Network security system based on deep learning

Abstract

The invention relates to the technical field of networks, in particular to a network security system based on deep learning. A network security system based on deep learning comprises a data arrangement module which is used for updating virus data in a database and anti-virus software for processing the corresponding virus data, and obtaining data of each owned server. And the port detection and modification module is used for analyzing the dangerous data in the database by using a fuzzy reasoning algorithm based on the current server condition and the dangerous data in the database, combining the dangerous data with a traditional accurate control method to obtain an analysis result, and modifying the state of each port of the server according to the analysis result. According to the method, the database is updated by adopting big data, analysis is carried out according to the conditions of the servers and the access conditions of the ports, and whether the log data are normal or not is detected and judged by analyzing the log data.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a network security system based on deep learning. Background Art

[0002] The network security system refers to the perception and protection of the security status of the network environment in the future. It is one of the important cores to ensure the network security of the whole society. The current network security defense methods mostly use firewalls and machine learning anomaly detection protection methods. However, the use of firewalls can only provide passive defense and cannot actively adjust and protect. The existing machine learning anomaly detection method cannot monitor the security of logs in real time, and requires a large amount of manual labor to manually label the data, wasting a lot of manpower but failing to achieve the expected results. Therefore, the technical needs for how to actively protect servers and accurately detect data security in real time have become increasingly urgent. Summary of the invention

[0003] In order to overcome the shortcomings of being unable to accurately detect and protect the server status, the present invention provides a network security system based on deep learning.

[0004] The technical solution of the present invention is: a network security system based on deep learning, comprising:

[0005] The data sorting module is used to update the virus data in the database and the anti-virus software that processes the corresponding virus data, and to obtain the data of each server owned;

[0006] The port detection and modification module uses a fuzzy inference algorithm to analyze the dangerous data in the database based on the current server situation and the dangerous data in the database, and combines it with the traditional precise control method to obtain the analysis results, and modifies the status of each port of its own server according to the analysis results;

[0007] The anomaly detection module obtains real-time log data, pre-processes the real-time log data to obtain pre-processed log data, inputs the pre-processed log data into the anomaly detection model, and finally obtains an anomaly result;

[0008] A second judgment module obtains the number of abnormal results within a first preset time and makes a judgment based on the number of abnormal results;

[0009] The anomaly classification module uses the anomaly classification model to classify the saved anomaly log data, and finally takes countermeasures based on the anomaly classification results.

[0010] Preferably, based on the current server situation and the dangerous data in the database, the dangerous data in the database are analyzed using a fuzzy inference algorithm, and the analysis result is obtained by combining it with a traditional precise control method. Before modifying the status of each port of the own server according to the analysis result, the method includes:

[0011] An update module, used to update virus data in the database and the anti-virus software that processes the corresponding virus data through big data;

[0012] The server data acquisition module is used to obtain the performance data of each server and the access data of each server port.

[0013] The dangerous data priority processing module uses the FIFO algorithm to obtain a preset threshold number of server dangerous data, and uses the preset threshold number of server dangerous data as a priority processing sequence. After adjusting the server dangerous data in the priority processing sequence through an adjustment formula, the priority processed server dangerous data is obtained, wherein the adjustment formula is:

[0014]

[0015] Where R is the priority of dangerous data, q and k are adjustment factors, and t i

[0016] is the average waiting time for the same dangerous data in the priority processing sequence, t min is the minimum waiting time, t max is the maximum waiting time, and c is the total number of the same dangerous data in the priority processing sequence.

[0017] Preferably, after adjusting the server danger data in the priority processing sequence by means of the adjustment formula and before obtaining the server danger data for priority processing, it includes: after prioritizing the server danger data in the priority processing sequence according to the priority of the danger data, removing the server danger data for priority processing in the priority processing sequence, wherein the earliest waiting time in the priority processing sequence is used as the waiting time for each server danger data.

