Mimicry distribution decision method based on deep learning traffic monitoring

Abstract

The invention relates to a flow detection filtering mimicry distribution decision method based on deep learning, which is characterized in that a message analysis and preprocessing concept is added on the basis of a distribution component, a decision component and an executor component in a general mimicry defense structure, and comprises the following steps of: firstly, carrying out network message high-speed detection of an application environment based on a network driver; the network message high-speed detection comprises data acquisition, data preprocessing and data analysis; according to the part, CNN and LSTM are combined by using a deep learning method, a mimicry architecture is combined with a CNN-LSTM model, a CNN-LSTM-based network message detection method is proposed, and time and space features of network traffic data are extracted by using a hybrid network of CNN and LSTM, so that the efficiency and accuracy of network anomaly detection are improved. According to the method, the problems of low efficiency and low accuracy of untrusted message flow detection in a network are solved, the efficiency and the safety of the whole method are improved, the anti-interference attack capability of a system is effectively improved, and a better effect of abnormal message flow detection and classification is achieved.

Description

Technical Field

[0001] The present invention relates to the intersecting technical field of computer network security technology and artificial intelligence technology, and in particular to a mimetic distribution decision method based on deep learning traffic monitoring. Background Art

[0002] With the rapid development of industrial digitalization, networking, and intelligence, the current network environment is becoming increasingly complex, and network attacks are frequently occurring. Under the new situation, the security issues of industrial control networks have begun to attract widespread attention. Although encryption technology has been widely adopted in a large number of network applications and services, and to a certain extent, the privacy and data security of users have been greatly protected, due to the double-edged nature of encryption technology, attackers will also use this technology to hide their malicious network activities. Therefore, if malicious traffic messages can be discovered in a large number of traffic messages in a timely manner and corresponding measures can be taken, the probability of attackers' success will be greatly reduced.

[0003] The current detection methods for malicious traffic messages in the network include misuse detection methods and anomaly detection methods. Among them, the misuse detection method relies on database comparison, and it is necessary to match the current network traffic with the information in the database one by one. Most of the commonly used network traffic anomaly detection systems use traditional statistical methods to manually design the detection rules of the anomaly detection system based on data statistics and attack characteristics. At the same time, in recent years, machine learning methods have also begun to be used to detect abnormal traffic, such as support vector machines, decision trees, random forests, etc. However, the detection methods based on traditional machine learning algorithms usually rely heavily on the number and quality of samples for recognition effect, and sometimes complex features need to be manually designed. In addition, there is a problem that the traffic after obfuscation and shaping cannot be effectively dealt with, and the nature of traffic anomalies will also change over time. In the actual network environment, the daily traffic is massive. When there is a large amount of data in the network, the above methods have low detection efficiency for malicious traffic and it is difficult to perform rapid detection in a short time. In view of the various problems of traditional methods in network traffic detection, we use deep learning methods to solve such problems. As a branch of machine learning, deep learning has shown superior performance in image processing, natural language processing and other fields, and has gradually been applied to the field of traffic identification. Since deep learning technology can automatically learn the characteristics of data without the need for manual feature design, it can effectively reduce the reliance on expert knowledge and has better robustness and versatility. Currently, network traffic analysis and detection methods based on deep learning methods mostly use recursive neural networks (RNN) and other network building models.

[0004] At the same time, with the continuous development of network security technology, mimetic security defense has also been widely used. Network mimetic security was first proposed by Academician Wu Jiangxing. The principle of mimetic defense is an improvement in immunity brought by the inner structure. Based on the heterogeneous redundant reliability technology architecture, a dynamic heterogeneous redundant mimetic system structure is established by introducing a multi-dimensional dynamic reconstruction mechanism based on mimetic camouflage strategy. The characteristic of mimetic defense is heterogeneous redundancy. The heterogeneous redundant executors are running concurrently and accept real-time requests sent by the distribution components. In the current related technologies, after receiving the request data transmitted by the parsed message, the distribution component sends it to the redundant executor, monitors the voting effect of the abnormality, and constructs a mimetic defense architecture based on heterogeneous redundancy suitable for the application environment from the three levels of network drive, heterogeneous executor resource pool, and feedback control, so as to realize the application protection of the terminal by mimetic defense. At present, the mimetic defense architecture has been studied from many levels, but most of them focus on the security analysis of the mimetic defense architecture at the level of the particularity of the system structure details. This often means sacrificing efficiency in exchange for security, so how to effectively improve the efficiency of the mimetic defense architecture is an urgent problem to be solved.

