Method and system for detecting network hidden attack

Abstract

The invention provides a method and a system for detecting network hidden attacks, which solve the problem of data imbalance of a training data set by using an oversampling algorithm and an undersampling algorithm, and highlight confused key features by capturing the long-distance dependency relationship of features and calculating the importance degree of each attribute feature, so that the network hidden attacks can be detected. A depth anomaly detection model is optimized, a node uploads trained model parameters, a control node optimizes and aggregates, and then issues the model parameters to each node, and the hidden attack is quickly identified by using the depth anomaly detection model, so that the problems that obfuscated codes cannot be effectively resisted and hidden attack means cannot be quickly and accurately identified in the prior art are solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a detection method and system for hidden network attacks. Background Art

[0002] Covert attacks refer to the use of concealment and evasion techniques to invade and attack specific targets. As the network situation becomes increasingly complex, network covert attacks have brought more and more serious harm. The detection of network covert attacks has become an urgent problem to be solved. Existing detection methods rely too much on expert knowledge, cannot effectively fight against obfuscated codes, and cannot quickly and accurately identify covert attack methods. In addition, how to improve the training efficiency of the model is also an issue that needs to be improved urgently.

[0003] Therefore, there is an urgent need for a targeted detection method and system for covert network attacks. Summary of the invention

[0004] The purpose of the present invention is to provide a detection method and system for network covert attacks, which use oversampling algorithms and undersampling algorithms to solve the problem of data imbalance in training data sets. At the same time, by capturing the long-distance dependencies of features and calculating the importance of each attribute feature, the key features of confusion are highlighted, and the deep anomaly detection model is optimized. The nodes upload the trained model parameters, which are optimized and aggregated by the control node and then sent to each node, and the deep anomaly detection model is used to quickly identify covert attacks.

[0005] In a first aspect, the present application provides a method for detecting covert network attacks, the method comprising:

[0006] Each common node builds and trains a deep anomaly detection model;

[0007] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result;

[0008] The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0009] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0010] The control node sends the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node;

[0011] The common node obtains the parameters of the trained deep anomaly detection model, encrypts the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and uses a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes.

[0012] The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node;

[0013] Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data;

[0014] The identification result, including the location of the covert attack and the guessed real identity of the attacker, is output and provided to the user.

[0015] In a second aspect, the present application provides a detection system for hidden network attacks, the system comprising: a common node, a control node, a deep anomaly detection model and an output unit;

[0016] Each common node is used to build and train the deep anomaly detection model;

[0017] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result;

[0018] The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0019] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0020] The control node is used to send the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node;

[0021] The common nodes are also used to obtain the parameters of the trained deep anomaly detection model, encrypt the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and use a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes.

[0022] The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node;

[0023] Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data;

[0024] The output unit is used to output the identification result, including: the location of the covert attack and the guessed real identity of the attacker, and provide it to the user.

[0025] In a third aspect, the present application provides a detection system for hidden network attacks, the system comprising: a processor and a memory:

[0026] The memory is used to store program code and transmit the program code to the processor;

[0027] The processor is configured to execute any one of various possible methods of the first aspect according to instructions in the program code.

[0028] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement any of the various possible methods of the first aspect.

[0029] Beneficial Effects

[0030] The present invention provides a detection method and system for network covert attacks. The oversampling algorithm and the undersampling algorithm are used to solve the problem of data imbalance in the training data set. At the same time, the long-distance dependency of features is captured and the importance of each attribute feature is calculated to highlight the key features of obfuscation and optimize the deep anomaly detection model. The nodes upload the trained model parameters, which are optimized and aggregated by the control node and then sent to each node. The deep anomaly detection model is used to quickly identify covert attacks, thereby overcoming the problem that the prior art cannot effectively combat obfuscated codes and cannot quickly and accurately identify covert attack methods.

[0031] The present invention has the following advantages and effects:

[0032] Use oversampling and undersampling algorithms to solve the problem of data imbalance in training data sets;

[0033] The control node performs optimization aggregation and then sends the aggregated parameters to each node, so that the nodes can use the model with the same detection effect;

[0034] Able to quickly identify covert attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 It is a flow chart of the detection method for hidden network attacks of the present invention;

[0037] Figure 2 The figure is a schematic diagram of the system for detecting hidden network attacks according to the present invention. DETAILED DESCRIPTION

[0038] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0039] Figure 1 A general flow chart of a method for detecting hidden network attacks provided in this application, the method comprising:

[0040] Each common node builds and trains a deep anomaly detection model;

[0041] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result;

[0042] The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0043] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0044] The control node sends the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node;

[0045] The common node obtains the parameters of the trained deep anomaly detection model, encrypts the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and uses a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes.

[0046] The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node;

[0047] Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data;

[0048] The identification result, including the location of the covert attack and the guessed real identity of the attacker, is output and provided to the user.

[0049] As an emerging basic technology of artificial intelligence, the control node (or centralized server) sends the training tasks to each ordinary node (or participant). The control node is only responsible for model parameter aggregation. Through this "data available but invisible" method, it ensures the privacy and security of data during exchange and makes full use of the computing power of ordinary nodes to train the model.

[0050] The encrypted data does not need to be sent to the control node. The ordinary nodes are trained locally. The ordinary nodes upload the model parameters to the control node. The control node performs optimization aggregation and then sends the aggregation results to each ordinary node without decryption.

[0051] In some preferred embodiments, the sublayer uses a regularization method to prevent the model from overfitting.

[0052] In some preferred embodiments, the identifying whether the traffic data is abnormal includes: comparing the label of the received traffic data with the label obtained locally based on the characteristic analysis of the traffic data, determining whether the data packet has been synthetically tampered with, and discarding the traffic data if it is determined to have been synthetically tampered with.

