Computer network security dynamic protection method and system based on fusion factors
By setting up dynamic protection and detection modes and deep reinforcement learning models in computer networks, the problem of low efficiency in computer network security protection in existing technologies is solved, and dynamic autonomous protection and early warning capabilities are realized in different environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG INTERNATIONAL TRADE GROUP CO LTD
- Filing Date
- 2024-10-08
- Publication Date
- 2026-05-12
AI Technical Summary
Existing computer network security protection strategies lack the ability to respond to different environments and proactively handle the risks of abnormal behavior, resulting in low protection efficiency and increased computer processor load.
A dynamic protection method for computer network security based on fusion factors is adopted. By setting up a dynamic security protection detection mode, combining a deep reinforcement learning model to construct a decision-making method, establishing a database of abnormal network behavior features, and adjusting parameters based on the model decision results, the detection mode and processing scheme are optimized.
It improves the adaptability and efficiency of computer network security protection, reduces processor load, and realizes dynamic autonomous protection and early warning capabilities in different environments.
Smart Images
Figure CN119276570B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer network security, specifically to a dynamic protection method and system for computer network security based on fusion factors. Background Technology
[0002] With the rapid development of the information age, computer network technology has been applied to all walks of life. Ensuring computer network security is of great significance for protecting personal information, maintaining the normal operation of enterprises, and ensuring enterprise stability. For complex and ever-changing computer network environments, it is necessary to consider the influence of multiple factors. Therefore, by integrating multiple factors and combining dynamic protection technologies and methods, we can improve the ability to defend against unknown advanced network threats and the ability to automatically handle risks.
[0003] Existing computer network security protection strategies mainly rely on traditional static security measures, such as firewalls and intrusion detection systems. Faced with complex computer network environments, they lack the ability to respond to different environments and proactively handle the risks of abnormal behavior, resulting in low efficiency of computer network security protection and increased load on computer processors. Summary of the Invention
[0004] To address the aforementioned technical problems, this paper provides a dynamic protection method and system for computer network security based on fusion factors. This technical solution solves the problems mentioned in the background art, such as the lack of ability to respond to different environments and proactively handle abnormal behavior risks, which leads to low efficiency of computer network security protection and increased load on computer processors.
[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0006] A dynamic computer network security protection method based on fusion factors includes:
[0007] Set up dynamic security protection and detection modes for different computer network application environments;
[0008] Based on the detection content of the security dynamic protection mode, set corresponding security dynamic protection schemes;
[0009] A decision-making method for dynamic protection of computer network security is constructed based on a deep reinforcement learning model.
[0010] Based on the decision results of the deep reinforcement learning model, corresponding protection schemes are adopted to address network risks;
[0011] Establish a network abnormal behavior feature database, and adjust the model parameters and optimize the network abnormal behavior feature database by comparing it with the decision results of the model.
[0012] Preferably, the setting of dynamic security protection modes for different computer network application environments specifically includes:
[0013] Based on the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection, a dynamic security protection detection mode is set according to different computer network application environments.
[0014] For application environments where computer network security requirements are not high but information confidentiality is necessary, a single port number detection mode is adopted.
[0015] For application environments with high computer network security requirements that do not require precise identification of traffic behavior, a single mode of deep packet inspection is adopted.
[0016] For computer network security applications that require accurate identification and fast processing of traffic behavior, a single-mode deep flow detection is adopted.
[0017] For other computer network security needs, a joint detection mode is set up by considering the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection modes. The detection results are adjusted by setting the weight of each detection mode.
[0018] Based on the DS evidence theory, the proportion of port number detection, deep packet detection, and deep flow detection in the joint detection mode is calculated.
[0019] The weight expression for each detection is as follows:
[0020]
[0021] Where y represents the linear relationship between several detection methods, x1 represents port number detection, x2 represents deep packet detection, x3 represents deep flow detection, ε1 represents the weight of port number detection, ε2 represents the weight of deep packet detection, and ε3 represents the weight of deep flow detection.
