Security detection method and device for unknown threats of network and electronic equipment

Abstract

The embodiment of the invention provides a security detection method and device for unknown threats of a network and electronic equipment, and belongs to the technical field of network security, and the method comprises the steps: carrying out the feature extraction of sample data D collected from a security network NA through a security classification matrix Mf, and obtaining a first data set containing n feature values; performing m times of data transformation on the obtained unknown threat T to obtain a second data set; calculating a fluctuation matrix MB = Fg (Q1, Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2; and detecting the unknown threat T based on the first data set L = {L1, L2,..., Ln}, the second data set TS = {TS1, TS2,... TSm}, the fluctuation matrix MB and a security detection function Fj to obtain a detection result R = Fj (L, TS, MB), and determining the security of the unknown threat T based on the detection result R. According to the invention, the accuracy and applicability of unknown network threat detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security detection method, device and electronic equipment for unknown network threats. Background Art

[0002] Unknown network threats refer to new types of attacks that have not yet been identified or understood. Such threats often exploit vulnerabilities or attack methods that are not covered by existing security protection mechanisms, so they are difficult to identify and prevent through traditional detection methods based on known threat features.

[0003] The existing technology has the following defects when identifying unknown network threats:

[0004] 1. Signature-based detection methods: Many traditional security solutions rely on signatures or patterns of known threats to detect malicious activities. However, for unknown threats, the effectiveness of this approach is greatly reduced due to the lack of corresponding signatures or patterns.

[0005] 2. Limitations of static analysis: Static analysis is often used to detect malicious code in files, but it cannot identify dynamically generated or encrypted malicious code, which are often part of unknown threats.

[0006] 3. High false positive rate: When using behavioral analysis and anomaly detection techniques, a high false positive rate may occur. This is because these technologies may also mark normal network activities as suspicious while trying to catch abnormal behavior.

[0007] 4. Slow response: There may be a delay between discovering a new threat and updating defenses. During this period, the network may still be attacked. Especially for a rapidly changing threat environment, this delay can lead to serious consequences.

[0008] 5. Complexity and cost: Advanced threat detection technologies (such as artificial intelligence and machine learning) can improve detection efficiency, but they also increase system complexity and operation and maintenance costs. For small and medium-sized enterprises, this may be a considerable burden.

[0009] The above problems become technical problems that need to be solved. Summary of the invention

[0010] In view of this, the embodiments of the present invention provide a security detection method, device and electronic device for unknown network threats, which at least partially solve the problems existing in the prior art.

[0011] In a first aspect, an embodiment of the present invention provides a security detection method for unknown network threats, including:

[0012] The sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values;

[0013] Through a rule set J={J1, J2, …Jm} containing m data transformation rules, m data transformations are performed on the acquired unknown threat T to obtain a second data set TS={TS1, TS2, …TSm};

[0014] The unknown threat T is placed in the security network NA, and a first change curve Q1 corresponding to the data sent and a second change curve Q2 corresponding to the data received in the security network within a preset time period are calculated. Based on the first change curve Q1 and the second change curve Q2, a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, where Fg is a fluctuation calculation function;

[0015] Based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,…TSm}, the fluctuation matrix MB and the security detection function Fj, the unknown threat T is detected to obtain the detection result R=Fj(L,TS,MB). Based on the detection result R, the security of the unknown threat T is determined.

[0016] According to a specific implementation of an embodiment of the present invention, the sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues, including:

[0017] A security classification matrix Mf is predefined, and the security classification matrix Mf contains rules for identifying and classifying network traffic and file characteristics, including protocol type, packet length, transmission frequency, destination IP address, port number, application layer protocol behavior, and encryption characteristics.

[0018] According to a specific implementation of an embodiment of the present invention, the feature extraction of the sample data D collected from the security network NA by the security classification matrix Mf is performed to obtain a first data set L={L1, L2, ..., Ln} containing n feature values, and further includes:

[0019] Perform cleaning and formatting operations on the sample data D, remove noise data in the sample data D, fill in missing values ​​in the sample data D, and obtain standard data;

[0020] Selecting associated data from the standard data based on rules defined in the security classification matrix Mf;

[0021] For each feature in the associated data, calculate the corresponding value to obtain the feature value of the element in the first data set L;

[0022] The calculated eigenvalues ​​are organized into a list to form a first data set L={L1,L2,...,Ln}.