[0053] Figure 2 This is an architecture diagram of a detection system for hidden network attacks provided by the present application, wherein the system includes: a common node, a control node, a deep anomaly detection model, and an output unit;

[0054] Each common node is used to build and train the deep anomaly detection model;

[0055] The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result;

[0056] The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies;

[0057] The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance;

[0058] The control node is used to send the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node;

[0059] The common nodes are also used to obtain the parameters of the trained deep anomaly detection model, encrypt the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and use a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes.

[0060] The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node;

[0061] Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data;

[0062] The output unit is used to output the identification result, including: the location of the covert attack and the guessed real identity of the attacker, and provide it to the user.

[0063] The present application provides a detection system for network covert attacks, the system comprising: a processor and a memory:

[0064] The memory is used to store program code and transmit the program code to the processor;

[0065] The processor is used to execute the method described in any one of all embodiments of the first aspect according to the instructions in the program code.

[0066] The present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement the method described in any one of all the embodiments of the first aspect.

[0067] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment of the present invention. The storage medium may be a disk, an optical disk, a read-only storage memory (abbreviated as: ROM) or a random access memory (abbreviated as: RAM), etc.

[0068] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention or some parts of the embodiments.

[0069] The same and similar parts between the various embodiments of this specification can be referred to each other. In particular, for the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0070] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A detection method for hidden network attacks, characterized in that: The method comprises: Each common node builds and trains a deep anomaly detection model; The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result; The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies; The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance; The control node sends the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node; The common node obtains the parameters of the trained deep anomaly detection model, encrypts the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and uses a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes. The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node; Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data; The identification result, including the location of the covert attack and the guessed real identity of the attacker, is output and provided to the user.

2. The method according to claim 1, characterized in that: The sublayer adopts a regularization method to prevent the model from overfitting.

3. The method according to claim 1, characterized in that: The identifying whether the traffic data is abnormal includes: comparing the label of the received traffic data with the label obtained locally based on the characteristic analysis of the traffic data, determining whether the data packet is synthetically tampered with, and discarding the traffic data if it is determined to be synthetically tampered with.

4. A detection system for hidden network attacks, characterized in that: The system includes: a common node, a control node, a deep anomaly detection model and an output unit; Each common node is used to build and train the deep anomaly detection model; The deep anomaly detection model can extract key features from traffic data through structured processing. The deep anomaly detection model includes an input layer, multiple sublayers, a balanced sampling module and a neural network structure. The neural network structure includes: an obfuscation processing layer, an embedding layer, a convolution layer, a pooling layer, a bidirectional memory layer, an attention mechanism, a fully connected layer and an output layer; the obfuscation processing layer includes: data cleaning, parameter extraction, case recovery, keyword filtering, encoding restoration, equivalent function matching and word segmentation processing; the embedding layer is used to embed input data into a word vector template; the convolution layer extracts representative local features, captures long-distance dependencies through the bidirectional memory layer, uses the attention mechanism to calculate the importance of each attribute feature, highlights the key features of the obfuscation, assigns relevant weights and passes them to the fully connected layer, and the classifier calculates the final result of the obfuscation detection and the output layer outputs the final result; The input layer receives multiple basic features under different sampling time windows; the multiple sub-layers with different encoding dimensions encode the multiple basic features to obtain hierarchical feature representation and generate an embedding space; the balanced sampling module integrates the oversampling algorithm and the undersampling algorithm, calculates the average of each category of features, defines the features whose number is greater than or equal to the average as the majority class features, and defines the features whose number is less than the average as the minority class features, uses the undersampling algorithm for the majority class features, and uses the oversampling algorithm for the minority class features, summarizes the results of the oversampling algorithm and the undersampling algorithm, and inputs the summarized results into the neural network structure; the neural network structure learns the summarized results and detects anomalies; The deep anomaly detection model adopts the maximum marginal loss function and the multiple loss function as optimization objectives, so that traffic with similar characteristics is clustered together in the embedding space, while traffic with different characteristics is separated by a certain distance; The control node is used to send the model training task to each common node, and each common node inputs its own training data set and performs training locally on the common node; The common nodes are also used to obtain the parameters of the trained deep anomaly detection model, encrypt the parameters of the model using a homomorphic encryption algorithm to obtain a homomorphic ciphertext, and use a symmetric encryption algorithm to perform secondary encryption on the homomorphic ciphertext. The key of the homomorphic encryption algorithm is only shared between the common nodes participating in the model training, and the symmetric encryption key is shared between the common nodes and the control nodes participating in the model aggregation. At the same time, different symmetric encryption keys are used for communication between the common nodes and the control nodes. The common node uploads the parameters of the trained deep anomaly detection model to the control node, which performs optimization aggregation, and then the control node sends the aggregation results to each common node to unify the model parameters of each common node; Ordinary nodes clean, filter and standardize the traffic data uploaded by users, and then use the local deep anomaly detection model with unified parameters to identify whether the traffic data is abnormal. If it is abnormal, the distribution characteristics of the traffic data are analyzed by inferring attacks, and then the location of the covert attack is inferred, and the true identity of the attacker is guessed through the pseudo-identity information carried in the traffic data; The output unit is used to output the identification result, including: the location of the covert attack and the guessed real identity of the attacker, and provide it to the user.

5. A detection system for hidden network attacks, characterized in that: The system includes: a processor and a memory: the memory is used to store program code and transmit the program code to the processor; the processor is used to execute the method according to any one of claims 1-3 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to be executed by a processor to implement the method according to any one of claims 1 to 3.

Images