[0022] The expression for the DS evidence theory is as follows:
[0023]
[0024] Where m(A) represents the confidence level of using the A-th detection method, K is the normalization constant, and m i (A i ) represents the probability of using the i-th feature item with the A-th detection method, and n represents the number of feature items using the A-th detection method.
[0025] Preferably, the detection content based on the dynamic security protection mode, and the corresponding dynamic security protection scheme specifically include:
[0026] Based on historical data of abnormal network behavior, the detection content features of each detection mode are determined;
[0027] For each detection mode's detection content features, a standardized processing scheme for network abnormal behavior features is set.
[0028] Based on the characteristics of the detected content and the standardized processing scheme, establish a standardized processing list for abnormal behaviors.
[0029] Preferably, the decision-making method for constructing dynamic protection of computer network security based on a deep reinforcement learning model specifically includes:
[0030] Based on the standardized handling checklist for abnormal behavior, determine the probability of choosing a strategy among different handling options;
[0031] Based on the Markov chain algorithm, the probability value of the state at future time moments is determined according to the computer network when identifying different detection content features;
[0032] Based on the standardized list of abnormal behaviors, calculate the cumulative reward feedback value corresponding to the completion of a decision.
[0033] Based on a deep reinforcement learning model and the Monte Carlo algorithm, we determine the expected total reward for a computer network to make a decision in this state.
[0034] Based on a deep reinforcement learning model and the SARSA algorithm, we determine the expected total reward for a computer network to make a decision by selecting this action.
[0035] The probability expression for confirming the choice of strategy among different actions is as follows:
[0036] π(b|s)=P(B k =b|S k =s)
[0037] Where π(b|s) is the probability that the computer network selects the b-th processing scheme in state s, and B k S is a set of solutions for handling abnormal behavior characteristics of computer networks. k A set of current states of a computer network;
[0038] The Markov chain algorithm is as follows:
[0039] P[S k+1 |S k ]=P[S1|S2,S3,…,S i ,…,S k+1 ]
[0040] Among them, P[S k+1 |S k[S] represents the probability of the (k+1)th state in the k-th state of a computer network. k+1 S represents the (k+1)th future state of the computer network. k This represents the k-th state of the computer network.
[0041] The expression for the cumulative reward feedback value corresponding to the completion of a decision is as follows:
[0042]
[0043] Among them, G k G represents the cumulative reward feedback value corresponding to the k-th state of a decision made by the computer network, where γ is the discount factor for the future impact of the computer network on the present state. k+1 Let r be the cumulative reward feedback value corresponding to the (k+1)th state of a decision made by a computer network. k The reward feedback value corresponding to the k-th state for a computer network to complete a decision;
[0044] The computer network completes a decision in this state, corresponding to G. k The expected expression is:
[0045]
[0046] in, For the computer network, the corresponding state G in the k-th state of this policy k The expected value of the update, V(S) k ) represents the G corresponding to the k-th state of the computer network under this policy. k The expected value, where α is the learning rate, V(S) k+1 ) represents the G corresponding to the (k+1)th state of the computer network under this policy. k Expected value;
[0047] The computer network selects this action to complete a decision corresponding to G. k The expected expression is:
[0048]
[0049] in, For a computer network to select this action to complete a decision, the corresponding state in the k-th state is G. k The expected value of the update, Q(B) k ,S k For a computer network to select this action to complete a decision, the corresponding state in state k is G. k The expected value, β is the learning rate, Q(B) k+1 ,S k+1 For a computer network to select this action to complete a decision, the (k+1)th state corresponds to G. kThe expected value.
[0050] Preferably, the step of taking corresponding protection measures to address network risks based on the decision results of the deep reinforcement learning model specifically includes:
[0051] Based on the impact on network operation caused by abnormal network behavior characteristics and the ease of handling methods, the methods for handling abnormal network behavior characteristics are divided into categories.