[0023] According to a specific implementation of an embodiment of the present invention, the rule set J={J1, J2, ...Jm} including m data transformation rules is used to perform m data transformations on the acquired unknown threat T to obtain a second data set TS={TS1, TS2, ...TSm}, including:

[0024] A plurality of data conversion rules are set in the data conversion rule set J, and the data conversion rules include data format conversion, data encoding and decoding, data dimension reduction and feature enhancement.

[0025] According to a specific implementation of an embodiment of the present invention, the method further includes: performing m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} including m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm}.

[0026] After obtaining the unknown threat T, prepare the data transformation rule set J={J1,J2,…,Jm};

[0027] For each rule Ji (i=1,2,…,m), apply the rule Ji to the unknown threat T and record the result TSi after each transformation;

[0028] All transformed results TSi are collected to form a second data set TS={TS1, TS2,…, TSm}.

[0029] According to a specific implementation of an embodiment of the present invention, the first change curve Q1 corresponding to the data sent in the security network and the second change curve Q2 corresponding to the data received in the preset time period are calculated, and based on the first change curve Q1 and the second change curve Q2, the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, including:

[0030] Collect the transmission data S(t) and the reception data R(t) in the safety network within the preset time period [t0, tp], express the transmission data change curve Q1 as a time series vector Q1=[S(t0), S(t1), …, S(tp)], and express the reception data change curve Q2 as a time series vector Q2=[R(t0), R(t1), …, R(tp)];

[0031] Data feature extraction is performed on the transmission data S(t) and the reception data R(t) collected in the preset time period to obtain the first feature vector K1=[μ S ,μ R ,σ S ,σ R ,ρ SR ],in:

[0032]

[0033]

[0034]

[0035] p is the number of time series divided into by the preset time period, t i is a time point in the time series, S(t i ) represents the time point t i The amount of data sent in the secure network, R(t i ) represents the time point t i The amount of data received in the secure network at the time

[0036] According to a specific implementation of an embodiment of the present invention, the first change curve Q1 corresponding to the data sent in the security network and the second change curve Q2 corresponding to the data received in the preset time period are calculated, and based on the first change curve Q1 and the second change curve Q2, the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, and further includes:

[0037] Use the autocorrelation function (ACF) to capture the time dependence of the data:

[0038] ,

[0039] Through data transformation, the time series data is converted to the frequency domain to analyze the changes in different frequency components:

[0040]

[0041]

[0042] Based on the calculation results, the volatility matrix MB is constructed:

[0043]

[0044] , Respectively represent the frequency characteristics and power characteristics of the first characteristic curve, , They represent the frequency characteristics and power characteristics of the second characteristic curve respectively.

[0045] According to a specific implementation of an embodiment of the present invention, the unknown threat T is detected based on the first data set L={L1, L2, ..., Ln}, the second data set TS={TS1, TS2, ... TSm}, the fluctuation matrix MB and the security detection function Fj to obtain the detection result R=Fj(L, TS, MB), including:

[0046] Flatten the volatility matrix MB into a one-dimensional vector MBf, and concatenate L, TS, and MBf into a comprehensive eigenvector X:

[0047] X=[L1,L2,…,Ln,TS1,TS2,…,TSm,MBf]

[0048] Construct the security detection function Fj:

[0049]

[0050] Among them, w is the weight vector, b is the bias term, and X is the input feature vector. It is a sign function, and the output is +1 or -1, indicating the presence or absence of a threat, respectively. If R=+1, it means that the unknown threat T is detected, and if R=-1, it means that the unknown threat T is not detected.

[0051] In a second aspect, an embodiment of the present invention provides a security detection device for unknown network threats, including:

[0052] The acquisition module extracts features of the sample data D collected from the security network NA through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues;

[0053] The transformation module performs m data transformations on the acquired unknown threat T through a rule set J={J1,J2,…Jm} containing m data transformation rules to obtain a second data set TS={TS1,TS2,…TSm};

[0054] A calculation module is provided, which places the unknown threat T in the security network NA, calculates a first change curve Q1 corresponding to the data sent in the security network and a second change curve Q2 corresponding to the data received in the security network within a preset time period, and calculates a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2, where Fg is a fluctuation calculation function;

[0055] The detection module detects the unknown threat T based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,...TSm}, the fluctuation matrix MB and the security detection function Fj, obtains the detection result R=Fj(L,TS,MB), and determines the security of the unknown threat T based on the detection result R.