[0018] Preferably, in the port modification module, based on the current server situation and the dangerous data in the database, a fuzzy inference algorithm is used to analyze the dangerous data in the database, and the analysis result is obtained by combining it with a traditional precise control method, and the status of each port of the own server is modified according to the analysis result, including:

[0019] The first judgment module is used to judge whether the newly added virus data has anti-virus software that can process the corresponding virus data, and to make further judgments based on whether there is a corresponding result;

[0020] The fuzzy reasoning module uses the fuzzy reasoning algorithm to analyze and adjust the opening status of each server port. The specific steps are as follows:

[0021] S1: Define fuzzy variables: Collect historical data, including the connection request frequency of each port and the virus danger level of each port, and convert quantitative data into fuzzy variables by using relevant membership functions;

[0022] S2: Specify fuzzy rules: Formulate fuzzy rules based on expert domain experience knowledge and historical data;

[0023] S3: Determine the degree of membership: Based on the existing relevant data, map it to the corresponding fuzzy set and determine its degree of membership;

[0024] S4: Determine the fuzzy state: determine the corresponding activation rule based on the membership of the existing relevant data, and determine that the port is in a certain fuzzy state based on the activation rule and the membership of the existing relevant data;

[0025] S5: Defuzzification: convert the fuzzy state obtained by reasoning into actual operation;

[0026] The triangular membership function and trapezoidal membership function are used to construct the membership image.

[0027] Preferably, the above method is combined with a traditional precise control method to obtain an analysis result, and the status of each port of the server itself is modified according to the analysis result, including:

[0028] When the fuzzy inference result of the port is greater than or equal to the normal level and less than the threshold of the traditional precise control method, a danger alarm is obtained and sent to relevant personnel.

[0029] Preferably, in the anomaly detection module, real-time log data is acquired, and the real-time log data is preprocessed to obtain preprocessed log data, and the preprocessed log data is input into the anomaly detection model, and finally an anomaly result is obtained, including:

[0030] First, the real-time log data is preprocessed, including removing irrelevant characters, standardizing the date and time format, and converting the original log into a numerical feature vector. Finally, the preprocessed log data is obtained and input into the anomaly detection model to determine whether the log data is abnormal.

[0031] Preferably, the finally obtaining the preprocessed log data and inputting the preprocessed log data into an anomaly detection model to determine whether the log data is abnormal include:

[0032] The anomaly detection model uses the OC-SVM model. After the normal log data is cleaned and converted into numerical feature vectors, it is divided into a training set and a test set. The anomaly detection model uses the Gaussian kernel as the kernel function for training, and the cross-validation evaluation method is used to find the optimal parameter combination. Finally, the test set is used to test the performance of the anomaly detection model.

[0033] The formula of Gaussian kernel is as follows:

[0034]

[0035] where x i and x j are two vectors in the input space, where σ is the width parameter of the kernel function, which controls the radial range of the function, and ||x i -x j || represents x i and x j The Euclidean distance between .

[0036] Preferably, in the second judgment module, obtaining the number of abnormal results within the first preset time and making a judgment based on the number of abnormal results includes:

[0037] If the number of abnormal results is greater than or equal to a first preset number, the log data detected abnormally within the first preset time is saved and used as abnormal log data, and finally the abnormal log data is input into the abnormal classification model for classification;

[0038] If the number of abnormal results is less than the first preset number, the log data continues to be monitored.

[0039] Preferably, in the abnormal classification module, an abnormal classification model is used to classify the stored abnormal log data, and finally countermeasures are taken according to the abnormal classification results, including:

[0040] The abnormality classification model uses the LSTM neural network model to remove irrelevant information and standardize the abnormal log data, convert it into time series data, and design a suitable LSTM layer, in which the activation function uses the softmax function;

[0041] The formula of the softmax function is as follows:

[0042]

[0043] Among them, Xi is the element in the vector, is to apply e to the entire vector x The sum of the elements after .

[0044] Preferably, in the abnormal classification module, an abnormal classification model is used to classify the stored abnormal log data, and finally countermeasures are taken according to the abnormal classification results, including:

[0045] After classifying the abnormal log data, an abnormal classification result is obtained, and an urgency calculation formula is used according to the abnormal classification result to obtain an urgency score, and the data are sorted according to different urgency scores, wherein the urgency calculation formula is: E=αF+βS+γI;

[0046] Where E is the urgency score, F is the frequency of the anomaly, S is the historical severity, I is the impact range, and α, β, and γ are adjustable weight factors.

