Method and device for constructing network attack trend prediction model

Abstract

The invention provides a network attack trend prediction model construction method and device. The method comprises the following steps: collecting network attack data from at least one data source, and preprocessing the network attack data; extracting at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to a network attack; an initial prediction model composed of an input layer, a bidirectional recurrent neural network layer, a full connection layer and an output layer is constructed, the attack trend prediction model is trained through the characteristic parameters, a network attack trend prediction model is obtained, and the bidirectional recurrent neural network layer comprises a forward recurrent neural network and a backward recurrent neural network. According to the technical scheme, the problems existing in an existing network attack trend prediction method can be solved, the prediction accuracy is improved, the calculation complexity is reduced, the generalization ability is enhanced, and timely and effective support is provided for network security protection.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method and device for constructing a network attack trend prediction model. Background Art

[0002] With the continuous development of network technology, cyberspace has become an important platform for information exchange and resource sharing. However, the openness and anonymity of cyberspace also bring many security risks, and cyber attacks occur frequently. Therefore, how to effectively predict the trend of cyber attacks and timely discover potential cyber attack risks is of great significance to improving network security protection capabilities.

[0003] Traditional network attack trend prediction methods are mainly based on statistics and simple machine learning algorithms. However, this method cannot fully capture time dependence and serial correlation, has high computational complexity and poor model generalization ability, and therefore has limitations when processing complex network attack data.

[0004] In summary, a method is needed to solve the problems existing in the existing network attack trend prediction methods, improve prediction accuracy, reduce computational complexity, enhance generalization capabilities, and provide timely and effective support for network security protection. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for constructing a network attack trend prediction model, which can improve prediction accuracy, reduce computational complexity, enhance generalization capability, and process complex network attack data.

[0006] According to one aspect of the present invention, a method for constructing a network attack trend prediction model is provided, comprising:

[0007] Collect network attack data from at least one data source and pre-process the network attack data;

[0008] Extracting at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack;

[0009] An initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer is constructed, and the attack trend prediction model is trained by the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

[0010] Optionally, collecting network attack data from at least one data source and preprocessing the network attack data includes:

[0011] Collect the network attack data from at least one of a network log, a security device, and a firewall, wherein the network attack data includes at least one attack type, different countries or regions, attack source IP, attack target IP, at least one time range, and attack danger level information;

[0012] The network attack data is cleaned to remove at least one of duplicate records, process missing values, and identify and remove outliers.

[0013] Optionally, extracting at least one characteristic parameter from the preprocessed network attack data includes:

[0014] Extracting characteristic parameters including attack frequency, attack intensity and attack duration from the network supply data through deep learning automatic feature extraction technology or feature engineering method;

[0015] Feature selection is performed through a statistical method, a model-based method, or an information gain-based method to screen the feature parameters used for training. The feature parameters include: time features, attack frequency features, calculating the number of attacks per unit time; attack type distribution features, statistically analyzing the proportion of different attack types within a period of time, and other related features.

[0016] Optionally, the method further includes:

[0017] Determining a numerical feature in the feature parameter;

[0018] The data of the numerical feature is scaled according to a preset ratio so that its value falls within a specific range.

[0019] Optionally, constructing an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer, and an output layer includes:

[0020] Embedding the normalized data into a high-dimensional vector at the input layer;

[0021] Using LSTM as the basic unit of the bidirectional recurrent neural network layer;

[0022] Determining model parameters, including the number of hidden layers, the number of neurons in the hidden layers, and a learning rate; initializing network parameters, including a weight matrix and a bias term;

[0023] At each time step, the forward recurrent neural network receives the input of the current time step and the hidden state of the previous time step, and calculates the forward hidden state; the backward recurrent neural network receives the input of the current time step and the hidden state of the next time step, and calculates the backward hidden state; the forward and backward hidden states are concatenated to obtain the complete hidden state of the current time step;

[0024] The output layer is set to receive the output of the fully connected layer and output the predicted value through a linear activation function;

[0025] Set the loss function and optimization algorithm.