[0056] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0057] at least one processor; and,

[0058] a memory communicatively connected to the at least one processor; wherein,

[0059] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security detection method for unknown network threats in any of the first aspects or any of the implementations of the first aspect.

[0060] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the security detection method for unknown network threats in the aforementioned first aspect or any implementation of the first aspect.

[0061] In the fifth aspect, an embodiment of the present invention further provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the security detection method for unknown network threats in the aforementioned first aspect or any implementation of the first aspect.

[0062] The security detection scheme for unknown network threats in the embodiment of the present invention includes: extracting features from sample data D collected from a security network NA through a security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values; performing m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} containing m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm}; placing the unknown threat T in the security network NA, calculating the first corresponding to the data sent in the security network within a preset time period The change curve Q1 and the second change curve Q2 corresponding to the received data, based on the first change curve Q1 and the second change curve Q2, calculate the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T, Fg is a fluctuation calculation function; based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,...TSm}, the fluctuation matrix MB and the security detection function Fj, the unknown threat T is detected to obtain the detection result R=Fj(L,TS,MB), based on the detection result R, determine the security of the unknown threat T. This solution has the following beneficial effects:

[0063] 1. Multi-dimensional feature analysis: By extracting features from sample data D through the security classification matrix Mf, network activities can be analyzed from multiple perspectives, which helps to more comprehensively understand normal behavior patterns and identify abnormal behaviors.

[0064] 2. Data transformation enhances recognition capability: Using a set of data transformation rules J to transform unknown threats T multiple times can reveal different aspects of the threat, thereby increasing the recognition capability and flexibility of the detection system. This method helps to detect threats that attempt to evade detection through simple disguises.

[0065] 3. Dynamic behavior analysis: By calculating the network activity change curves Q1 and Q2 of unknown threats within a preset time period and constructing the fluctuation matrix MB based on them, this method can capture the characteristics of threat behavior evolving over time. This is particularly important for identifying advanced threats with complex behavior patterns or whose behavior characteristics change over time.

[0066] 4. Comprehensive decision-making mechanism: The final detection result R is determined based on the feature set L, the transformed data set TS, and the fluctuation matrix MB. This method of comprehensively considering multiple factors helps to improve the accuracy of judgment and reduce the possibility of false positives and false negatives.

[0067] 5. Strong adaptability: This method is designed to be flexible and can adjust parameters such as feature extraction rules, data transformation rules, and fluctuation calculation functions according to actual application scenarios, so that it can better adapt to security requirements in different environments.

[0068] 6. Improved detection capabilities for unknown threats: By performing multi-angle analysis and transformation processing on unknown threats, this method can, to a certain extent, overcome the limitations of traditional signature-based or pattern matching methods that are difficult to deal with unknown threats, and enhance the ability to discover new threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0070] Figure 1 A schematic flow chart of a security detection method for unknown network threats provided by an embodiment of the present invention;

[0071] Figure 2 A schematic flow chart of another security detection method for unknown network threats provided by an embodiment of the present invention;

[0072] Figure 3 A schematic diagram of the structure of a security detection device for unknown network threats provided by an embodiment of the present invention;

[0073] Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0075] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0076] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0077] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0078] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0079] The disclosed embodiment provides a security detection method for unknown network threats. The security detection method for unknown network threats provided by the embodiment can be executed by a computing device, which can be implemented as software, or as a combination of software and hardware, and the computing device can be integrated in a server, terminal device, etc.

[0080] See also Figure 1 The present disclosure provides a security detection method for unknown network threats, including:

[0081] S101, extracting features from sample data D collected from a security network NA through a security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues.

[0082] Extracting features from the sample data D collected from the security network NA through the security classification matrix Mf to obtain the first data set L={L1,L2,...,Ln} containing n eigenvalues ​​is a key step in the entire security detection process. This process mainly includes the following aspects:

[0083] It is necessary to select a set of effective features to describe network traffic or behavior based on the characteristics of network security. These features may include but are not limited to:

[0084] Traffic statistics characteristics: such as packet size, transmission rate, connection frequency, etc.

[0085] Time series characteristics: such as activity cycle, interval time distribution, etc.

[0086] Protocol characteristics: such as the type of protocol used, port number, etc.

[0087] Content features: such as URL, domain name, file type, etc.

[0088] Behavioral characteristics: such as access patterns, user behavior habits, etc.

[0089] The security classification matrix Mf is a predefined model or algorithm used to transform the original sample data D into a set of eigenvalues. This matrix or model can be based on one or a combination of the following techniques:

[0090] Statistical methods: Use statistical methods to quantify the characteristics of network traffic, such as mean, standard deviation, etc.