[0005] Due to the importance and urgency of industrial control network security work under the new situation, in order to cope with unknown threats based on unknown vulnerabilities, backdoors or viruses and Trojans in cyberspace, after the active defense theory (CMD) was proposed, mimetic security defense has also been widely used. Based on the heterogeneous redundant reliability technology architecture, it constructs a mimetic defense architecture based on heterogeneous redundancy suitable for the application environment from the three levels of network drive, heterogeneous executor resource pool, and feedback control, realizing the application protection of the terminal by mimetic defense. In the current related technology, when a network message is received, the network message is parsed. Since the data is not pre-processed, a large number of untrusted messages will be processed during the parsing process. If too many untrusted messages are parsed, temporary information will occupy a large amount of storage resources. When it is subsequently sent to the distribution and arbitration components, the overhead of the mimetic storage resources will increase and the response rate will be reduced. Therefore, it is particularly important to pre-process the data during the message parsing process. In view of the demand for real-time analysis and rapid processing of business application network messages, as well as the need for data security detection, real-time network protocol feature extraction and rapid verification mechanism voting and anomaly monitoring are required. However, in actual network environments, daily traffic data is generally massive, and the time for processing and caching traffic data is long, and the data processing efficiency is low. In this process, the detection time is delayed, and it is difficult to perform rapid detection in a short period of time. This poses a huge challenge to industrial control network security.

[0006] At present, the technologies proposed to solve the traffic detection problem are mainly divided into two categories: traffic detection protection based on cryptography and traffic detection protection based on machine learning methods. Traffic detection protection based on cryptography mainly includes ciphertext retrieval technology and deep packet inspection technology. This method usually has theoretical guarantees. However, different encryption methods will produce different characteristics. There is currently no universal method that can be applied to all types of encrypted traffic. At the same time, due to the double-edged nature of encryption technology, attackers will also use this technology to hide their malicious network activities, which brings many challenges to network threat monitoring and security management. Traffic detection protection based on traditional machine learning algorithms usually relies heavily on the number and quality of samples for identification effect, and there is a problem that it cannot effectively deal with obfuscated and shaped traffic. Similarly, intruders often adjust their network attacks based on malicious traffic detection results to evade existing detection schemes. The nature of traffic anomalies will also change over time. After each change, new features need to be designed manually, and training also takes a lot of time. Therefore, when the network becomes increasingly complex and there is a large amount of data, these two traditional methods are difficult to meet the needs of detection tasks.

[0007] In response to the problems of traditional traffic detection methods in malicious encrypted traffic detection, some researchers have begun to use deep learning methods to solve such problems. Since deep learning technology can automatically learn the characteristics of data and does not require manual feature design, it can effectively reduce the dependence on expert knowledge and greatly reduce time costs. At the same time, the model can also learn potential feature knowledge from massive data, thereby improving the versatility and robustness of the traffic detection system. Summary of the invention

[0008] Aiming at the problems of low efficiency and accuracy in the detection of untrusted message traffic in the network, a mimetic distribution decision method for traffic detection and filtering based on deep learning is proposed. The convolutional neural network (CNN) and recurrent neural network (RNN) are combined and applied to the mimetic distribution decision process. The heterogeneity between different algorithms is used to overcome the vulnerability of the algorithm itself, thereby solving technical problems, improving the efficiency and security of the overall method, and effectively enhancing the system's anti-interference attack capability.

[0009] The technical solution of the present invention is:

[0010] A mimetic distribution decision method based on deep learning traffic monitoring. Based on the distribution component, decision component and executive component in the general mimetic defense structure, this method improves the distribution part in the mimetic application structure, adds the concept of message parsing and preprocessing, and uses deep learning methods to parse and process a large number of untrusted messages to obtain the malicious probability of traffic data, alleviate the situation where temporary information occupies a large amount of storage resources, and realize fast online detection of traffic;

[0011] The components set up include network traffic message preprocessing components, distribution components, abnormal monitoring voting components, and executive components; the components comply with the standard working mode of the mimicry system of the components in the entire mimicry security defense structure during startup, operation, and cleaning and recovery, and a high-speed parsing preprocessing method for network traffic messages is added before the distribution component's work processing to improve the working efficiency of the mimicry system;

[0012] In the study of mimetic defense architecture based on heterogeneous redundancy suitable for application environment, we first perform high-speed detection of network packets in the application environment based on network driver, which includes data acquisition, data preprocessing and data analysis. This part uses deep learning methods to combine CNN and LSTM, and combines the mimetic architecture with the CNN-LSTM model. We propose a network packet detection method based on CNN-LSTM, which uses a hybrid network of CNN and LSTM to extract the temporal and spatial characteristics of network traffic data to improve the efficiency and accuracy of network anomaly detection.