[0052] Based on the learning and training results of deep reinforcement learning models, automatic decision-making is performed on common, simple, and low-impact network abnormal behavior features.
[0053] Based on the learning and training results of deep reinforcement learning models, early warning and alarm methods are set up for complex, novel, and impactful abnormal network behavior features that cause model overload, and the abnormal network behavior features are recorded.
[0054] Preferably, the step of establishing a network abnormal behavior feature database, and adjusting the model parameters and optimizing the network abnormal behavior feature database by comparing it with the model's decision results, specifically includes:
[0055] Based on the decision-making results of the standardized abnormal behavior processing list and model, a network abnormal behavior feature database is established.
[0056] By comparing the processing results of the network abnormal behavior feature database with the decision results of the model, the most suitable processing method is selected, and the model parameters are adjusted and the network abnormal behavior feature database is optimized based on the comparison results.
[0057] If the model's decision is better than the feature library's processing result, then the processing result recorded in the feature library is optimized; otherwise, the model's parameters need to be adjusted.
[0058] Furthermore, this solution proposes a dynamic computer network security protection system based on fusion factors to implement the aforementioned dynamic computer network security protection method based on fusion factors, including:
[0059] The detection and solution module is used to set up a dynamic security protection detection mode for different computer network application environments; and to set up a corresponding dynamic security protection solution based on the detection content of the dynamic security protection mode.
[0060] The protection and feedback module is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model; to take corresponding protection schemes to solve security risks according to the decision results of the deep reinforcement learning model; to establish a network abnormal behavior feature library, and to adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.
[0061] Preferably, the detection and solution module includes:
[0062] The detection mode setting unit is used to set a dynamic security protection detection mode for different computer network application environments.
[0063] The protection scheme setting unit is used to set a corresponding dynamic security protection scheme based on the detection content of the dynamic security protection mode.
[0064] Preferably, the protection and feedback module includes:
[0065] A protection decision unit is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model.
[0066] A protection scheme unit is used to take corresponding protection schemes to solve security risks based on the decision results of the deep reinforcement learning model.
[0067] The feature library feedback unit is used to establish a network abnormal behavior feature library, and adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.
[0068] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0069] Different network security detection modes are set according to different computer network environments. Based on the detection content of the dynamic security protection mode, a dynamic protection decision-making method for computer network security is constructed based on a deep reinforcement learning model. Through the learning and training of the model, dynamic autonomous protection of computer network security is realized, which effectively improves the computer network security protection capability and early warning capability in different environments and reduces network risks. Attached Figure Description
[0070] Figure 1 This is a flowchart of a dynamic computer network security protection method based on fusion factors according to the present invention.
[0071] Figure 2 This is a flowchart illustrating the dynamic security protection mode for different computer network application environments according to the present invention.
[0072] Figure 3 This is a flowchart illustrating the decision-making process for constructing dynamic protection of computer network security based on a deep reinforcement learning model, as described in this invention.
[0073] Figure 4To establish a network abnormal behavior feature database for this invention, the parameters of the model are adjusted and the network abnormal behavior feature database flowchart is optimized by comparing it with the decision results of the model. Detailed Implementation
[0074] The following description is intended to disclose the invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art.
[0075] Reference Figure 1 As shown, a dynamic computer network security protection method based on fusion factors includes:
[0076] Set up dynamic security protection and detection modes for different computer network application environments;
[0077] Based on the detection content of the security dynamic protection mode, set corresponding security dynamic protection schemes;
[0078] A decision-making method for dynamic protection of computer network security is constructed based on a deep reinforcement learning model.
[0079] Based on the decision results of the deep reinforcement learning model, corresponding protection schemes are adopted to address network risks;
[0080] Establish a network abnormal behavior feature database, and adjust the model parameters and optimize the network abnormal behavior feature database by comparing it with the decision results of the model.