[0026] Optionally, the training the attack trend prediction model by using the characteristic parameters includes:

[0027] Dividing the characteristic parameters into a training set, a validation set and a test set;

[0028] The model is trained using the training set, and the network parameters are updated through a back-propagation algorithm and a selected optimization algorithm.

[0029] After each iteration cycle, the model is evaluated using the validation set, and the loss value and performance index are recorded;

[0030] Adjust hyperparameters based on the performance metrics on the validation set or use early stopping to avoid overfitting.

[0031] Optionally, the method further includes:

[0032] Use the trained model to predict the test set and get the prediction results.

[0033] Use at least one metric among accuracy, recall, and F1 value to evaluate the prediction results and compare them with the benchmark model;

[0034] Further optimize or adjust the model based on the evaluation results.

[0035] According to another aspect of the present invention, there is provided a network attack trend prediction model construction device, comprising:

[0036] A data processing unit, configured to collect network attack data from at least one data source and pre-process the network attack data;

[0037] A parameter extraction unit, configured to extract at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack;

[0038] The parameter application unit is used to construct an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer, and train the attack trend prediction model through the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

[0039] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0040] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network attack trend prediction model construction method described in any embodiment of the present invention.

[0041] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack trend prediction model construction method described in any embodiment of the present invention when executed.

[0042] The embodiment of the present invention provides a method and device for constructing a network attack trend prediction model, including: collecting network attack data from at least one data source and preprocessing the network attack data; extracting at least one characteristic parameter from the preprocessed network attack data, the characteristic parameter characterizing the parameter corresponding to the attack trend related to the network attack; constructing an initial prediction model composed of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer, training the attack trend prediction model through the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network. The technical solution of the embodiment of the present invention provides a method for constructing a network attack trend prediction model based on a bidirectional long short-term memory recurrent neural network, which solves the problems existing in the existing network attack trend prediction methods, improves prediction accuracy, reduces computational complexity, enhances generalization ability, and provides timely and effective support for network security protection.

[0043] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 It is a flow chart of a method for constructing a network attack trend prediction model provided by one embodiment of the present invention;

[0046] Figure 2is a schematic diagram of an N-layer bidirectional recurrent neural network structure provided by an embodiment of the present invention;

[0047] Figure 3 It is a structural schematic diagram of a network attack trend prediction model building device provided by one embodiment of the present invention;

[0048] Figure 4 It is a structural schematic diagram of an electronic device for implementing the network attack trend prediction model building method of an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0050] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0051] In recent years, recurrent neural networks (RNNs) and their improved models have made significant progress in the field of time series forecasting. RNNs have the ability to process time series data, and their structure allows information to flow between time steps, so they are particularly suitable for processing data with time dependency and sequence correlation. Compared with traditional forecasting methods, RNNs have the following advantages:

[0052] Able to fully capture temporal dependency and serial correlation. The structure of RNN enables it to process sequence data of arbitrary length and use the output of the previous time step as the input of the next time step through a cyclic connection, thereby capturing the temporal dependency and serial correlation in the data.

[0053] High computational efficiency. RNN reduces the computational complexity of the model by sharing parameters, enabling it to process large-scale, high-dimensional data and meet the needs of real-time prediction.

[0054] The model has strong generalization ability. RNN has strong adaptability and can learn the dependencies between different time steps and adjust the parameters of the model according to new data to adapt to the ever-changing network attack environment.

[0055] In addition, recurrent neural networks (RNNs) and their improved models, such as long short-term memory recurrent neural networks (LSTMs) and bidirectional long short-term memory recurrent neural networks (BiLSTMs), have achieved remarkable results in the field of sequence data processing. In particular, BiLSTM can simultaneously consider the forward and backward information of the sequence, thereby more comprehensively capturing the dependencies in the sequence data. Applying BiLSTM to network attack trend prediction can significantly improve the accuracy and real-time performance of the prediction.

[0056] like Figure 1 As shown, an embodiment of the present invention provides a method for constructing a network attack trend prediction model, which may include the following steps:

[0057] S110: Collect network attack data from at least one data source and pre-process the network attack data.

