Intelligent defense and detection methods for network vulnerabilities, computer equipment

Abstract

The embodiments of the present application relate to the field of intelligent defense and detection of network vulnerabilities, and specifically to intelligent defense and detection methods and computer equipment for network vulnerabilities. A specific implementation method of the method includes: collecting historical network data sequences corresponding to each network device in a network device cluster within a historical time period; generating a network device spatial association matrix corresponding to the network device cluster through network call path information; generating network device spatial feature information of each historical time node based on the network device spatial association matrix and the historical network data sequence set; generating network device vulnerability detection information of the network device cluster at the target time corresponding to the network device cluster based on the network device spatial feature information through a pre-trained network vulnerability detection model; and performing network detection on network devices in the network device cluster based on the network device vulnerability detection information. This implementation method can detect the operation of network devices in a cluster, and improves the comprehensiveness of network device detection.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of intelligent network vulnerability defense and detection, and specifically to a network vulnerability intelligent defense and detection method and computer equipment. Background Art

[0002] As the issue of information security on the international Internet becomes increasingly prominent, strengthening network security management has become a top priority. When a network system has vulnerabilities, the network system is at risk of being attacked by the network. The process of vulnerability detection is the process of detecting the unprocessed vulnerabilities in the network system. When there are unprocessed vulnerabilities in the network system, serious consequences may occur, such as network paralysis, equipment loss, etc. At present, the method commonly used for detecting network vulnerabilities is that the user inputs the information such as the network data of the device to be detected into the security vulnerability scanning tool disclosed on the network vulnerability detection platform for detection.

[0003] However, this method usually has the following technical problems: low detection efficiency and long delay time; and it can only detect a single device, and cannot detect the operation status of the network device based on the operating indicators of other related network devices, resulting in incomplete vulnerability detection and reduced security of network devices. Summary of the invention

[0004] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present application propose a network vulnerability intelligent defense and detection method, a computer device, and a computer-readable storage medium to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present application provide a method for intelligent defense and detection of network vulnerabilities, the method comprising: collecting a historical network data sequence corresponding to each network device in a network device cluster within a historical time period to obtain a historical network data sequence set, wherein the above-mentioned network device cluster corresponds to network call path information, and one historical network data corresponds to a historical time node; through the above-mentioned network call path information, generating a network device spatial association matrix corresponding to the above-mentioned network device cluster; based on the above-mentioned network device spatial association matrix and the above-mentioned historical network data sequence set, generating network device spatial feature information corresponding to each historical time node of the above-mentioned network device cluster; based on the above-mentioned network device spatial feature information, generating network device vulnerability detection information corresponding to the target time of the above-mentioned network device cluster through a pre-trained network vulnerability detection model; and based on the above-mentioned network device vulnerability detection information, performing network detection on the network devices in the above-mentioned network device cluster.

[0007] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0008] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0009] The above-mentioned embodiments of the present application have the following beneficial effects: the duration of network device detection can be shortened and the accuracy of detecting the operation status of each network device can be improved. And the operation status of the network device in the cluster can be detected, which improves the comprehensiveness of the network device detection. First, the historical network data sequence corresponding to each network device in the network device cluster in the historical time period is collected to obtain a historical network data sequence set. Among them, the above-mentioned network device cluster corresponds to network call path information, and one historical network data corresponds to a historical time node. Thus, the historical network data sequence of each network device with a call relationship can be obtained. Secondly, the network device space association matrix corresponding to the above-mentioned network device cluster is generated through the above-mentioned network call path information. Thus, the call relationship between each network device can be quantitatively represented in the form of a matrix. Then, according to the above-mentioned network device space association matrix and the above-mentioned historical network data sequence set, the network device space feature information corresponding to each historical time node of the above-mentioned network device cluster is generated. Thus, the correlation features of the historical network data of each network device in the call space can be found. Then, according to the above-mentioned network device space feature information, the network device vulnerability detection information corresponding to the target time of the above-mentioned network device cluster is generated through the pre-trained network vulnerability detection model. Therefore, the time correlation feature can be further captured on the basis of the spatial correlation feature of the network device to detect the network device vulnerability detection information at the target time. Because the spatial and temporal correlation of the time information is captured, the accuracy of the network device vulnerability detection information is improved. Finally, according to the above network device vulnerability detection information, the network devices in the above network device cluster are subjected to network detection. As a result, the duration of network device detection is shortened and the accuracy of detecting the operation status of each network device is improved. In addition, the operation status of the network device in the cluster can be detected, which improves the comprehensiveness of the network device detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0011] Figure 1 is a flow chart of some embodiments of the network vulnerability intelligent defense and detection method according to the present application;