[0081] This can be explained by the fact that, for complex and ever-changing computer network application environments, different detection modes can be adopted to accurately adapt the computer network to various external environments, reducing the load on the computer processor. Secondly, through the training and learning of deep reinforcement learning models, in the face of different detected abnormal behavior characteristics, the reward value fed back by the model training enables the computer network to achieve dynamic autonomous protection and autonomous handling of network risks caused by abnormal behavior, effectively improving the ability of computer network security to dynamically protect and issue early warnings in different environments, and reducing network risks.
[0082] Reference Figure 2 As shown, the specific steps for setting dynamic security protection modes for different computer network application environments include:
[0083] Based on the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection, a dynamic security protection detection mode is set according to different computer network application environments.
[0084] For application environments where computer network security requirements are not high but information confidentiality is necessary, a single port number detection mode is adopted.
[0085] For application environments with high computer network security requirements that do not require precise identification of traffic behavior, a single mode of deep packet inspection is adopted.
[0086] For computer network security applications that require accurate identification and fast processing of traffic behavior, a single-mode deep flow detection is adopted.
[0087] For other computer network security needs, a joint detection mode is set up by considering the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection modes. The detection results are adjusted by setting the weight of each detection mode.
[0088] Based on the DS evidence theory, the proportion of port number detection, deep packet detection, and deep flow detection in the joint detection mode is calculated.
[0089] The weight expression for each detection is as follows:
[0090]
[0091] Where y represents the linear relationship between several detection methods, x1 represents port number detection, x2 represents deep packet detection, x3 represents deep flow detection, ε1 represents the weight of port number detection, ε2 represents the weight of deep packet detection, and ε3 represents the weight of deep flow detection.
[0092] The expression for the DS evidence theory is as follows:
[0093]
[0094] Where m(A) represents the confidence level of using the A-th detection method, K is the normalization constant, and m i (A i ) represents the probability of using the i-th feature item with the A-th detection method, and n represents the number of feature items using the A-th detection method.
[0095] It can be explained that common computer network security detection methods include three modes: port number detection, deep packet inspection, and deep flow inspection. Port number detection is used to detect whether a computer network port is being used or to query which servers or programs are using that port. Deep packet inspection analyzes and detects network traffic packets based on three aspects: network characteristics, application gateways, and behavioral patterns. Deep flow inspection is mainly used to detect characteristics such as the total number of packets, total size, duration, average speed, and start and end times of the flow. By analyzing the characteristic items corresponding to the three detection modes, the appropriate detection mode for computer network security protection can be effectively selected, improving the computer's processing speed and making it more suitable for different computer network application environments.
[0096] Reference Figure 3 As shown, the decision-making method for constructing dynamic protection of computer network security based on a deep reinforcement learning model specifically includes:
[0097] Based on the standardized handling checklist for abnormal behavior, determine the probability of choosing a strategy among different handling options;
[0098] Based on the Markov chain algorithm, the probability value of the state at future time moments is determined according to the computer network when identifying different detection content features;
[0099] Based on the standardized list of abnormal behaviors, calculate the cumulative reward feedback value corresponding to the completion of a decision.
[0100] Based on a deep reinforcement learning model and the Monte Carlo algorithm, it is confirmed that the computer network makes a decision in this state corresponding to G. k Expectations;
[0101] Based on a deep reinforcement learning model and the SARSA algorithm, it is determined that the computer network selects this action to complete a decision corresponding to G. k Expectations;
[0102] The probability expression for confirming the choice of strategy among different actions is as follows:
[0103] π(b|s)=P(B k =b|S k =s)
[0104] Where π(b|s) is the probability that the computer network selects the b-th processing scheme in state s, and B k S is a set of solutions for handling abnormal behavior characteristics of computer networks. k A set of current states of a computer network;
[0105] The Markov chain algorithm is as follows:
[0106] P[S k+1 |S k ]=P[S1|S2,S3,…,S i ,…,S k+1 ]
[0107] Among them, P[S k+1 |S k [S] represents the probability of the (k+1)th state in the k-th state of a computer network. k+1 S represents the (k+1)th future state of the computer network. k This represents the k-th state of the computer network.