[0091] Machine Learning: Use supervised or unsupervised learning algorithms, such as support vector machines (SVM), random forests, neural networks, etc., to learn and extract features from historical data.

[0092] Deep learning: Use deep learning models, such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs), to automatically learn complex feature representations.

[0093] Natural Language Processing: If the data contains text information, NLP technology can be used to extract semantic features.

[0094] The feature extraction process can include the following steps:

[0095] 1. Data preprocessing: Clean the raw data, remove noise and irrelevant information, and ensure data quality.

[0096] 2. Feature selection and extraction: Based on the selected feature set, the corresponding feature values ​​are extracted from the preprocessed data.

[0097] 3. Normalization / Standardization: Normalize or standardize the extracted feature values ​​to eliminate the impact of dimensions between different features and improve the accuracy of subsequent analysis.

[0098] 4. Feature vectorization: Convert the extracted feature values ​​into vector form to form the first data set L.

[0099] S102, using a rule set J={J1, J2, ...Jm} including m data transformation rules, perform m data transformations on the acquired unknown threat T to obtain a second data set TS={TS1, TS2, ...TSm}.

[0100] By using a rule set J={J1,J2,...,Jm} containing m data transformation rules, the acquired unknown threat T is transformed m times to obtain the second data set TS={TS1,TS2,...,TSm}, which is an important step to improve the accuracy and robustness of threat detection.

[0101] The choice of data conversion rules depends on the threat detection goals and specific application scenarios. Common data conversion rules include:

[0102] 1. Encoding conversion: Encode the original data into a different format, such as encoding a string into numeric data, or encoding binary data into hexadecimal.

[0103] 2. Normalization: Scale the data values ​​to a fixed range, such as [0, 1] or [-1, 1], to eliminate the effect of dimension.

[0104] 3. Discretization: Convert continuous data into discrete data, such as dividing age into different intervals.

[0105] 4. Feature combination: combine multiple features into a new feature, such as combining an IP address and a port number into a composite feature.

[0106] 5. Data enhancement: Generate more training data by adding noise, rotation, translation and other operations to enhance the generalization ability of the model.

[0107] 6. Dimensionality reduction: Use methods such as principal component analysis (PCA) and linear discriminant analysis (LDA) to reduce feature dimensions and improve computational efficiency.

[0108] 7. Time series conversion: Convert time series data into frequency domain data using methods such as Fourier transform or wavelet transform.

[0109] 8. Feature selection: Select the most relevant features through feature selection algorithms (such as recursive feature elimination RFE, LASSO regression, etc.).

[0110] The data transformation process usually includes the following steps:

[0111] 1. Data preprocessing: Clean the raw data, remove noise and missing values, and ensure data quality.

[0112] 2. Apply transformation rules: Apply each data transformation rule Ji (i=1,2,...,m) in turn to transform the unknown threat T.

[0113] 3. Generate transformed data: Each time a transformation rule is applied, a new data set TSi is generated.

[0114] 4. Combine transformation results: combine all transformed data sets into a second data set TS.

[0115] Through data transformation, the effect of unknown threat detection can be enhanced and the overall security of the system can be improved.

[0116] S103, placing the unknown threat T in the security network NA, calculating the first change curve Q1 corresponding to the data sent and the second change curve Q2 corresponding to the data received in the security network within a preset time period, and based on the first change curve Q1 and the second change curve Q2, calculating the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T, where Fg is the fluctuation calculation function.

[0117] The unknown threat T is placed in the security network NA, and the first change curve Q1 corresponding to the data sent in the network and the second change curve Q2 corresponding to the data received in the preset time period are calculated. Then, based on these two change curves, the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated. This is an important step to evaluate the impact of unknown threats through dynamic behavior analysis. The following are detailed steps and explanations:

[0118] Step 1: Place unknown threats in a secure network

[0119] 1. Simulation environment: Introduce unknown threats T in a controlled, isolated environment (such as a sandbox or virtual network) to ensure that they will not affect the production network.

[0120] 2. Monitoring tools: Deploy network monitoring tools such as traffic analyzers, loggers, etc. to collect network activity data.

[0121] Step 2: Calculate the first change curve Q1 and the second change curve Q2

[0122] 1. Data collection: Record all sent and received data in the network within a preset time period (for example, 1 hour).

[0123] 2. Time series data: Organize the sent data and received data into time series data respectively.

