detecting only one two-dimensional data slice may not be sufficient to determine the intrusion behavior. During detection, not only the current detection result but also the detection result of the previous data segment are considered to comprehensively judge the intrusion behavior. Therefore, through such a setting, the above losses are weighted and accumulated together to form the calculation formula of the total loss function. The above formula can be used to calculate the false alarm rate and missed alarm rate.
[0098] The real-time detection process in S5 includes:
[0099] First, the network traffic data flowing through the device is preprocessed to meet the input of the YOLO model and be consistent with the training set processing. Feature information is obtained through analysis, and then the one-dimensional data is converted into two-dimensional visualization data and input into the model for threat detection.
[0100] Through the above technical solution, this embodiment provides a real-time detection process. First, it is necessary to deploy a deep learning model to the network traffic management device and introduce the network traffic data into the model. Then, the detection data needs to be processed in real time. Similar to the training set, the network traffic data is first parsed and feature matched to obtain key data information. The key data is then segmented, and the one-dimensional data is converted into two-dimensional visual data through the above mapping relationship. Finally, the two-dimensional data is input into the deep learning model in real time to identify network threat data and obtain data detection result information. It is convenient, fast and efficient, thereby realizing security monitoring in response to the increasing threats of network traffic data. By obtaining the data detection result information, an accurate judgment can be made on whether the data is threatened, thereby realizing the early warning function.
[0101] The judgment process in S6 includes:
[0102] When the data to be detected is input and the result of intrusion behavior detection is obtained, it needs to be compared with the set probability threshold;
[0103] If it is greater than or equal to the threshold, it is determined as a certain type of intrusion behavior and an early warning is issued;
[0104] If it is less than the threshold, the probability information is retained, and the detection probability of the intrusion behavior is temporarily retained using the principle of long short-term memory network;
[0105] Through the above technical solution, in order to determine whether the detection result is a network intrusion behavior, a threat detection threshold θ needs to be set rWhen the probability of intrusion detection is greater than the threshold, the current detected traffic data is considered to be an intrusion behavior, and it needs to be marked and warned. When the probability of intrusion detection is less than the threshold, it is considered that the current detection result may be a false alarm for normal network data, but it cannot be ruled out, and the data needs to be retained. Through the integration of the long short-term memory network principle, the subsequent detection results are used for joint judgment. Through such a setting, the comparison between the results of data intrusion behavior detection and the threshold can be used to judge whether the data is a threat, thereby realizing the warning function;
[0106] It should be noted that the threat detection threshold θ r It can be set based on experience fitting.
[0107] The analysis process in S7 includes:
[0108] After obtaining the network detection results, we use multi-dimensional features as data, such as the type and quantity of intrusion behaviors and the network impact caused, to build an assessment model and establish an assessment platform. By inputting the data into the model, we can obtain a classification of the current network threat level.
[0109] Through the above technical scheme, in order to have a clear understanding of the current network threat intrusion situation, the threat level in the network traffic is rated through multi-dimensional features. Maintenance personnel can take targeted measures in a timely manner through understanding the threat level. The multi-dimensional features can include the type and quantity of the detected intrusion behaviors, as well as the specific impact caused, etc., which are formed into a set of feature vectors. Combined with the previous judgment of the intrusion behavior, the weight value of the threat is trained, and the corresponding processing method is obtained by calculating the level. For example: when a certain intrusion behavior is detected in the current network, the intrusion behavior can be dealt with by limiting the influencing factors of the intrusion behavior; when multiple serious intrusion behaviors are detected in the current network, the current threat level will increase, and the network maintenance personnel can temporarily stop the operation of the network equipment, deeply clean up the network intrusion behavior, and protect the normal operation of the equipment; when it is detected that there is no intrusion behavior in the network, the threat level will be reduced, and the maintenance personnel will continue to observe the network traffic detection, thereby realizing the dangerous monitoring and early warning of network data.
[0110] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.
Claims
1. A network threat monitoring and early warning method based on the YOLO algorithm, characterized in that: The method comprises: S1: Collect network traffic data through the data acquisition module and extract valid feature data from all network traffic data; S2: convert the obtained one-dimensional effective characteristic network traffic data into two-dimensional visualization data; S3: Preprocess the data to determine the location information of the intrusion behavior in the two-dimensional network traffic data, add detection boxes to the threat data and classify them to form a training set and a verification set; S4: Build a deep learning model of the YOLO algorithm, integrate the principle of long short-term memory network, input the labeled training set into the deep learning model for training, and then verify the results by inputting the validation set, and correct the model in time; S5: Real-time detection, inputting the pre-processed network traffic data into the deep learning model to obtain information such as the type, probability, and location of the detected intrusion behavior; S6: Compare the current result of detecting network intrusion behavior with the set threshold, determine whether the current network traffic contains intrusion behavior, and confirm and warn the intrusion behavior; S7: Analyze the threat level of the intrusion behavior existing in the network traffic data, and obtain the threat level of the network traffic data.