[0013] Furthermore, the specific steps of the mimetic distribution decision method are as follows:

[0014] Model training stage: Preprocess the network traffic data set offline, mark whether the data is abnormal and divide it into training set and verification set, build a network packet detection model based on CNN-LSTM, use the training set data to train the network model, and use the test set to test the model effect after the network packet detection model is obtained. After the test passes, the traffic detection model obtained can complete the detection and classification of abnormal packet traffic;

[0015] High-speed detection stage of network packets: The network traffic packet preprocessing component performs network-driven supervision and control and traffic data packet capture requests sent by the client. After preprocessing the data packet, the network message constitutes the input vector of the input layer of the traffic detection model. After the CNN partial convolution layer extracts the features, the output is transmitted to the pooling layer for feature selection and information filtering. After multiple convolution and pooling operations, the feature block obtained after the fully connected layer represents the spatial feature information of the entire traffic data packet. The LSTM part of the model is connected to the CNN network output, and the latter part consists of the LSTM layer, the fully connected layer, the Softmax layer and the output layer. By introducing LSTM, the time series features of the traffic data packets and the relationship between them can be used as the basis for judging the nature of the traffic. Through multiple LSTM layers, the feature relationship between these data packets is analyzed. LSTM finds the group containing attack data and marks all the data packets of these groups as attack groups. Finally, the final classification result is obtained through the fully connected layer, the Softmax layer and the output layer. The unsafe message data packets are discarded and the useful data is transmitted to the next stage.

[0016] Mimic distribution and decision phase: For the request sent by the client, it is returned to the client after distribution and voting. Its life cycle includes the client initiating request phase, the request message parsing phase, the distribution to the heterogeneous executor resource pool phase, the heterogeneous executor resource pool processing response phase, the response anomaly monitoring and voting phase, and the voting result processing phase; after high-speed detection of network messages, the next step is to distribute the application request in real time, including obtaining the request, request preprocessing and sending the request; the request is copied and sent to the heterogeneous executor through the request of the distribution component. After receiving the request, each running executor processes the request and obtains a response; finally, the decision component makes response decisions and results processing on the responses of multiple heterogeneous executors, and then returns the results to the distribution and sends them to the client.

[0017] Furthermore, the components used in the mimic distribution adjudication method are as follows:

[0018] Network traffic message preprocessing components:

[0019] The functions of the network traffic message preprocessing component include data acquisition, data preprocessing and data analysis. To obtain the network traffic to be detected, the network driver first intercepts the network message and obtains the request data. Then the original network message is preprocessed to obtain a flow set with the same number of messages and message load size. The traffic data is processed into a four-tuple feature vector and then input into the trained model for detection to obtain the malicious probability of the traffic data and realize fast online detection of message traffic. Since network abnormal traffic has a certain correlation in time and space, the convolutional neural network CNN is mixed with the long-short-term convolutional neural network LSTM to detect abnormal traffic.

[0020] The abnormal traffic detection method based on LSTM convolutional neural network fully explores the structural characteristics of attack traffic on the basis of extracting the spatial features of a single data packet through CNN, and uses LSTM to extract the time features of the data stream. A high-dimensional data packet vector is output to the LSTM part, and the LSTM part processes the high-dimensional data packet vector into a classification probability vector, which is finally input into the softmax layer to obtain the final classification result. It has a high detection accuracy and a very low false alarm rate. By combining with the general mimicry defense infrastructure, the efficiency and effect of mimicry defense are greatly improved;

[0021] Distribution components:

[0022] The function of the distribution component is to receive and respond to tasks of the endogenous security terminal system. After receiving the request from the network traffic message preprocessing component, it extracts key data from the request, copies and forwards the single request to three redundant background execution components; the task response is uploaded to the distribution component through the interface by the arbitration component, and then returned to the response client;

[0023] The abnormal monitoring voting component is also the ruling component:

[0024] The function of the adjudication component is to compare the output information generated by multiple application execution bodies at the back end, and to find anomalies contained in the input based on the principle of majority agreement, and to determine whether inconsistency occurs. If the output is consistent, the response of the correct judgment is successfully generated and passed to the redundant real-time distribution component, and the voting result is set to safe. If the output is inconsistent, the response of the correct judgment fails to be generated, and the voting result is set to dangerous. Based on the judgment result, the distribution component determines the final returned result, and realizes autonomous perception of unknown attacks.