[0047] Beneficial effects:

[0048] The present invention detects server ports by using a fuzzy inference algorithm, which can help identify potential security risks, and can play a good early warning effect on port management by analyzing abnormal behavior patterns; by combining the fuzzy inference algorithm with the traditional precise control method, not only the advantage of fuzzy inference on uncertainty problems is retained, but also the accuracy of the traditional precise control method is retained, and the accuracy and security of port management are improved by combining the two; by using the OC-SVM model, only correct data is needed during training, and no manual marking of the data is required, which saves manpower while ensuring the accuracy of detection and more accurately handles problems; by using the LSTM model to classify the number of abnormal logs, not only can the time relationship of the abnormal logs be used, but also the log data can be further detected to see whether it is real abnormal log data, and finally, by classifying the abnormal log data according to the degree of urgency, it is convenient for maintenance personnel to perform maintenance operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a system framework diagram of a network security system based on deep learning in the present invention;

[0050] Figure 2 is a block diagram of a data collating module of the present invention;

[0051] Figure 3 It is a flow chart of the fuzzy reasoning module of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] Unless otherwise defined, the technical terms or scientific terms used in the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The words "first", "second" and similar words used in the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, the words "one", "an" or "the" and the like do not indicate a quantitative limitation, but indicate the presence of at least one.

[0054] Embodiment 1: A network security system based on deep learning, such as Figure 1-3 As shown, including:

[0055] The data sorting module is used to update the virus data in the database and the anti-virus software that processes the corresponding virus data, and to obtain the data of each server owned.

[0056] It should be noted that the assumed database contains information about various viruses and related anti-virus software. This module will update this data according to the latest virus database to ensure that the anti-virus software on the server can deal with new viruses. At the same time, the module will collect data from each server, including the usage of CPU, memory, and network ports.

[0057] An update module, used to update virus data in the database and the anti-virus software that processes the corresponding virus data through big data;

[0058] It should be noted that the update module first obtains the latest virus data from multiple sources. Virus signature libraries and blacklists provided by various antivirus software vendors. Malware analysis reports shared by global network security communities, forums, and research institutions. Suspicious activities and log data captured by the intrusion detection system within the system. These data are collected in real time or regularly through big data technology to ensure that the virus data in the database is up to date and can cover newly discovered viruses worldwide.

[0059] Through big data analysis technology, the update module will classify and prioritize the collected virus data. According to factors such as the spread range, attack method, and harm level of the virus, it is classified into different types, such as Trojans, ransomware, worms, spyware, etc.

[0060] The update module not only updates virus data, but also updates the antivirus software in the system. Whenever new virus data enters the database, the update module generates update packages for the corresponding antivirus software based on this data. These update packages contain the latest virus signatures, detection rules, response strategies and other information.

[0061] The server data acquisition module is used to obtain the performance data of each server and the access data of each server port.

[0062] The dangerous data priority processing module uses the FIFO algorithm to obtain a preset threshold number of server dangerous data, and uses the preset threshold number of server dangerous data as a priority processing sequence. After adjusting the server dangerous data in the priority processing sequence through an adjustment formula, the priority processed server dangerous data is obtained, wherein the adjustment formula is:

[0063]

[0064] Where R is the priority of dangerous data, q and k are adjustment factors, and t i is the average waiting time for the same dangerous data in the priority processing sequence, t min is the minimum waiting time, t max is the maximum waiting time, and c is the total number of the same dangerous data in the priority processing sequence.

[0065] It should be noted that when updating the virus data in the database through big data, the port number of each virus data attack should be analyzed, and the anti-virus program that can process the corresponding virus data should be obtained at the same time, and the virus feature data for which there is no corresponding anti-virus program should be saved. At the same time, the performance data of the owned servers and the access data received by each port within the preset time period should be obtained. By using the HRRN concept to adjust the priority processing of server danger data, relevant personnel can be assisted in auxiliary source search for key danger sources.

[0066] After the server dangerous data in the priority processing sequence are prioritized according to the dangerous data priority, the server dangerous data prioritized in the priority processing sequence are removed, wherein the earliest waiting time in the priority processing sequence is used as the waiting time of each server dangerous data.