[0124] The time series of sending data is recorded as S(t)

[0125] The time series of received data is recorded as R(t)

[0126] 3. Calculate the change curve:

[0127] The first change curve Q1: represents the change trend of the transmitted data over time. It can be calculated using the following method:

[0128] Q1(t)=dS(t) / dt

[0129] Wherein, dS(t) / dt represents the rate of change of the transmitted data over time.

[0130] The second change curve Q2: represents the change trend of the received data over time. It can be calculated using the following method:

[0131] Q2(t)=dR(t) / dt

[0132] Wherein, dR(t) / dt represents the rate of change of received data over time.

[0133] Step 3: Calculate the volatility matrix MB

[0134] 1. Fluctuation calculation function Fg: A fluctuation calculation function Fg is defined to convert the first change curve Q1 and the second change curve Q2 into a fluctuation matrix MB. Common fluctuation calculation methods include:

[0135] Covariance matrix: Calculate the covariance matrix of Q1 and Q2 to reflect the correlation between the two.

[0136] MB=Cov(Q1,Q2)

[0137] Cross-correlation function: Calculate the cross-correlation function of Q1 and Q2 to reflect the time delay relationship between the two.

[0138] MB= Corr(Q1,Q2)

[0139] Spectrum analysis: Perform Fourier transform on Q1 and Q2 to analyze their spectrum characteristics.

[0140] MB={FFT(Q1,Q2)

[0141] 2. Fluctuation matrix MB: The final fluctuation matrix MB can be a two-dimensional matrix, in which each element reflects the fluctuation of the sent data and the received data at different time points.

[0142] By calculating the volatility matrix MB, we can:

[0143] Dynamic behavior analysis: Capture the dynamic behavior of unknown threats over a period of time and identify abnormal network activity patterns.

[0144] Correlation analysis: Analyze the correlation between sent data and received data to discover potential associations and dependencies.

[0145] Time series features: Preserving the characteristics of time series helps to identify temporal trends and periodic behaviors.

[0146] In summary, through dynamic behavior analysis and volatility matrix calculation, the impact of unknown threats on the network can be more comprehensively evaluated, and the accuracy and reliability of threat detection can be improved.

[0147] S104, based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,...TSm}, the fluctuation matrix MB and the security detection function Fj, the unknown threat T is detected to obtain the detection result R=Fj(L,TS,MB), and based on the detection result R, the security of the unknown threat T is determined.

[0148] Based on the first data set L={L1, L2, ..., Ln}, the second data set TS={TS1, TS2, ..., TSm}, the fluctuation matrix MB and the security detection function Fj, the unknown threat T is detected to obtain the detection result R=Fj(L, TS, MB), and the security of the unknown threat T is determined based on the detection result R. This is a multi-step process. The following are the detailed steps and explanations:

[0149] Step 1: Prepare input data

[0150] 1. The first data set L: a set of feature values ​​obtained by extracting features from sample data D collected from the security network NA.

[0151] 2. The second data set TS: a set of feature values ​​obtained after data transformation of the unknown threat T.

[0152] 3. Fluctuation matrix MB: The fluctuation matrix calculated based on the first variation curve Q1 of the transmitted data and the second variation curve Q2 of the received data.

[0153] Step 2: Define the security detection function Fj

[0154] The security detection function Fj is a comprehensive evaluation model that combines multiple features and data to determine the security of unknown threats T. Common security detection functions can be based on one or a combination of the following methods:

[0155] 1. Machine Learning Model:

[0156] Supervised learning: Use labeled training data (known threats and normal behaviors) to train classification models, such as support vector machines (SVM), random forests, logistic regression, etc.

[0157] Unsupervised learning: Use clustering algorithms (such as K-means) or anomaly detection algorithms (such as IsolationForest) to identify abnormal behavior.

[0158] 2. Deep Learning Model:

[0159] Neural Networks: Use models such as Multilayer Perceptron (MLP), Convolutional Neural Network (CNN), Recurrent Neural Network (RNN) to extract complex feature representations.

[0160] Autoencoder: Used to reconstruct input data and identify abnormal behavior by detecting reconstruction errors.

[0161] 3. Hybrid Model:

[0162] Combine multiple machine learning and deep learning methods to improve detection accuracy and robustness.

[0163] Step 3: Input data to the security detection function Fj

[0164] The first data set L, the second data set TS and the fluctuation matrix MB are passed as input to the safety detection function Fj.