[0108] The expression for the cumulative reward feedback value corresponding to the completion of a decision is as follows:
[0109]
[0110] Among them, G k G represents the cumulative reward feedback value corresponding to the k-th state of a decision made by the computer network, where γ is the discount factor for the future impact of the computer network on the present state. k+1 Let r be the cumulative reward feedback value corresponding to the (k+1)th state of a decision made by a computer network. k The reward feedback value corresponding to the k-th state for a computer network to complete a decision;
[0111] The computer network completes a decision in this state, corresponding to G. k The expected expression is:
[0112]
[0113] in, For the computer network, the corresponding state G in the k-th state of this policy k The expected value of the update, V(S) k ) represents the G corresponding to the k-th state of the computer network under this policy. k The expected value, where α is the learning rate, V(S) k+1 ) represents the G corresponding to the (k+1)th state of the computer network under this policy. k Expected value;
[0114] The computer network selects this action to complete a decision corresponding to G. k The expected expression is:
[0115]
[0116] in, For a computer network to select this action to complete a decision, the corresponding state in the k-th state is G. k The expected value of the update, Q(B) k ,S k For a computer network to select this action to complete a decision, the corresponding state in state k is G. k The expected value, β is the learning rate, Q(B) k+1 ,S k+1 For a computer network to select this action to complete a decision, the (k+1)th state corresponds to G. k The expected value.
[0117] This can be explained as follows: a deep reinforcement learning model is a way for an intelligent machine to select different processing methods under different states and obtain reward values. By judging the magnitude of the reward value, the model selects the method with the higher reward value as the optimal method. Through the training and learning of the model, the goal of dynamic autonomous protection of computer network security can be effectively achieved, and the ability to proactively handle abnormal behavior risks can be improved. The reward value for selecting different methods is determined by judging the matching degree of the solutions corresponding to different feature items. The reward value can be optimized through the results of multiple training and learning of the model.
[0118] Reference Figure 4 As shown, the establishment of the network abnormal behavior feature database, and the adjustment of model parameters and optimization of the network abnormal behavior feature database by comparing it with the decision results of the model, specifically includes:
[0119] Based on the decision-making results of the standardized abnormal behavior processing list and model, a network abnormal behavior feature database is established.
[0120] By comparing the processing results of the network abnormal behavior feature database with the decision results of the model, the most suitable processing method is selected, and the model parameters are adjusted and the network abnormal behavior feature database is optimized based on the comparison results.
[0121] If the model's decision is better than the feature library's processing result, then the processing result recorded in the feature library is optimized; otherwise, the model's parameters need to be adjusted.
[0122] This can be explained by the fact that the training and learning of deep reinforcement learning models require a certain number of network abnormal behavior feature samples. For complex, novel, and impactful network abnormal behavior features that overload the model, a new list of corresponding feature samples needs to be established. The deep reinforcement learning model is then updated through training and learning. By comparing the processing results recorded in the network abnormal behavior feature database with the model's decision results, the most suitable processing method is selected. Based on the comparison results, the model parameters are adjusted and the network abnormal behavior feature database is optimized, thus enabling the establishment of a dynamic protection mechanism for computer network security in real time.
[0123] Furthermore, based on the same inventive concept as the aforementioned dynamic protection method for computer network security based on fusion factors, this solution proposes a dynamic protection system for computer network security based on fusion factors, comprising:
[0124] The detection and solution module is used to set up a dynamic security protection detection mode for different computer network application environments; and to set up a corresponding dynamic security protection solution based on the detection content of the dynamic security protection mode.
[0125] The protection and feedback module is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model; to take corresponding protection schemes to solve security risks according to the decision results of the deep reinforcement learning model; to establish a network abnormal behavior feature library, and to adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.
[0126] The detection and solution module includes:
[0127] The detection mode setting unit is used to set a dynamic security protection detection mode for different computer network application environments.