[0025] Actuator components:

[0026] The executor refers to the server-side application, which receives requests from the distribution component and outputs the processing results to the arbitration component. The arbitration component uses the output data to perform a majority vote to detect whether an attack or vulnerability occurs during the executor processing. The executor cluster adopts a redundancy of greater than or equal to three; it adopts a redundant execution method and is located at the back end of the distribution component. When a single executor fails, it can perform a cleaning operation on the failed component and does not directly provide external services, which can prevent direct external attacks and prevent losses caused by internal vulnerabilities.

[0027] The beneficial effects of the present invention are:

[0028] While the mimicry architecture improves security, it also meets the needs of business applications for real-time analysis and rapid processing of network messages. The mimicry distribution decision method based on deep learning traffic detection and filtering applies artificial intelligence deep learning algorithms to mimicry defense, and uses the heterogeneity between different algorithms to overcome the vulnerabilities of the algorithms themselves. This effectively improves the system's ability to resist interference attacks while improving overall efficiency and security.

[0029] 1) Based on the spatial features of a single data packet extracted by CNN, the structural characteristics of untrusted traffic are fully explored, and the temporal features of the data flow are extracted by LSTM. The two are mixed to detect abnormal traffic with high detection accuracy.

[0030] 2) Establish corresponding data sets for network traffic preprocessing and labeling, train the network packet detection model based on CNN-LSTM, and the traffic detection model obtained after the test has better effect in detecting and classifying abnormal packet traffic.

[0031] 3) After parsing the network messages and preprocessing the data, a large number of untrusted messages will be filtered out and subsequently sent to the distribution and decision components, which will reduce the overhead of mimetic storage resources and improve the response rate of mimetic distribution decisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is an overall schematic diagram of the mimicry defense structure of the present invention;

[0033] Figure 2 A flow chart of a method for constructing a flow detection model for the present invention;

[0034] Figure 3 This is a structural diagram of the flow detection model based on the CNN-LSTM network of the present invention. DETAILED DESCRIPTION

[0035] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0036] Based on the distribution components, arbitration components and executive components in the general mimetic defense structure, the present invention improves the distribution part in the mimetic application structure, adds the concept of message parsing and preprocessing, and uses deep learning methods to parse and process a large number of untrusted messages to obtain the malicious probability of traffic data, alleviate the situation where temporary information occupies a large amount of storage resources, and realize rapid online detection of traffic, which is subsequently sent to the distribution and arbitration components to reduce resource overhead. The application of this method does not affect network performance, but can improve the response rate, thereby achieving efficient message distribution and abnormal monitoring and voting effects. At the same time, through the reconstruction of the distribution service component, a mimetic distribution component with high-speed message filtering and parsing is realized. The functions of each component are described below, such as Figure 1 :

[0037] 1) Network traffic message preprocessing component

[0038] The main functions of the network traffic message preprocessing component include data acquisition, data preprocessing and data analysis. To obtain the network traffic to be detected, the network driver first intercepts the network message, obtains the request data, and then preprocesses the original network message to obtain a flow set with the same number of messages and message load size. The flow data is processed into a four-tuple feature vector and then input into the trained model for detection to obtain the malicious probability of the flow data, thereby realizing rapid online detection of message traffic. Since network abnormal traffic has a certain correlation in time and space, the present invention mixes the convolutional neural network (CNN) with the long short-term convolutional neural network (LSTM) to detect abnormal traffic.