[0165] Step 4: Calculate the detection result R

[0166] The security detection function Fj performs a comprehensive evaluation based on the input data and outputs the detection result R. The detection result R can be a scalar value, indicating the probability or severity of the threat, or a multidimensional vector, indicating the evaluation results of multiple aspects.

[0167] Step 5: Determine security against unknown threat T

[0168] According to the detection result R, determine the safety of the unknown threat T. Specific methods may include:

[0169] 1.Threshold determination:

[0170] If R is a scalar value, a threshold θ can be set. If R>θ, then T is considered a threat; otherwise, T is considered safe.

[0171] For example, if R represents the threat probability, we can set θ=0.5.

[0172] 2. Multi-level evaluation:

[0173] If R is a multidimensional vector, each dimension can be evaluated separately and the results of multiple dimensions can be combined to determine security.

[0174] For example, multiple thresholds can be set, one for each dimension, and T is considered safe only when all dimensions meet the conditions.

[0175] By comprehensively using a variety of features and data transformation methods, combined with a powerful security detection function Fj, the security of unknown threats T can be effectively evaluated. This method not only improves the accuracy of detection, but also enhances the robustness and adaptability of the system, and is suitable for complex and changing network security environments.

[0176] According to a specific implementation of an embodiment of the present invention, the sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues, including:

[0177] A security classification matrix Mf is predefined, and the security classification matrix Mf contains rules for identifying and classifying network traffic and file characteristics, including protocol type, data packet length, transmission frequency, destination IP address, port number, application layer protocol behavior, and encryption characteristics.

[0178] See also Figure 2 According to a specific implementation of an embodiment of the present invention, the sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues, and further comprising:

[0179] S201, performing cleaning and formatting operations on the sample data D, removing noise data in the sample data D, filling missing values ​​in the sample data D, and obtaining standard data;

[0180] S202, selecting associated data from the standard data based on the rules defined in the security classification matrix Mf;

[0181] S203, for each feature in the associated data, calculate the corresponding value to obtain the feature value of the element in the first data set L;

[0182] S204, organizing the calculated eigenvalues ​​into a list to form a first data set L={L1, L2, ..., Ln}.

[0183] According to a specific implementation of an embodiment of the present invention, the rule set J={J1, J2, ...Jm} including m data transformation rules is used to perform m data transformations on the acquired unknown threat T to obtain a second data set TS={TS1, TS2, ...TSm}, including:

[0184] A plurality of data conversion rules are set in the data conversion rule set J, and the data conversion rules include data format conversion, data encoding and decoding, data dimension reduction and feature enhancement.

[0185] According to a specific implementation of an embodiment of the present invention, the method further includes: performing m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} including m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm}.

[0186] After obtaining the unknown threat T, prepare the data transformation rule set J={J1,J2,…,Jm};

[0187] For each rule Ji (i=1,2,…,m), apply the rule Ji to the unknown threat T and record the result TSi after each transformation;

[0188] All transformed results TSi are collected to form a second data set TS={TS1, TS2,…, TSm}.

[0189] According to a specific implementation of an embodiment of the present invention, the first change curve Q1 corresponding to the data sent in the security network and the second change curve Q2 corresponding to the data received in the preset time period are calculated, and based on the first change curve Q1 and the second change curve Q2, the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, including:

[0190] Collect the transmission data S(t) and the reception data R(t) in the safety network within the preset time period [t0, tp], express the transmission data change curve Q1 as a time series vector Q1=[S(t0), S(t1), …, S(tp)], and express the reception data change curve Q2 as a time series vector Q2=[R(t0), R(t1), …, R(tp)];

[0191] Data feature extraction is performed on the transmission data S(t) and the reception data R(t) collected in the preset time period to obtain the first feature vector K1=[μ S ,μ R ,σ S ,σ R ,ρ SR ],in:

[0192]

[0193]

[0194]

[0195] p is the number of time series divided into by the preset time period, t i is a time point in the time series, S(t i ) represents the time point t i The amount of data sent in the secure network, R(t i ) represents the time point t i The amount of data received in the secure network at the time

[0196] According to a specific implementation of an embodiment of the present invention, the first change curve Q1 corresponding to the data sent in the security network and the second change curve Q2 corresponding to the data received in the preset time period are calculated, and based on the first change curve Q1 and the second change curve Q2, the fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, and further includes:

[0197] Use the autocorrelation function (ACF) to capture the time dependence of the data:

[0198] ,

[0199] Through data transformation, the time series data is converted to the frequency domain to analyze the changes in different frequency components:

[0200]

[0201]

[0202] Based on the calculation results, the volatility matrix MB is constructed:

[0203]

[0204] , Respectively represent the frequency characteristics and power characteristics of the first characteristic curve, , They represent the frequency characteristics and power characteristics of the second characteristic curve respectively.