[0012] Figure 2 is a schematic diagram of a computer device suitable for implementing some embodiments of the present application;

[0013] Figure 3 It is a schematic diagram of the network device call path in the network vulnerability intelligent defense and detection method according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0014] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0015] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0016] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0017] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0018] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0019] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0020] Figure 1 The process 100 of some embodiments of the network vulnerability intelligent defense and detection method according to the present application is shown. The network vulnerability intelligent defense and detection method includes the following steps:

[0021] Step 101 , collecting a historical network data sequence corresponding to each network device in a network device cluster within a historical time period to obtain a historical network data sequence set.

[0022] In some embodiments, the execution subject (for example, a computing device) of the network vulnerability intelligent defense and detection method can collect the historical network data sequence corresponding to each network device in the network device cluster within the historical time period from the associated database to obtain a historical network data sequence set. Among them, the above-mentioned network device cluster corresponds to network call path information, and one historical network data corresponds to a historical time node. For example, the preset time period can be the time period corresponding to the past week. The above-mentioned network device cluster can represent devices that provide various network services. The device network data of the network device can be stored in the above-mentioned database. The device network data may include: daily query rate, daily visits, daily browsing volume, daily download volume, and daily communication resource consumption. The device network data has a time granularity. For example, the time granularity of the daily query rate can be 1 day. The historical network data sequence can be each performance data of the network device within the preset time period. Each historical network data sequence can correspond to a network device. Each historical network data in the historical network data sequence can be arranged in chronological order. The historical network data in the historical network data sequence can correspond to a historical time node, that is, the collection time node of the historical network data. The network call path information can represent the call relationship between the network devices in the above-mentioned network device cluster. For example, the network call path information may include various call relationship information. The call relationship information may include a first network device and a second network device. The first network device may be a network device that performs the call. The second network device may be a network device that is called. For example, the network call path information may include: network device B, network device A; network device A, network device C; network device C, network device D. For another example, two network devices may also call each other. For example, Figure 3 In this example, the calling relationship between network devices A, B, C, and D is illustrated. Figure 3 In the example, network device A and network device B have a path calling relationship. Network device A and network device C have a path calling relationship. Network device A and network device D have a path calling relationship. Network device B and network device C have a path calling relationship. Network device B and network device D have a path calling relationship. Network device C and network device D have a path calling relationship.

[0023] In an actual application scenario, the above execution subject can collect the historical network data sequence corresponding to each network device in the network device cluster within the historical time period through the following steps:

[0024] The first step is to obtain the initial historical network data sequence corresponding to the above network devices within the historical time period.

[0025] The second step is to perform data standardization processing on the above-mentioned initial historical network data sequence to obtain a standardized historical network data sequence. Data standardization processing may refer to the processing of supplementing the missing data in the initial historical network data sequence. For example, the average value of each initial historical network data in the initial historical network data sequence may be determined as the filling data of the missing data to fill the missing data.

[0026] The third step is to perform data smoothing on the above-mentioned standardized historical network data sequence to obtain a standardized historical network data sequence after data smoothing as the historical network data sequence corresponding to the network device. For example, the above-mentioned execution subject can perform data smoothing on the above-mentioned standardized historical network data sequence through a data smoothing algorithm to obtain a standardized historical network data sequence after data smoothing as the historical network data sequence corresponding to the network device. The data smoothing algorithm can be an exponential smoothing algorithm.