[0039] Convolutional Neural Networks (CNN) optimizes and improves traditional neural networks, adopting a multi-layer feedforward neural network similar to artificial neural networks. Convolutional neural networks use three structures: local perception, weight sharing, and pooling. Compared with traditional neural networks, they reduce the parameter scale of the network, avoid time-consuming training processes, improve the generalization performance of the model, and reduce the problem of overfitting. The most basic convolutional neural network includes: an input layer that accepts input; a convolutional layer that uses convolution operations to obtain features and generate feature maps; a pooling layer that is used to reduce the number of parameters to reduce the risk of overfitting and can also aggregate and count features; and finally a fully connected layer, which is at the end of the convolutional neural network and uses the output results of the previous convolutional layer and pooling layer as input. In addition, all neurons in each layer are connected to complete tasks such as classification. Convolutional neural networks are inspired by the working principle of human visual center and process local information features statically and independently. However, in reality, most of the information received is a set of continuous, temporal and related sequence information. If it is not considered dynamically, the connection between the information will be cut off, resulting in unsatisfactory results in the processing of sequence information. Therefore, it is necessary to use a network structure that is different from convolutional neural networks, which can process sequential information and has the function of storing and remembering previously received information.

[0040] Recurrent Neural Network (RNN) is a network structure that focuses more on processing sequential data. It was proposed to solve the problem of processing sequential data. It can not only process the current input information, but also store and remember the previous output information. It is mainly used in natural language processing tasks. In general fully connected neural networks, the value of the hidden layer is only affected by the input, while in recurrent neural networks, the current input and the value of the hidden layer of the previous layer simultaneously affect the value of the hidden layer neural unit, so this gives the recurrent neural network a certain memory function and can obtain information up to now. Long short-term memory network (LSTM) is a typical variant of RNN. Since RNN cannot handle long-term and long-distance dependencies, it is easy to cause gradient vanishing or gradient explosion problems, so it is generally difficult to train. It is specially designed to solve this problem. The most special structure is the threshold structure, which refers to the threshold mechanism. The LSTM-based convolutional neural network abnormal traffic detection method designed by the present invention fully explores the structural characteristics of attack traffic on the basis of extracting the spatial characteristics of a single data packet by CNN, uses LSTM to extract the time characteristics of the data stream, outputs a high-dimensional data packet vector to the LSTM part, and the LSTM part processes the high-dimensional data packet vector into a classification probability vector, which is finally input into the softmax layer to obtain the final classification result. The method has high detection accuracy and extremely low false alarm rate, and is combined with the general mimicry defense infrastructure to greatly improve the efficiency and effect of mimicry defense.

[0041] 2) Distribution components

[0042] The function of the distribution component is to receive and respond to tasks of the endogenous security terminal system. After receiving the request from the network traffic message preprocessing component, it extracts key data from the request, copies the single request and forwards it to three redundant background execution components. The task response is uploaded to the distribution component through the interface by the arbitration component, and then returned to the response client.

[0043] 3) Abnormal monitoring voting component (decision component)

[0044] The main function of the arbitration component is to compare the output information generated by multiple application executors on the back end, and to use the principle of majority agreement to find anomalies contained in the input and determine whether inconsistencies occur. If the output is consistent, the response of the correct judgment is successfully generated and passed to the redundant real-time distribution component, and the voting result is set to safe. If the output is inconsistent, the response of the correct judgment fails to be generated and the voting result is set to dangerous. Based on the judgment result, the distribution component determines the final returned result to achieve autonomous perception of unknown attacks.

[0045] 4)Executor Components

[0046] The executor refers to the server application, which receives requests from the distribution component and outputs the processing results to the adjudication component. The adjudication component uses the output data to perform a majority vote to detect whether attacks or vulnerabilities occur during the executor processing. The executor cluster adopts a redundancy of greater than or equal to three. The redundant execution method is adopted. At the back end of the distribution component, when a single executor fails, the faulty component can be cleaned without directly providing external services, which can prevent direct external attacks and also prevent losses caused by internal vulnerabilities.

[0047] The above components conform to the standard working mode of the mimicry system of the components in the entire mimicry security defense structure during startup, operation, cleaning and recovery. Before the distribution component's work processing, a high-speed parsing preprocessing method for network traffic messages is added to improve the working efficiency of the mimicry system. The following describes the request processing process of each component at each stage and the operations that need to be completed:

[0048] In the study of the mimetic defense architecture based on heterogeneous redundancy suitable for application environments, we first perform high-speed detection of network packets in the application environment based on network drivers. High-speed detection of network packets mainly includes data acquisition, data preprocessing and data analysis. This part uses deep learning methods to combine CNN and LSTM, combines the mimetic architecture with the CNN-LSTM model, and proposes a CNN-LSTM-based network packet detection method, which uses a hybrid network of CNN and LSTM to extract the temporal and spatial characteristics of network traffic data to improve the efficiency and accuracy of network anomaly detection.