[0205] According to a specific implementation of an embodiment of the present invention, the unknown threat T is detected based on the first data set L={L1, L2, ..., Ln}, the second data set TS={TS1, TS2, ... TSm}, the fluctuation matrix MB and the security detection function Fj to obtain the detection result R=Fj(L, TS, MB), including:

[0206] Flatten the volatility matrix MB into a one-dimensional vector MBf, and concatenate L, TS, and MBf into a comprehensive eigenvector X:

[0207] X=[L1,L2,…,Ln,TS1,TS2,…,TSm,MBf]

[0208] Construct the security detection function Fj:

[0209]

[0210] Among them, w is the weight vector, b is the bias term, and X is the input feature vector. It is a sign function, and the output is +1 or -1, indicating the presence or absence of a threat, respectively. If R=+1, it means that the unknown threat T is detected, and if R=-1, it means that the unknown threat T is not detected.

[0211] Corresponding to the above method embodiment, see Figure 3 The embodiment of the present invention further discloses a security detection device 30 for unknown network threats, including:

[0212] The collection module 301 extracts features from the sample data D collected from the security network NA through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values;

[0213] The transformation module 302 performs m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} including m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm};

[0214] The calculation module 303 places the unknown threat T in the security network NA, calculates a first change curve Q1 corresponding to the data sent in the security network and a second change curve Q2 corresponding to the data received in the preset time period, and calculates a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2, where Fg is a fluctuation calculation function;

[0215] The detection module 304 detects the unknown threat T based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,...TSm}, the fluctuation matrix MB and the security detection function Fj, obtains the detection result R=Fj(L,TS,MB), and determines the security of the unknown threat T based on the detection result R.

[0216] See also Figure 4 The embodiment of the present invention further provides an electronic device 60, the electronic device comprising:

[0217] at least one processor; and,

[0218] a memory communicatively connected to the at least one processor; wherein,

[0219] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security detection method for unknown network threats in the aforementioned method embodiment.

[0220] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute the aforementioned method embodiment.

[0221] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the security detection method for unknown network threats in the aforementioned method embodiment.

[0222] Reference below Figure 4 , which shows a schematic diagram of the structure of an electronic device 60 suitable for implementing the embodiment of the present disclosure. The electronic device in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0223] like Figure 4 As shown, the electronic device 60 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 60 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0224] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, a gage, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 60 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 60 is shown with various devices, but it should be understood that it is not required to implement or have all the devices shown. More or fewer devices may be implemented or have instead.

[0225] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0226] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A security detection method for unknown network threats, characterized in that: include: The sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values; Through a rule set J={J1, J2, …Jm} containing m data transformation rules, m data transformations are performed on the acquired unknown threat T to obtain a second data set TS={TS1, TS2, …TSm}; The unknown threat T is placed in the security network NA, and a first change curve Q1 corresponding to the data sent and a second change curve Q2 corresponding to the data received in the security network within a preset time period are calculated. Based on the first change curve Q1 and the second change curve Q2, a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T is calculated, where Fg is a fluctuation calculation function; Based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,…TSm}, the fluctuation matrix MB and the security detection function Fj, the unknown threat T is detected to obtain the detection result R=Fj(L,TS,MB). Based on the detection result R, the security of the unknown threat T is determined.

2. The method according to claim 1, characterized in that The sample data D collected from the security network NA is subjected to feature extraction through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values, including: A security classification matrix Mf is predefined, and the security classification matrix Mf contains rules for identifying and classifying network traffic and file characteristics, including protocol type, data packet length, transmission frequency, destination IP address, port number, application layer protocol behavior, and encryption characteristics.

3. The method according to claim 2, characterized in that The method extracts features from the sample data D collected from the security network NA through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n feature values, and further includes: Perform cleaning and formatting operations on the sample data D, remove noise data in the sample data D, fill in missing values ​​in the sample data D, and obtain standard data; Selecting associated data from the standard data based on rules defined in the security classification matrix Mf; For each feature in the associated data, calculate the corresponding value to obtain the feature value of the element in the first data set L; The calculated eigenvalues ​​are organized into a list to form a first data set L={L1,L2,...,Ln}.