[0067] It should be noted that after the server danger data in the priority processing sequence is prioritized, the server danger data in the priority processing sequence is removed, and the priority processing sequence is obtained again, wherein the earliest waiting time in the latest priority processing sequence is used as the waiting time of each server danger data. For example, the server danger data contained in the priority processing sequence are: A, B, C, A, wherein the waiting times are: 10, 5, 6, 5 respectively, then the waiting time of A is 10, the waiting time of B is 5, and the waiting time of C is 6.

[0068] The port detection and modification module uses a fuzzy inference algorithm to analyze the dangerous data in the database based on the current server situation and the dangerous data in the database, and combines it with the traditional precise control method to obtain the analysis results, and modifies the status of each port of its own server according to the analysis results;

[0069] It should be noted that the fuzzy inference algorithm is used to analyze dangerous data in the database, such as viruses and hacker attack data, and combined with traditional precise control methods to modify the status of the server port. When a server port frequently receives abnormal requests, such as malicious scanning or brute force cracking, the fuzzy inference algorithm will analyze the risk level of the port based on these data. If the risk of certain ports is found to be greater than the preset risk threshold, the system will automatically close the port or enable higher security protection measures.

[0070] The first judgment module is used to judge whether the newly added virus data has anti-virus software that can process the corresponding virus data, and to make further judgments based on whether there is a corresponding result;

[0071] The fuzzy reasoning module uses the fuzzy reasoning algorithm to analyze and adjust the opening status of each server port. The specific steps are as follows:

[0072] S1: Define fuzzy variables: Collect historical data, including the connection request frequency of each port and the virus danger level of each port, and convert quantitative data into fuzzy variables by using relevant membership functions;

[0073] S2: Specify fuzzy rules: Formulate fuzzy rules based on expert domain experience knowledge and historical data;

[0074] S3: Determine the degree of membership: Based on the existing relevant data, map it to the corresponding fuzzy set and determine its degree of membership;

[0075] S4: Determine the fuzzy state: determine the corresponding activation rule based on the membership of the existing relevant data, and determine that the port is in a certain fuzzy state based on the activation rule and the membership of the existing relevant data;

[0076] S5: Defuzzification: Convert the fuzzy state obtained by reasoning into actual operation.

[0077] The triangular membership function and trapezoidal membership function are used to construct the membership image.

[0078] When the fuzzy inference result of the port is greater than or equal to the normal level and less than the threshold of the traditional precise control method, a danger alarm is obtained and sent to relevant personnel.

[0079] It should be noted that the severity of the virus is judged according to whether each virus data has a corresponding processing program, and the fuzzy set is defined for factors such as the quantity of virus data of each port and the access volume of each port number. For example, the severity of the virus can be defined as light, medium, and high, the number of viruses can be defined as small, medium, and large, and the access volume of each port number can be defined as small, medium, and large; then fuzzy rules are defined, for example, if the severity of the virus is light, the number of viruses is small, and the access volume of the port number is small, then the port is kept open; if the severity of the virus is "high", the number of viruses is "large", and the port access volume is "large", then the port is closed or an alarm is sent; if the severity of the virus is "medium", the number of viruses is "medium", and the port access volume is "medium", then the warning state is entered, and the system needs to increase the monitoring frequency; through the membership function (such as a triangle or trapezoidal function), the membership of the input data in a certain fuzzy set can be determined;

[0080] And according to the membership and fuzzy rules, calculate the rule with the highest activation degree; for example: if the system finds that the membership of the access volume is "medium" is 0.7, the membership of the virus severity is "medium" is 0.6, and the membership of the number of viruses is "small" is 0.8, then the system will activate the following rules:

[0081] Rule 1: If the virus severity is "mild", the number of viruses is "few", and the port access volume is "few", keep the port open.

[0082] Rule 2: If the virus severity is "medium", the number of viruses is "medium", and the port access volume is "many", the system enters the warning state.

[0083] Since the membership and activation degree of rule 2 are high, the system considers the current port status to be "warning";

[0084] The defuzzification process is to convert the inferred fuzzy state into a specific action. For example, if the fuzzy state of a port is "warning", the system may take the following actions: increase the monitoring frequency and closely observe the activities of the port; reduce the connection limit of the port to reduce potential risks; send a warning signal to the administrator to indicate possible security issues.

[0085] The use of fuzzy reasoning algorithms can help identify potential security risks and provide a good early warning effect on port management.