[0049] Model training stage: pre-process the network traffic data set offline, mark the data to see if it is abnormal and divide it into training set and validation set, build a network packet detection model based on CNN-LSTM, use the training set data to train the network model, and use the test set to test the model effect after the network packet detection model is obtained. After the test passes, the traffic detection model obtained can complete the detection and classification of abnormal packet traffic. Figure 2 shown.

[0050] High-speed detection stage of network packets: The network traffic packet preprocessing component performs network-driven supervisory control and traffic data packet capture requests sent by the client. After preprocessing the data packet, the network message constitutes the input vector of the input layer of the traffic detection model. After the features are extracted by the CNN partial convolution layer, the output is transmitted to the pooling layer for feature selection and information filtering. After multiple convolution and pooling operations, the feature block obtained after the fully connected layer represents the spatial feature information of the entire traffic data packet. The LSTM part of the model is connected to the CNN network output, and the latter part consists of the LSTM layer, the fully connected layer, the Softmax and the output layer. By introducing LSTM, the timing characteristics of the traffic data packets and the relationship between them can be used as the basis for judging the nature of the traffic. Through multiple LSTM layers, the feature relationship between these data packets is analyzed. LSTM finds the group containing attack data and marks all the data packets of these groups as attack groups. Finally, the final classification result is obtained through the fully connected layer, the Softmax layer and the output layer. Discard the unsafe message data packets and transmit the useful data to the next stage. As follows Figure 3 ,

[0051] Mimic distribution decision phase: For the request sent by the client, it is returned to the client after distribution and voting. Its life cycle includes the client initiating request phase, request message parsing phase, distribution to the heterogeneous executor resource pool phase, heterogeneous executor resource pool processing response phase, response anomaly monitoring voting phase, and voting result processing phase. After high-speed detection of network messages, the next step is to distribute the application request in real time, which mainly includes obtaining requests, request preprocessing, and sending requests. The request of the distribution component copies the request to the heterogeneous executor. After receiving the request, each running executor processes the request and obtains a response. Finally, the decision component makes response decisions and results processing on the responses of multiple heterogeneous executors, and then returns the results to the distribution and sends them to the client.

[0052] Based on the above architecture, the study of the network anomaly traffic detection model based on CNN-LSTM can achieve efficient message detection effects. Combined with real-time distribution, heterogeneous redundant executors, and anomaly monitoring voting, a mimetic defense architecture based on heterogeneous redundancy can be constructed to achieve mimetic defense for terminal application protection while also improving overall efficiency and robustness.

[0053] Implementation example:

[0054] After the network driver intercepts the network message and obtains the request data, it preprocesses it to obtain a flow set with the same number of messages and message load size. The flow data is processed into a four-tuple feature vector and then input into the network flow message preprocessing component for detection. The data processing implementation method of the network flow message preprocessing component is to use Python's pandas library and sklearn library to clean and segment the data. After the data cleaning is completed, the train_test_split() function of sklearn needs to be used to segment the data, and all the data is divided into a training set and a validation set. The model implementation method of the network flow message preprocessing component is mainly based on the deep learning framework pytorch. CNN model and LSTM model are built respectively, and finally the two models are integrated into one model, that is, the CNN output is used to input into LSTM, and the output of LSTM is compared with the label to obtain the loss. Based on this loss, the ADAM optimizer in torch.optim is used to optimize the model until the accuracy of the model on the validation set tends to be stable, indicating that the model converges. The training is completed to obtain the trained model. The network flow message preprocessing component can realize fast online detection of message traffic.

[0055] The distribution component uses Golang's Gin framework to construct a Web service. The service needs to be configured in the environment variables. After the service is started, the environment variables will be read and the request will be redirected to the variable of the post-application service URL. If multiple responses are received, the response message will be transmitted to the decision component through remote RPC for comparison. If most of the choices are consistent, one response will be returned. If no consensus can be reached, a service unavailable message will be returned.