[0027] Step 102: Generate a network device spatial association matrix corresponding to the network device cluster through the network call path information.

[0028] In some embodiments, the execution subject may generate a network device space association matrix corresponding to the network device cluster through the network call path information, wherein the network device space association matrix may be a matrix used to characterize the call relationship between different network devices.

[0029] In an actual application scenario, the execution subject can generate a network device spatial association matrix corresponding to the network device cluster through the following steps:

[0030] In the first step, for each network device in the above network device cluster, perform the following processing steps:

[0031] First, the above network device is determined as a target network device.

[0032] Second, based on the call link information, determine whether the target network device has an association relationship with other network devices in the network device cluster. There is a direct link call relationship between two network devices that have an association relationship. There is no direct link call relationship between two network devices that do not have an association relationship.

[0033] Third, for each network device in the above network device cluster, perform the following determination steps:

[0034] 1. In response to determining that the target network device has an association relationship with the network device, determine the corresponding association relationship identifier as an association matrix element. The association relationship identifier can represent the existence of an association relationship. The no-relationship identifier can represent the absence of an association relationship. For example, the association relationship identifier can be 1. The no-relationship identifier can be 0.

[0035] 2. In response to determining that the target network device has no association relationship with the network device, determine a corresponding no-relationship identifier as an element of an association matrix.

[0036] Fourth, the determined association matrix elements are combined into a matrix column vector corresponding to the target network device. For example, the matrix column vector of the target network device can be: .

[0037] The second step is to combine the matrix column vectors into a network device spatial association matrix corresponding to the above network device cluster. For example, the network device spatial association matrix can be: .

[0038] Step 103 : Generate network device spatial feature information of the network device cluster corresponding to each historical time node according to the network device spatial association matrix and the historical network data sequence set.

[0039] In some embodiments, the execution subject may generate network device spatial feature information corresponding to each historical time node of the network device cluster according to the network device spatial association matrix and the historical network data sequence set. The network device spatial feature information may include each network device spatial feature. The network device spatial feature may be a vector representing the spatial association of each network device in the network device cluster corresponding to the same historical time node.

[0040] In an actual application scenario, the execution subject can generate the network device spatial feature information corresponding to each historical time node of the network device cluster through the following steps:

[0041] In the first step, for each of the above historical time nodes, perform the following processing steps:

[0042] 1. Determine each historical network data corresponding to the above historical time node in the above historical network data series as network input data.

[0043] 2. Input the above network input data and the above network device spatial association matrix into the spatial feature vector extraction layer included in the pre-trained network vulnerability detection model to obtain the network device spatial feature vector of the above network device cluster corresponding to the above historical time node. Among them, the network vulnerability detection model can be a neural network model that takes the historical network data of each network device at each historical time node as input and the network device spatial association matrix as output, and the network device vulnerability detection information at the target time as output. The network vulnerability detection model may include a spatial feature vector extraction layer and a temporal feature vector extraction layer. The spatial feature vector extraction layer may include a diffusion convolutional network. The temporal feature vector extraction layer may include a gated loop unit. The diffusion convolutional network can be used to capture the spatial correlation of the network performance data of each network device at the call relationship level. The gated loop unit can be used to further capture the temporal correlation of the device performance data of each network device. The input of the gated loop unit may include the output of the diffusion convolutional network at the current moment and the output of the gated loop unit at the previous moment.

[0044] The diffusion convolution network uses the diffusion convolution in the image signal and filter The definition of can be:

[0045] .

[0046] .

[0047] in, and Can be filter parameters. It can be a graph convolution symbol. Can be an adjacency matrix The in-degree matrix of . It can be an adjacency matrix The out-degree matrix of . and It can be a diffusion migration matrix. Can be embedded for randomly initialized network devices, . The number of individual network devices that can be included in the network device cluster. , The feature dimension size that can be expressed for network devices is embedded. It can be a network device spatial association matrix. Can be a coefficient. It can be the input data of each network device corresponding to the same historical time node. It can represent the result of diffuse convolution.