[0086] By combining the fuzzy reasoning algorithm with the traditional precise control method, the fuzzy reasoning module is responsible for judging that when the risk score of a port is too high but does not reach the threshold of the traditional precise control method, it can be sent to the relevant personnel for judgment. This not only improves the accuracy of detection of each port, but also greatly improves the security of the port by adding the factor of human judgment.

[0087] The anomaly detection module obtains real-time log data, pre-processes the real-time log data to obtain pre-processed log data, inputs the pre-processed log data into the anomaly detection model, and finally obtains an anomaly result;

[0088] It should be noted that this module is used to collect real-time log data from the server, and after preprocessing, it is input into the anomaly detection model to determine whether an anomaly occurs. The server log records all system activities, such as login attempts, file operations, etc. If a user frequently attempts to log in and fails multiple times, the log will be detected as abnormal behavior. After data preprocessing, such as removing irrelevant characters and standardizing dates, the log will be converted into numerical features and input into the anomaly detection model. The model determines whether this is a malicious attack or the user simply entered the wrong password based on the trained data.

[0089] First, the real-time log data is preprocessed, including removing irrelevant characters, standardizing the date and time format, and converting the original log into a numerical feature vector. Finally, the preprocessed log data is obtained and input into the anomaly detection model to determine whether the log data is abnormal.

[0090] It should be noted that the system will obtain real-time log data on the server. Log data is usually a record of various formats and information, such as system access logs, error logs, security logs, etc. The purpose of preprocessing is to convert these messy log data into a standardized data format that can be used for model processing. Remove irrelevant characters: Among them, the log data may contain many unnecessary characters or information, which will not be helpful for anomaly detection; Standardized date and time format: Different log systems may use different time formats (such as 12-hour system, 24-hour system, different time zones, etc.). In order for the system to correctly process the time information in the log, the date and time of all logs must be standardized into a unified format, so that the consistency of time data can be ensured after standardization, which is convenient for subsequent time series analysis; Log data formatting: Log data may be in unstructured or semi-structured text format. In the machine learning model, these text data must be converted into numerical data so that the model can process it. For example, map certain text fields to numerical values ​​or categories.

[0091] The anomaly detection model uses the OC-SVM model. After the normal log data is cleaned and converted into numerical feature vectors, it is divided into a training set and a test set. The anomaly detection model uses the Gaussian kernel as the kernel function for training, and the cross-validation evaluation method is used to find the optimal parameter combination. Finally, the test set is used to test the performance of the anomaly detection model.

[0092] The formula of Gaussian kernel is as follows:

[0093]

[0094] where x i and x j are two vectors in the input space, where σ is the width parameter of the kernel function, which controls the radial range of the function, and ||x i -x j || represents x i and x j The Euclidean distance between .

[0095] It should be noted that converting the original log into a numerical feature vector is a way to convert the original log data into a form that can be understood by the machine learning algorithm. By adopting the OC-SVM model, only the correct data set needs to be input during training, and the unsupervised learning method that does not require manual annotation saves a lot of manpower; by using the Gaussian kernel function, it can process complex high-dimensional data and can better capture nonlinear relationships. This enables it to detect subtle abnormal patterns in network security logs and improve detection accuracy; the model can flexibly control the sensitivity of anomaly detection by adjusting the width parameter σ of the kernel function to meet the needs of different scenarios. In addition, the OC-SVM model is relatively efficient in calculation and is suitable for processing large-scale log data.

[0096] A second judgment module obtains the number of abnormal results within a first preset time and makes a judgment based on the number of abnormal results;

[0097] If the number of abnormal results is greater than or equal to a first preset number, the log data detected abnormally within the first preset time is saved and used as abnormal log data, and finally the abnormal log data is input into the abnormal classification model for classification;

[0098] If the number of abnormal results is less than the first preset number, the log data continues to be monitored.

[0099] It should be noted that abnormal log data is log data that has abnormalities within the first preset time. By inputting the abnormal log data into the abnormal classification model for classification, it is convenient to further detect the danger and urgency of the abnormal log data; if the number of abnormal results is less than the first preset number, it means that it may be normal inaccurate data, and the log data continues to be monitored.