[0056] The adjudication component is implemented using the Golang RPCX component. There are two adjudication methods, namely binary comparison and special data comparison. Binary comparison uses traditional byte comparison to compare sequences one by one. The other method, special data comparison, uses a plug-in approach to encapsulate the adjudication method into a function, which is called for comparison when needed.

[0057] The above-mentioned embodiment only expresses one implementation mode of the present invention, and its description is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be based on the attached claims.

Claims

1. A mimetic distribution decision method based on deep learning traffic monitoring, characterized in that: Based on the distribution component, adjudication component and executive component in the general mimicry defense structure, this method improves the distribution part in the mimicry application structure, adds the concept of message parsing and preprocessing, and uses deep learning methods to parse and process a large number of untrusted messages to obtain the malicious probability of traffic data, alleviate the situation where temporary information occupies a large amount of storage resources, and realize fast online detection of traffic; The components set up include network traffic message preprocessing components, distribution components, abnormal monitoring voting components, and executive components; the components comply with the standard working mode of the mimicry system of the components in the entire mimicry security defense structure during startup, operation, and cleaning and recovery, and a high-speed parsing preprocessing method for network traffic messages is added before the distribution component's work processing to improve the working efficiency of the mimicry system; In the study of mimetic defense architecture based on heterogeneous redundancy suitable for application environment, we first perform high-speed detection of network packets in the application environment based on network driver, which includes data acquisition, data preprocessing and data analysis. This part uses deep learning methods to combine CNN and LSTM, and combines the mimetic architecture with the CNN-LSTM model. We propose a network packet detection method based on CNN-LSTM, which uses a hybrid network of CNN and LSTM to extract the temporal and spatial characteristics of network traffic data to improve the efficiency and accuracy of network anomaly detection.

2. According to claim 1, the method for mimetic distribution decision based on deep learning traffic monitoring is characterized in that: The specific steps of the mimetic distribution ruling method are as follows: Model training stage: Preprocess the network traffic data set offline, mark whether the data is abnormal and divide it into training set and verification set, build a network packet detection model based on CNN-LSTM, use the training set data to train the network model, and use the test set to test the model effect after the network packet detection model is obtained. After the test passes, the traffic detection model obtained can complete the detection and classification of abnormal packet traffic; High-speed detection stage of network packets: The network traffic packet preprocessing component performs network-driven supervision and control and traffic data packet capture requests sent by the client. After preprocessing the data packet, the network message constitutes the input vector of the input layer of the traffic detection model. After the CNN partial convolution layer extracts the features, the output is transmitted to the pooling layer for feature selection and information filtering. After multiple convolution and pooling operations, the feature block obtained after the fully connected layer represents the spatial feature information of the entire traffic data packet. The LSTM part of the model is connected to the CNN network output, and the latter part consists of the LSTM layer, the fully connected layer, the Softmax layer and the output layer. By introducing LSTM, the temporal features of the traffic data packets and the relationship between them can be used as the basis for judging the nature of the traffic. Through multiple LSTM layers, the feature relationship between these data packets is analyzed. LSTM finds the group containing attack data and marks all the data packets of these groups as attack groups. Finally, the final classification result is obtained through the fully connected layer, the Softmax layer and the output layer. Discard unsafe packets and transfer useful data to the next stage; Mimic distribution and decision phase: For the request sent by the client, it is returned to the client after distribution and voting. Its life cycle includes the client initiating request phase, the request message parsing phase, the distribution to the heterogeneous executor resource pool phase, the heterogeneous executor resource pool processing response phase, the response anomaly monitoring and voting phase, and the voting result processing phase; after high-speed detection of network messages, the next step is to distribute the application request in real time, including obtaining the request, request preprocessing and sending the request; the request is copied and sent to the heterogeneous executor through the request of the distribution component. After receiving the request, each running executor processes the request and obtains a response; finally, the decision component makes response decisions and results processing on the responses of multiple heterogeneous executors, and then returns the results to the distribution and sends them to the client.