[0128] The protection scheme setting unit is used to set a corresponding dynamic security protection scheme based on the detection content of the dynamic security protection mode.
[0129] The protection and feedback module includes:
[0130] A protection decision unit is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model.
[0131] A protection scheme unit is used to take corresponding protection schemes to solve security risks based on the decision results of the deep reinforcement learning model.
[0132] The feature library feedback unit is used to establish a network abnormal behavior feature library, and adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.
[0133] In summary, the advantages of this invention are as follows: different network security detection modes are set according to different computer network environments, and based on the detection content of the dynamic security protection mode, a dynamic protection decision-making method for computer network security is constructed based on a deep reinforcement learning model. Through the learning and training of the model, dynamic autonomous protection of computer network security is realized, effectively improving the computer network security protection capability and early warning capability in different environments, and reducing network risks.
[0134] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.
Claims
1. A dynamic protection method for computer network security based on fusion factors, characterized in that, include: Set up dynamic security protection and detection modes for different computer network application environments; Based on the detection content of the security dynamic protection mode, set corresponding security dynamic protection schemes; A decision-making method for dynamic protection of computer network security is constructed based on a deep reinforcement learning model. Based on the decision results of the deep reinforcement learning model, corresponding protection schemes are adopted to address network risks; Establish a network abnormal behavior feature database, and adjust the model parameters and optimize the network abnormal behavior feature database by comparing it with the decision results of the model. The specific features of setting up dynamic security protection modes for different computer network application environments include: For application environments where computer network security requirements are not high but information confidentiality is necessary, a single port number detection mode is adopted. For application environments with high computer network security requirements that do not require precise identification of traffic behavior, a single mode of deep packet inspection is adopted. For application environments that require accurate identification of traffic behavior and improved computer network processing speed, a single-mode deep flow detection is adopted. The decision-making method for constructing dynamic protection of computer network security based on a deep reinforcement learning model specifically includes: Based on the standardized handling checklist for abnormal behavior, determine the probability of choosing a strategy among different handling options; Based on the Markov chain algorithm, the probability value of the state at future time moments is determined according to the computer network when identifying different detection content features; Based on the standardized list of abnormal behaviors, calculate the cumulative reward feedback value corresponding to the completion of a decision. Based on a deep reinforcement learning model and the Monte Carlo algorithm, it is confirmed that the computer network completes a decision in this state. Expectations; Based on deep reinforcement learning models, according to This confirms that the computer network has selected this processing method to complete a decision. Expectations; The specific steps for implementing corresponding protection schemes to address network risks based on the decision results of the deep reinforcement learning model include: Based on the impact on network operation caused by abnormal network behavior characteristics and the ease of handling methods, the methods for handling abnormal network behavior characteristics are divided into categories. Based on the learning and training results of deep reinforcement learning models, automatic decision-making is performed on common, simple, and low-impact network abnormal behavior features. Based on the learning and training results of deep reinforcement learning models, early warning and alarm methods are set up for complex, novel, and impactful abnormal network behavior features that cause model overload, and the abnormal network behavior features are recorded.
2. The dynamic protection method for computer network security based on fusion factors according to claim 1, characterized in that, The specific features of setting up dynamic security protection modes for different computer network application environments include: Based on the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection, a dynamic security protection detection mode is set according to different computer network application environments. For other computer network security needs, a joint detection mode is set up by considering the advantages and disadvantages of port number detection, deep packet inspection, and deep flow inspection modes. The detection results are adjusted by setting the weight of each detection mode. Based on the DS evidence theory, the proportion of port number detection, deep packet detection, and deep flow detection in the joint detection mode is calculated. The weight expression for each detection is as follows: in, The linear relationship between several detection methods is shown. To use port number detection, To employ deep packet inspection, To employ depth flow detection, The weights are determined by the port number. To use the weights of deep packet inspection, Weights for using depth flow detection; The expression for the DS evidence theory is as follows: in, To adopt the first The reliability of each detection method The normalization constant is To adopt the first The first detection method The probability of each feature term. To adopt the first The number of feature items for each detection method.