[0048] In the second step, each network device spatial feature vector is determined as network device spatial feature information.

[0049] Furthermore, the network vulnerability detection model can be trained through the following steps:

[0050] The first step is to obtain a sample set of network operation data.

[0051] The second step is to determine the initial network vulnerability detection model, wherein the initial network vulnerability detection model includes: an initial spatial feature vector extraction layer and an initial temporal feature vector extraction layer.

[0052] The third step is to select a network operation data sample from the above network operation data sample set as the target network operation data sample.

[0053] The fourth step is to input the target network operation data sample into the initial spatial feature vector extraction layer to obtain the initial network device spatial feature vector.

[0054] The fifth step is to input the above-mentioned initial network device spatial feature vector into the above-mentioned initial time feature vector extraction layer to obtain the initial time network device feature vector.

[0055] Step 6: Determine the loss value between the initial time network device feature vector and the corresponding sample label. For example, the loss value between the initial time network device feature vector and the corresponding sample label can be determined by a preset loss function. The sample label can represent the real vulnerability detection information corresponding to the network device. The loss function can be a cross entropy loss function or a hinge loss function.

[0056] In the seventh step, in response to determining that the loss value is less than or equal to the preset loss value, the initial network vulnerability detection model is determined as the trained network vulnerability detection model.

[0057] Step 104 , based on the network device spatial feature information, a pre-trained network vulnerability detection model is used to generate network device vulnerability detection information of the network device cluster at a target time.

[0058] In some embodiments, the above-mentioned execution subject may generate the network device vulnerability detection information of the above-mentioned network device cluster at the target time corresponding to the above-mentioned network device cluster through a pre-trained network vulnerability detection model based on the above-mentioned network device spatial feature information. Among them, the network device vulnerability detection information may be a vector composed of the device performance data of each network device in the predicted network device cluster at the target time. The target time may be a future time or a specified time. For example, the target time may be the next time point of the current time. In practice, the above-mentioned execution subject may input the network device spatial feature information into a pre-trained network vulnerability detection model to generate the network device vulnerability detection information of the above-mentioned network device cluster at the target time corresponding to the above-mentioned network device cluster. The network vulnerability detection model may be a pre-trained neural network model that takes the network device spatial feature information as input and the device performance data at the target time as output. For example, the network vulnerability detection model may be an LSTM model.

[0059] For another example, the spatial feature information of network devices can be input into the network vulnerability detection model to obtain the network device vulnerability detection information of the above network device cluster at the target time. The network device vulnerability detection information can indicate the network devices with vulnerabilities in the network device cluster. Vulnerabilities can include but are not limited to: application vulnerabilities, network fluctuation vulnerabilities, communication protocol vulnerabilities, device software vulnerabilities, etc. The network vulnerability detection model can also be a trained PDR model, P2DR model, PDRR model, WPDRRC model, etc.

[0060] In an actual application scenario, the execution subject can generate the network device vulnerability detection information of the network device cluster corresponding to the target time through the following steps:

[0061] In the first step, the preset time feature is determined as a time-related feature vector. The preset time feature can be an empty vector. The dimension of the time feature can be the number of each network device included in the above network device cluster.

[0062] The second step is to determine the first historical time node among the above historical time nodes as the target historical time node.

[0063] In the third step, based on the target historical time nodes and time-related feature vectors, the following input steps are performed:

[0064] 1. Input the time-related feature vector and the network device spatial feature vector corresponding to the target historical time node in the above network device spatial feature information into the time feature vector extraction layer included in the above network vulnerability detection model to obtain the time network device feature vector. When the input step is executed for the first time, the time-related feature vector can be the above-mentioned preset time feature. When the input step is executed later, the time-related feature vector can be the time network device feature vector obtained by the last execution of the input step. The time network device feature vector can be the device operation data of each network device at the current moment detected by the time feature vector extraction layer.