[0100] The anomaly classification module uses the anomaly classification model to classify the saved anomaly log data, and finally takes countermeasures based on the anomaly classification results.

[0101] The abnormality classification model uses the LSTM neural network model to remove irrelevant information and standardize the abnormal log data, convert it into time series data, and design a suitable LSTM layer, in which the activation function uses the softmax function;

[0102] The formula of the softmax function is as follows:

[0103]

[0104] Among them, Xi is the element in the vector, is to apply e to the entire vector x The sum of the elements after

[0105] After classifying the abnormal log data, an abnormal classification result is obtained, and an urgency calculation formula is used according to the abnormal classification result to obtain an urgency score, and the data are sorted according to different urgency scores, wherein the urgency calculation formula is: E=αF+βS+γI;

[0106] Where E is the urgency score, F is the frequency of the anomaly, S is the historical severity, I is the impact range, and α, β, and γ are adjustable weight factors.

[0107] It should be noted that the LSTM neural network model can understand the time sequence of log entries, identify the time correlation and potential abnormal sequence patterns, better confirm whether it is an abnormal result by capturing the time sequence relationship, and derive the urgency of each data based on the abnormal classification results, and send it to the relevant maintenance personnel for further processing; the construction of the LSTM model includes:

[0108] Input layer: The input layer accepts the preprocessed time series log data. The log data at each time point is input into the model and passed to the subsequent LSTM units step by step.

[0109] LSTM layer: The LSTM layer is responsible for processing time series data. When each LSTM unit inputs the data at the current time point, it also retains and transmits the information of the previous time point, which can help the system understand the relationship between the previous and next time points.

[0110] The above is a detailed introduction to the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A network security system based on deep learning, characterized in that: include: The data sorting module is used to update the virus data in the database and the anti-virus software that processes the corresponding virus data, and to obtain the data of each server owned; The port detection and modification module uses a fuzzy inference algorithm to analyze the dangerous data in the database based on the current server situation and the dangerous data in the database, and combines it with the traditional precise control method to obtain the analysis results, and modifies the status of each port of its own server according to the analysis results; The anomaly detection module obtains real-time log data, pre-processes the real-time log data to obtain pre-processed log data, inputs the pre-processed log data into the anomaly detection model, and finally obtains an anomaly result; A second judgment module obtains the number of abnormal results within a first preset time and makes a judgment based on the number of abnormal results; The anomaly classification module uses the anomaly classification model to classify the saved anomaly log data, and finally takes countermeasures based on the anomaly classification results.

2. A network security system based on deep learning according to claim 1, characterized in that: Based on the current server situation and the dangerous data in the database, the dangerous data in the database are analyzed using a fuzzy inference algorithm, and the analysis result is obtained by combining it with the traditional precise control method. Before modifying the status of each port of the server according to the analysis result, the method includes: An update module, used to update virus data in the database and anti-virus software that processes the corresponding virus data through big data; The server data acquisition module is used to obtain the performance data of each server and the access data of each server port; The dangerous data priority processing module uses the FIFO algorithm to obtain a preset threshold number of server dangerous data, and uses the preset threshold number of server dangerous data as a priority processing sequence. After adjusting the server dangerous data in the priority processing sequence through an adjustment formula, the priority processed server dangerous data is obtained, wherein the adjustment formula is: Where R is the priority of dangerous data, q and k are adjustment factors, and t i is the average waiting time for the same dangerous data in the priority processing sequence, t min is the minimum waiting time, t max is the maximum waiting time, and c is the total number of the same dangerous data in the priority processing sequence.

3. A network security system based on deep learning according to claim 1, characterized in that: After the server danger data in the priority processing sequence is adjusted by the adjustment formula and before the server danger data for priority processing is obtained, it includes: after the server danger data in the priority processing sequence is prioritized according to the danger data priority, the server danger data for priority processing in the priority processing sequence is removed, wherein the earliest waiting time in the priority processing sequence is used as the waiting time of each server danger data.