2. A network threat monitoring and early warning method based on the YOLO algorithm according to claim 1, characterized in that: The process of extracting effective feature data in S1 includes: By formula Calculate the characteristic loss coefficient t of the xth group of network traffic data x ; Among them, p is the total amount of all network data collected, x is any set of network traffic data among all the network data collected, cf x is the number of repeated packets of the xth group of network traffic data, cw x is the number of error packets of the xth group of network traffic data, r1 and r2 are the first weight coefficients, zsl x is the total number of packets of the xth group of network traffic data, sl x is the link rate of the xth group of network traffic data, sl y is the preset link rate, sl b for sl x The standard value, f k To define a function, if (sl y -sl x )≥1, then let f k =(sl y -sl x ), if (sl y -sl x )<1, then let f k =1,dv x is the packet size of the xth group of network traffic data, dv y is the preset data packet size, dv b For DV x The standard value of , θ is the error influence coefficient, which is set according to empirical fitting; The process of extracting effective feature data in S1 also includes: By taking all the characteristic loss coefficients t of the network traffic data of all groups x Respectively with the preset feature loss coefficient threshold t 01 Make a comparison; If x >t 01 , it is determined that the feature loss of this group of network traffic data is large, and it is classified as non-valid feature data; If x ≤t 01 , determine that the feature loss of this group of network traffic data is small, classify it as valid feature data, and extract the data.
3. A network threat monitoring and early warning method based on YOLO algorithm according to claim 1, characterized in that: The process of converting the obtained one-dimensional network traffic data into two-dimensional visualization data in S2 includes: S21: segmenting the extracted effective characteristic network traffic data into segments with a fixed length of L, and then encoding the segmented data into a matrix Z of size m×n; S22: normalize the matrix Z to convert the values in the matrix into a range of 0 to 1; S23: grayscale the new matrix obtained after normalization; S24: After processing, a matrix between 0 and 255 is obtained, forming visualized two-dimensional data and retaining its mapping relationship.
4. A network threat monitoring and early warning method based on YOLO algorithm according to claim 1, characterized in that: The process of training the dataset in S3 includes: First, find the location information of network intrusion behavior, and use traditional anomaly detection methods to find data with threatening intrusion behavior. Then, add a detection box to mark its location in the two-dimensional data through the mapping relationship to obtain the feature data set X. wide ={x1,x2,x3,...xn}; Among them, x1, x2, x3…xn are feature elements, and n is the original number in the two-dimensional data set.
5. A network threat monitoring and early warning method based on YOLO algorithm according to claim 1, characterized in that: The process of constructing the deep learning model of the YOLO algorithm in S4 includes: Detect network threat behaviors through the YOLO deep learning model; And through the formula Loss = Loss box +a*Loss obj +b*Loss cls Calculate and obtain the total loss coefficient; Among them, Loss box is the predicted detection box loss, Loss cls is the predicted category loss, Loss obj is the predicted confidence loss, a and b are the descent speed weight coefficients used to adjust the loss during the gradient descent iteration process.
6. A network threat monitoring and early warning method based on YOLO algorithm according to claim 1, characterized in that: The real-time monitoring process in S5 includes: First, the network traffic data flowing through the device is preprocessed to meet the input of the YOLO model and be consistent with the training set processing. Feature information is obtained through analysis, and then the one-dimensional data is converted into two-dimensional visualization data and input into the model for threat detection.
7. A network threat monitoring and early warning method based on the YOLO algorithm according to claim 1, characterized in that: The judgment process in S6 includes: When the data to be detected is input and the result of intrusion behavior detection is obtained, it needs to be compared with the set probability threshold; If it is greater than or equal to the threshold, it is determined as a certain type of intrusion behavior and an early warning is issued; If it is less than the threshold, the probability information is retained, and the detection probability of the intrusion behavior is temporarily retained using the principle of long short-term memory network.
8. A network threat monitoring and early warning method based on the YOLO algorithm according to claim 1, characterized in that: The analysis process in S7 includes: After obtaining the network detection results, using multi-dimensional features as data, such as the type and quantity of intrusion behaviors and the network impact caused, and establishing an assessment platform through constructing an assessment model, and inputting the data into the model, we can obtain a level classification of the current network threat level.
Citation Information
Cited By
SDN controller load balancing method based on graph neural network and evolutionary algorithm
CN120434126A