[0065] 2. In response to determining that the target historical time node is the last historical time node among the above historical time nodes, determine the time network device feature vector as the network device vulnerability detection information at the corresponding target time.

[0066] In the fourth step, in response to determining that the target historical time node is not the last historical time node among the above historical time nodes, the time network device feature vector is determined as a new time-related feature vector, and a new target historical time node is selected from the remaining historical time nodes.

[0067] In the fifth step, based on the new time-related feature vector and the target historical time node, the above input step is performed again.

[0068] Step 105: Perform network detection on the network devices in the network device cluster according to the network device vulnerability detection information.

[0069] In some embodiments, the execution subject may perform network detection on the network devices in the network device cluster according to the network device vulnerability detection information. For example, when the network device vulnerability detection information indicates that there are network devices with vulnerabilities in the network device cluster, network detection may be performed on the network devices in the network device cluster through vulnerability scanning, traffic analysis, port scanning, operating system detection, and intrusion detection system. Vulnerability scanning: Use vulnerability scanning tools such as Nessus, OpenVAS, or Qualys to comprehensively check network and computer vulnerabilities. These tools can help discover and fix known security vulnerabilities, thereby reducing the risk of being attacked. Traffic analysis: Use network traffic analysis tools such as Wireshark or tcpdump to deeply analyze network data packets in order to promptly discover whether there is malicious traffic. Port scanning: Port scanning technology sends a detection data packet to the TCP / IP port of the target host and records the response of the target host to determine whether the port is open or closed and other status information. Common port scanning technologies include full connection scanning and half connection (SYN) scanning. Operating system detection: Detect the type and version of the operating system by analyzing the fingerprint information of the operating system. This can be achieved by sending specially constructed packets, such as operating system fingerprint detection technology based on the TCP / IP protocol stack and ICMP response analysis detection technology. Intrusion Detection System (IDS): Deploy IDS tools such as Snort or Suricata to monitor network traffic and events, and promptly detect and respond to potential attacks.

[0070] In an actual application scenario, the execution subject can perform network detection on the network devices in the network device cluster through the following steps:

[0071] In response to determining that the network device vulnerability detection information meets a preset vulnerability detection condition, the execution subject may perform the following network detection steps for each network device in the network device cluster:

[0072] The first step is to obtain the device operation data sequence of the above network devices within the target time period. The device operation data may include: historical user access information, historical traffic usage information, historical network status information, and each historical device page browsing behavior information. For example, the target time period refers to the current to the previous 72 hours.

[0073] The second step is to determine the causal coefficient information of each operation indicator that affects the abnormal operation of the network device based on the above-mentioned device operation data sequence and the pre-trained network anomaly causal detection model. Among them, the above-mentioned device operation data includes: feature data sequences under multiple indicator dimensions. The network anomaly causal detection model can be set according to actual needs, such as a linear causal model (Linear DML (Double Machine Learning)), a tree series causal model (Causal Forest DML), etc. The execution subject can determine the causal coefficient information of each operation indicator that affects the abnormal operation of the network device based on the above-mentioned device operation data sequence and the pre-trained network anomaly causal detection model. For example, the execution subject can input the device operation data sequence into the network anomaly causal detection model, analyze the device operation data sequence through the network anomaly causal detection model, and obtain the causal coefficient information of each operation indicator that affects the abnormal operation of the network device.

[0074] The third step is to select the causal coefficient information corresponding to the abnormal causal conditions from the causal coefficient information of each operating indicator. The abnormal causal conditions are factors that match the set time and the set feature dimension. The set time and the set dimension are usually the time and dimension of the equipment operation data feature to be detected.

[0075] The fourth step is to generate the network anomaly detection result output by the above-mentioned network anomaly causal detection model according to the above-mentioned causal coefficient information. For example, the various causal coefficient information can be input into the network device anomaly detection model included in the network anomaly causal detection model to obtain the network anomaly detection result. For another example, the network device anomaly detection model can include: a network device anomaly detection model, an anomaly-based detection model, a host-based intrusion detection model, a network-based intrusion detection model, and a hybrid intrusion detection model. The network anomaly detection result indicates whether the network device has an anomaly.