[0058] In the embodiment of the present invention, step S110 specifically includes:

[0059] Collect the network attack data from at least one of a network log, a security device, and a firewall, wherein the network attack data includes at least one attack type, different countries or regions, attack source IP, attack target IP, at least one time range, and attack danger level information;

[0060] The network attack data is cleaned to remove at least one of duplicate records, process missing values, and identify and remove outliers.

[0061] Specifically, historical data related to network attacks is collected. Historical network attack data is collected from network logs, security devices, firewalls and other sources, including various attack types, attack data from various countries or regions, attack source IP, attack target IP, multiple time ranges, multiple attack risk levels, and other attack data. Attack types include denial of service attacks (DDoS), SQL injections, cross-site scripting attacks, phishing attacks, data tampering, ransomware encryption, data leakage, Trojan viruses, etc.; time ranges include within 1 day, within 3 days, within 7 days, within 30 days, etc.; attack risk levels include high risk, medium risk, and low risk. The collected data is classified and sorted for subsequent training of attack trend prediction models in different dimensions.

[0062] The collected data is cleaned and preprocessed: duplicate records are deleted, missing values ​​are processed (such as by interpolation or mean value filling), and outliers are identified and removed.

[0063] S120: Extract at least one characteristic parameter from the preprocessed network attack data, where the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack.

[0064] In the embodiment of the present invention, step S120 specifically includes:

[0065] Extracting characteristic parameters including attack frequency, attack intensity and attack duration from the network supply data through deep learning automatic feature extraction technology or feature engineering method;

[0066] Feature selection is performed through a statistical method, a model-based method, or an information gain-based method to screen the feature parameters used for training. The feature parameters include: time features, attack frequency features, calculating the number of attacks per unit time; attack type distribution features, statistically analyzing the proportion of different attack types within a period of time, and other related features.

[0067] Specifically, based on data preprocessing, features that can reflect attack trends are extracted from network attack data. These features may include attack frequency, attack intensity, attack duration, etc. At the same time, in order to fully consider the time dependency and sequence correlation of network attack data, it is also necessary to extract time series features that can reflect these characteristics. In the process of feature extraction, traditional feature engineering methods can be used, or automatic feature extraction technology in deep learning can be combined.

[0068] In terms of feature selection, features can be screened based on their importance and relevance to reduce the computational complexity of the model and improve prediction accuracy. Common feature selection methods include statistical-based methods, model-based methods, and information gain-based methods. For example: time features. Extract time features such as hours, dates, days of the week, months, and quarters; attack frequency features. Calculate the number of attacks per unit time (such as per hour, per day); attack type distribution features. Count the proportion of different attack types within a period of time; other related features. Such as the geographic location of the source IP and target IP, historical attack records, etc.

[0069] In an embodiment of the present invention, the method may further include the following steps:

[0070] Determining a numerical feature in the feature parameter;

[0071] The data of the numerical feature is scaled according to a preset ratio so that its value falls within a specific range.

[0072] Specifically, for numerical features, normalization is performed to make them fall within the same numerical range. Data normalization is to scale the data so that it falls into a small specific interval, such as [0,1] or [-1,1], to facilitate data analysis and training of machine learning models. The present invention uses linear normalization to map the data to the [0,1] interval.

[0073] S130, constructing an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer, and training the attack trend prediction model through the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

[0074] In an embodiment of the present invention, an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer, and an output layer is constructed, including:

[0075] Embedding the normalized data into a high-dimensional vector at the input layer;

[0076] Using LSTM as the basic unit of the bidirectional recurrent neural network layer;

[0077] Determining model parameters, including the number of hidden layers, the number of neurons in the hidden layers, and a learning rate; initializing network parameters, including a weight matrix and a bias term;

[0078] At each time step, the forward recurrent neural network receives the input of the current time step and the hidden state of the previous time step, and calculates the forward hidden state; the backward recurrent neural network receives the input of the current time step and the hidden state of the next time step, and calculates the backward hidden state; the forward and backward hidden states are concatenated to obtain the complete hidden state of the current time step;

[0079] The output layer is set to receive the output of the fully connected layer and output the predicted value through a linear activation function;

[0080] Set the loss function and optimization algorithm.