3. The method for mimetic distribution decision based on deep learning traffic monitoring according to claim 1 is characterized in that: The components used in the mimic distribution adjudication method are as follows: Network traffic message preprocessing components: The functions of the network traffic message preprocessing component include data acquisition, data preprocessing and data analysis. To obtain the network traffic to be detected, the network driver first intercepts the network message and obtains the request data. Then the original network message is preprocessed to obtain a flow set with the same number of messages and message load size. The traffic data is processed into a four-tuple feature vector and then input into the trained model for detection to obtain the malicious probability of the traffic data and realize fast online detection of message traffic. Since network abnormal traffic has a certain correlation in time and space, the convolutional neural network CNN is mixed with the long-short-term convolutional neural network LSTM to detect abnormal traffic. The abnormal traffic detection method based on LSTM convolutional neural network fully explores the structural characteristics of attack traffic on the basis of extracting the spatial features of a single data packet through CNN, and uses LSTM to extract the time features of the data stream. A high-dimensional data packet vector is output to the LSTM part, and the LSTM part processes the high-dimensional data packet vector into a classification probability vector, which is finally input into the softmax layer to obtain the final classification result. It has a high detection accuracy and a very low false alarm rate. By combining with the general mimicry defense infrastructure, the efficiency and effect of mimicry defense are greatly improved; Distribution components: The function of the distribution component is to receive and respond to the tasks of the endogenous security terminal system. After receiving the request from the network traffic message preprocessing component, it extracts key data from the request, copies the single request and forwards it to three redundant background execution body components. The task response is uploaded to the distribution component through the interface by the adjudication component, and then returned to the response client; The abnormal monitoring voting component is also the ruling component: The function of the adjudication component is to compare the output information generated by multiple application execution bodies at the back end, and to find anomalies contained in the input based on the principle of majority agreement, and to determine whether inconsistency occurs. If the output is consistent, the response of the correct judgment is successfully generated and passed to the redundant real-time distribution component, and the voting result is set to safe. If the output is inconsistent, the response of the correct judgment fails to be generated, and the voting result is set to dangerous. Based on the judgment result, the distribution component determines the final returned result, and realizes autonomous perception of unknown attacks. Actuator components: The executor refers to the server-side application, which receives requests from the distribution component and outputs the processing results to the arbitration component. The arbitration component uses the output data to perform a majority vote to detect whether an attack or vulnerability occurs during the executor processing. The executor cluster adopts a redundancy of greater than or equal to three; it adopts a redundant execution method and is located at the back end of the distribution component. When a single executor fails, it can perform a cleaning operation on the failed component and does not directly provide external services, which can prevent direct external attacks and prevent losses caused by internal vulnerabilities.

4. The method for mimetic distribution decision based on deep learning traffic monitoring according to claim 3 is characterized in that: The network traffic message preprocessing component is specifically implemented as follows: After the network driver intercepts the network message and obtains the request data, it performs preprocessing to obtain a flow set with the same number of messages and message load size. The flow data is processed into a four-tuple feature vector and then input into the network flow message preprocessing component for detection. The data processing implementation method of the network flow message preprocessing component is to use Python's pandas library and sklearn library to clean and segment the data. After the data cleaning is completed, the train_test_split() function of sklearn needs to be used to segment the data, and all the data is divided into a training set and a validation set. The model implementation method of the network flow message preprocessing component is mainly based on the deep learning framework pytorch. CNN model and LSTM model are built respectively, and finally the two models are integrated into one model, that is, the CNN output is used to input into the LSTM, and the output of the LSTM is compared with the label to obtain the loss. Based on this loss, the ADAM optimizer in torch.optim is used to optimize the model until the accuracy of the model on the validation set tends to be stable, indicating that the model converges. The training is completed to obtain the trained model; the network flow message preprocessing component can realize fast online detection of message traffic.

5. The method for mimetic distribution decision based on deep learning traffic monitoring according to claim 3 is characterized in that: The distribution component is implemented as follows: The distribution component uses Golang's Gin framework to construct a Web service. The service needs to be configured in the environment variables. After the service is started, the environment variables will be read and the request will be redirected to the variable of the post-application service URL. If multiple responses are received, the response message will be passed to the decision component through remote RPC for comparison. If most of the choices are consistent, one response will be selected and returned. If no consensus can be reached, a service unavailable message will be returned.

6. The method for mimetic distribution decision based on deep learning traffic monitoring according to claim 3 is characterized in that: The adjudication component is implemented as follows: The adjudication component is implemented using the Golang RPCX component. There are two adjudication methods, namely binary comparison and special data comparison. The binary comparison adopts the traditional byte comparison to compare the sequence in sequence. The other method, special data comparison, adopts a plug-in approach to encapsulate the judgment method into a function, which is called for comparison when necessary.

Images