4. A network security system based on deep learning according to claim 1, characterized in that: In the port modification module, based on the current server situation and the dangerous data in the database, a fuzzy inference algorithm is used to analyze the dangerous data in the database, and the analysis result is obtained by combining it with the traditional precise control method. The status of each port of the server itself is modified according to the analysis result, including: The first judgment module is used to judge whether the newly added virus data has anti-virus software that can process the corresponding virus data, and to make further judgments based on whether there is a corresponding result; The fuzzy reasoning module uses the fuzzy reasoning algorithm to analyze and adjust the opening status of each server port. The specific steps are as follows: S1: Define fuzzy variables: Collect historical data, including the connection request frequency of each port and the virus danger level of each port, and convert quantitative data into fuzzy variables by using relevant membership functions; S2: Specify fuzzy rules: Formulate fuzzy rules based on expert domain experience knowledge and historical data; S3: Determine the degree of membership: Based on the existing relevant data, map it to the corresponding fuzzy set and determine its degree of membership; S4: Determine the fuzzy state: determine the corresponding activation rule based on the membership of the existing relevant data, and determine that the port is in a certain fuzzy state based on the activation rule and the membership of the existing relevant data; S5: Defuzzification: convert the fuzzy state obtained by reasoning into actual operation; The triangular membership function and trapezoidal membership function are used to construct the membership image.

5. A network security system based on deep learning according to claim 3, characterized in that: The above method is combined with the traditional precise control method to obtain the analysis result, and the status of each port of the server is modified according to the analysis result, including: When the fuzzy inference result of the port is greater than or equal to the normal level and less than the threshold of the traditional precise control method, a danger alarm is obtained and sent to relevant personnel.

6. A network security system based on deep learning according to claim 1, characterized in that: In the anomaly detection module, real-time log data is obtained, and the real-time log data is preprocessed to obtain preprocessed log data, and the preprocessed log data is input into the anomaly detection model, and finally an anomaly result is obtained, including: First, the real-time log data is preprocessed, including removing irrelevant characters, standardizing the date and time format, and converting the original log into a numerical feature vector. Finally, the preprocessed log data is obtained and input into the anomaly detection model to determine whether the log data is abnormal.

7. A network security system based on deep learning according to claim 6, characterized in that: Finally, the pre-processed log data is obtained, and the pre-processed log data is input into the anomaly detection model to determine whether the log data is abnormal, including: The anomaly detection model uses OC- SVM model, after preprocessing the normal log data by cleaning the logs and converting them into numerical feature vectors, divides them into training set and test set. The anomaly detection model uses Gaussian kernel as the kernel function for training, and uses the cross-validation evaluation method to find the optimal parameter combination. Finally, the test set is used to test the performance of the anomaly detection model. The formula of Gaussian kernel is as follows: where x i and x j are two vectors in the input space, where σ is the width parameter of the kernel function, which controls the radial range of the function, and ||x i -x j || represents x i and x j The Euclidean distance between .

8. A network security system based on deep learning according to claim 1, characterized in that: In the second judgment module, obtaining the number of abnormal results within the first preset time and making a judgment based on the number of abnormal results includes: If the number of abnormal results is greater than or equal to a first preset number, the log data detected abnormally within the first preset time is saved and used as abnormal log data, and finally the abnormal log data is input into the abnormal classification model for classification; If the number of abnormal results is less than the first preset number, the log data continues to be monitored.

9. A network security system based on deep learning according to claim 1, characterized in that: In the anomaly classification module, an anomaly classification model is used to classify the stored anomaly log data, and finally countermeasures are taken according to the anomaly classification results, including: The abnormality classification model uses the LSTM neural network model to remove irrelevant information and standardize the abnormal log data, convert it into time series data, and design a suitable LSTM layer, in which the activation function uses the softmax function; The formula of the softmax function is as follows: Among them, Xi is the element in the vector, is to apply e to the entire vector x The sum of the elements after .

10. A network security system based on deep learning according to claim 1, characterized in that: In the anomaly classification module, an anomaly classification model is used to classify the stored anomaly log data, and finally countermeasures are taken according to the anomaly classification results, including: After classifying the abnormal log data, an abnormal classification result is obtained, and an urgency calculation formula is used according to the abnormal classification result to obtain an urgency score, and the data are sorted according to different urgency scores, wherein the urgency calculation formula is: E=αF+βS+γI; Where E is the urgency score, F is the frequency of the anomaly, S is the historical severity, I is the impact range, and α, β, and γ are adjustable weight factors.

Images