4. The method according to claim 3, characterized in that The method performs m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} including m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm}, including: A plurality of data conversion rules are set in the data conversion rule set J, and the data conversion rules include data format conversion, data encoding and decoding, data dimension reduction and feature enhancement.

5. The method according to claim 4, characterized in that The method further includes: performing m data transformations on the acquired unknown threat T through a rule set J={J1, J2, ...Jm} including m data transformation rules to obtain a second data set TS={TS1, TS2, ...TSm}. After obtaining the unknown threat T, prepare the data transformation rule set J={J1,J2,…,Jm}; For each rule Ji (i=1,2,…,m), apply the rule Ji to the unknown threat T and record the result TSi after each transformation; All transformed results TSi are collected to form a second data set TS={TS1, TS2,…, TSm}.

6. The method according to claim 5, characterized in that The calculating of a first change curve Q1 corresponding to the data sent in the security network and a second change curve Q2 corresponding to the data received in the security network within a preset time period, and calculating a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2, includes: Collect the transmission data S(t) and the reception data R(t) in the safety network within the preset time period [t0, tp], express the transmission data change curve Q1 as a time series vector Q1=[S(t0), S(t1), …, S(tp)], and express the reception data change curve Q2 as a time series vector Q2=[R(t0), R(t1), …, R(tp)]; Data feature extraction is performed on the transmission data S(t) and the reception data R(t) collected in the preset time period to obtain the first feature vector K1=[μ S ,μ R ,σ S ,σ R ,ρ SR ],in: p is the number of time series divided into by the preset time period, t i is a time point in the time series, S(t i ) represents the time point t i The amount of data sent in the secure network, R(t i ) represents the time point t i The amount of data received in the secure network at the time 7. The method according to claim 6, characterized in that The method further comprises: calculating a first change curve Q1 corresponding to the data sent in the security network and a second change curve Q2 corresponding to the data received in the security network within a preset time period, and calculating a fluctuation matrix MB=Fg(Q1, Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2. Use the autocorrelation function (ACF) to capture the time dependence of the data: , Through data transformation, the time series data is converted to the frequency domain to analyze the changes in different frequency components: Based on the calculation results, the volatility matrix MB is constructed: , Respectively represent the frequency characteristics and power characteristics of the first characteristic curve, , They represent the frequency characteristics and power characteristics of the second characteristic curve respectively.

8. The method according to claim 7, characterized in that The method of detecting the unknown threat T based on the first data set L={L1, L2, ..., Ln}, the second data set TS={TS1, TS2, ... TSm}, the fluctuation matrix MB and the security detection function Fj to obtain a detection result R=Fj(L, TS, MB) includes: Flatten the volatility matrix MB into a one-dimensional vector MBf, and concatenate L, TS, and MBf into a comprehensive eigenvector X: X=[L1,L2,…,Ln,TS1,TS2,…,TSm,MBf] Construct the security detection function Fj: Among them, w is the weight vector, b is the bias term, and X is the input feature vector. It is a sign function, and the output is +1 or -1, indicating the presence or absence of a threat, respectively. If R=+1, it means that the unknown threat T is detected, and if R=-1, it means that the unknown threat T is not detected.

9. A security detection device for unknown network threats, characterized in that: include: The acquisition module extracts features of the sample data D collected from the security network NA through the security classification matrix Mf to obtain a first data set L={L1, L2, ..., Ln} containing n eigenvalues; The transformation module performs m data transformations on the acquired unknown threat T through a rule set J={J1,J2,…Jm} containing m data transformation rules to obtain a second data set TS={TS1,TS2,…TSm}; A calculation module is provided, which places the unknown threat T in the security network NA, calculates a first change curve Q1 corresponding to the data sent in the security network and a second change curve Q2 corresponding to the data received in the security network within a preset time period, and calculates a fluctuation matrix MB=Fg(Q1,Q2) corresponding to the unknown threat T based on the first change curve Q1 and the second change curve Q2, where Fg is a fluctuation calculation function; The detection module detects the unknown threat T based on the first data set L={L1,L2,...,Ln}, the second data set TS={TS1,TS2,...TSm}, the fluctuation matrix MB and the security detection function Fj, obtains the detection result R=Fj(L,TS,MB), and determines the security of the unknown threat T based on the detection result R.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the security detection method for unknown network threats as described in any one of claims 1 to 8.

Images