[0076] Furthermore, according to each network anomaly detection result, security maintenance processing is performed on each network device in the above network device cluster.

[0077] In some embodiments, the execution subject may perform security maintenance on each network device in the network device cluster according to each network anomaly detection result. For example, the device identification of the network device whose network anomaly detection result indicates an abnormality may be sent to the device maintenance terminal so that the technicians can perform security maintenance.

[0078] Therefore, the efficiency of network equipment detection is improved, and it is convenient to detect the network equipment, so that the network equipment can be repaired more easily and targetedly.

[0079] The present application also provides a computer device 200. Figure 2 As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0080] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0081] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0082] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0083] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned network vulnerability intelligent defense and detection method. That is, the memory 203 stores instructions for executing the aforementioned network vulnerability intelligent defense and detection method.

[0084] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0085] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned method of intelligent defense and detection of network vulnerabilities.

[0086] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned network vulnerability intelligent defense and detection method.

[0087] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0088] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A network vulnerability intelligent defense and detection method, comprising: Collecting a historical network data sequence corresponding to each network device in a network device cluster within a historical time period to obtain a historical network data sequence set, wherein the network device cluster corresponds to network call path information, and one historical network data corresponds to one historical time node; Generate a network device spatial association matrix corresponding to the network device cluster through the network call path information; Generate network device spatial feature information corresponding to each historical time node of the network device cluster according to the network device spatial association matrix and the historical network data sequence set; Generate network device vulnerability detection information of the network device cluster at a target time corresponding to the network device cluster through a pre-trained network vulnerability detection model according to the network device spatial feature information; Performing network detection on the network devices in the network device cluster according to the network device vulnerability detection information; The generating of network device spatial feature information of each historical time node of the network device cluster according to the network device spatial association matrix and the historical network data sequence set includes: For each of the historical time nodes, the following processing steps are performed: Determine each historical network data corresponding to the historical time node in the historical network data series set as network input data; Inputting the network input data and the network device spatial association matrix into a spatial feature vector extraction layer included in a pre-trained network vulnerability detection model to obtain a network device spatial feature vector of the network device cluster corresponding to the historical time node; Each network device spatial feature vector is determined as network device spatial feature information.

2. The network vulnerability intelligent defense and detection method according to claim 1 is characterized in that: The collecting of the historical network data sequence corresponding to each network device in the network device cluster within the historical time period includes: Obtaining an initial historical network data sequence corresponding to the network device within a historical time period; Performing data standardization processing on the initial historical network data sequence to obtain a standardized historical network data sequence; The standardized historical network data sequence is smoothed to obtain a standardized historical network data sequence after data smoothing as a historical network data sequence corresponding to the network device.

3. The network vulnerability intelligent defense and detection method according to claim 1 is characterized in that: Before generating the network device vulnerability detection information of the network device cluster corresponding to the target time by using a pre-trained network vulnerability detection model according to the network device spatial feature information, the method further includes: Obtain a sample set of network operation data; Determine an initial network vulnerability detection model, wherein the initial network vulnerability detection model includes: an initial spatial feature vector extraction layer and an initial temporal feature vector extraction layer; Selecting a network operation data sample from the network operation data sample set as a target network operation data sample; Inputting the target network operation data sample into the initial spatial feature vector extraction layer to obtain an initial network device spatial feature vector; Inputting the initial network device spatial feature vector into the initial time feature vector extraction layer to obtain an initial time network device feature vector; Determining a loss value between the initial time network device feature vector and the corresponding sample label; In response to determining that the loss value is less than or equal to a preset loss value, the initial network vulnerability detection model is determined as a trained network vulnerability detection model.

4. The network vulnerability intelligent defense and detection method according to claim 3 is characterized in that: The method further comprises: According to each network anomaly detection result, security maintenance processing is performed on each network device in the network device cluster.

5. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images