3. The dynamic protection method for computer network security based on fusion factors according to claim 2, characterized in that, The detection content based on the dynamic security protection mode, and the corresponding dynamic security protection scheme specifically include: Based on historical data of abnormal network behavior, the detection content features of each detection mode are determined; For each detection mode's detection content features, a standardized processing scheme for network abnormal behavior features is set. Based on the characteristics of the detected content and the standardized processing scheme, establish a standardized processing list for abnormal behaviors.
4. The dynamic protection method for computer network security based on fusion factors according to claim 3, characterized in that, The probabilistic expression for confirming the selection strategy among different processing schemes is as follows: in, For computer networks in state Next choice The probability of each solution. A set of solutions for handling abnormal behavior characteristics of computer networks. A set of current states of a computer network; The Markov chain algorithm is as follows: in, For computer networks in the first In the state of the th , the th Each state probability For the future of computer networks A state, For the current computer network One state; The expression for the cumulative reward feedback value corresponding to the completion of a decision is as follows: in, To make a decision for a computer network The cumulative reward feedback value corresponding to each state. As a discount factor for the future impact of computer networks on the present, To make a decision for a computer network The cumulative reward feedback value corresponding to each state. To make a decision for a computer network The reward feedback value corresponding to each state; The computer network completes a decision in this state. The expected expression is: in, For computer networks in this policy Each state corresponds to The expected value of the update For computer networks in this policy Each state corresponds to Expected value For learning rate, For computer networks in this policy Each state corresponds to Expected value; The computer network selects this processing scheme to complete a decision. The expected expression is: in, To select this processing scheme for a computer network, a decision is made. Each state corresponds to The expected value of the update To select this processing scheme for a computer network, a decision is made. Each state corresponds to Expected value For learning rate, To select this processing scheme for a computer network, a decision is made. Each state corresponds to The expected value.
5. The dynamic protection method for computer network security based on fusion factors according to claim 4, characterized in that, The establishment of a network abnormal behavior feature database, and the adjustment of model parameters and optimization of the network abnormal behavior feature database by comparing it with the decision results of the model, specifically includes: Based on the decision-making results of the standardized abnormal behavior processing list and model, a network abnormal behavior feature database is established. By comparing the processing results of the network abnormal behavior feature database with the decision results of the model, the most suitable processing method is selected, and the model parameters are adjusted and the network abnormal behavior feature database is optimized based on the comparison results. If the model's decision is better than the feature library's processing result, then the processing result recorded in the feature library is optimized; otherwise, the model's parameters need to be adjusted.
6. A dynamic computer network security protection system based on fusion factors, used to implement the dynamic computer network security protection method based on fusion factors as described in any one of claims 1-5, characterized in that, include: The detection and solution module is used to set up dynamic security protection detection modes for different computer network application environments. Based on the detection content of the security dynamic protection mode, set corresponding security dynamic protection schemes; The protection and feedback module is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model; to take corresponding protection schemes to solve security risks according to the decision results of the deep reinforcement learning model; to establish a network abnormal behavior feature library, and to adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.
7. A dynamic computer network security protection system based on fusion factors according to claim 6, characterized in that, The detection and solution module specifically includes: The detection mode setting unit is used to set a dynamic security protection detection mode for different computer network application environments. The protection scheme setting unit is used to set a corresponding dynamic security protection scheme based on the detection content of the dynamic security protection mode.
8. A dynamic computer network security protection system based on fusion factors according to claim 7, characterized in that, The protection and feedback module specifically includes: A protection decision unit is used to construct a decision-making method for dynamic protection of computer network security based on a deep reinforcement learning model. A protection scheme unit is used to take corresponding protection schemes to solve security risks based on the decision results of the deep reinforcement learning model. The feature library feedback unit is used to establish a network abnormal behavior feature library, and adjust the model parameters and optimize the network abnormal behavior feature library by comparing it with the decision results of the model.