[0081] On the basis of data preprocessing, feature extraction, and data standardization, an attack trend prediction model based on a bidirectional recurrent neural network is constructed. The model consists of an input layer, a bidirectional recurrent neural network layer, a fully connected layer, and an output layer. The input layer is used to receive the extracted feature data; the bidirectional recurrent neural network layer is used to capture the time dependency and sequence correlation in the feature data; the fully connected layer is used to further process the output of the bidirectional recurrent neural network layer; and the output layer is used to output the final prediction result. When constructing the bidirectional recurrent neural network model, a multi-layer bidirectional recurrent neural network structure is used to improve the model's expressiveness and prediction accuracy. At the same time, in order to reduce the computational complexity of the model, some optimization strategies are adopted, such as batch training and parameter sharing. Figure 2 It is a schematic diagram of an N-layer bidirectional recurrent neural network structure provided by an embodiment of the present invention.

[0082] 1) Input layer:

[0083] The normalized data is embedded into a high-dimensional vector at the input layer.

[0084] 2) Bidirectional recurrent neural network layer:

[0085] Use LSTM (Long Short-Term Memory Network) as the basic unit of bidirectional RNN. Select appropriate model parameters, including the number of hidden layers, the number of hidden layer neurons, and the learning rate. The selection of these parameters will affect the training effect and prediction performance of the model. The number of hidden layer units of the forward RNN and the backward RNN is usually determined based on the data complexity and computing resources. Initialize the network parameters, including the weight matrix and the bias term, usually using a random initialization method.

[0086] 3) Hidden layer:

[0087] At each time step, the forward RNN receives the input of the current time step and the hidden state of the previous time step, and calculates the forward hidden state.

[0088] At the same time, the backward RNN receives the input of the current time step and the hidden state of the next time step, and calculates the backward hidden state.

[0089] Concatenate the forward and backward hidden states to get the complete hidden state for the current time step.

[0090] 4) Output layer:

[0091] Receive the output of the fully connected layer and output the predicted value through a linear activation function.

[0092] 5) Loss function:

[0093] Use mean squared error (MSE) or mean absolute error (MAE) as the loss function.

[0094] 6) Optimization algorithm:

[0095] Select the Adam adaptive learning rate optimization algorithm for training.

[0096] Set hyperparameters such as learning rate, batch size, number of iterations, etc., and adjust them through the validation set.

[0097] In an embodiment of the present invention, training the attack trend prediction model by using the characteristic parameters includes:

[0098] Dividing the characteristic parameters into a training set, a validation set and a test set;

[0099] The model is trained using the training set, and the network parameters are updated through a back-propagation algorithm and a selected optimization algorithm.

[0100] After each iteration cycle, the model is evaluated using the validation set, and the loss value and performance index are recorded;

[0101] Adjust hyperparameters based on the performance metrics on the validation set or use early stopping to avoid overfitting.

[0102] Specifically, model training includes the following steps:

[0103] The preprocessed data is divided into training set, validation set and test set.

[0104] The model is trained using the training set, and the network parameters are updated through the back-propagation algorithm and the selected optimization algorithm.

[0105] After each epoch, the model is evaluated using the validation set, and the loss value and performance indicators (such as accuracy, recall, F1 value, etc.) are recorded.

[0106] Adjust hyperparameters based on the performance metrics on the validation set or use early stopping to avoid overfitting.

[0107] In an embodiment of the present invention, the method may further include the following steps:

[0108] Use the trained model to predict the test set and get the prediction results.

[0109] Use at least one metric among accuracy, recall, and F1 value to evaluate the prediction results and compare them with the benchmark model;

[0110] Further optimize or adjust the model based on the evaluation results.

[0111] The trained model is used to predict the test set to obtain the prediction results. The prediction results are evaluated using indicators such as accuracy, recall, and F1 value, and compared with the benchmark model. The model is further optimized or adjusted based on the evaluation results.

[0112] After the model training is completed, the model can be used to predict future network attack trends. By inputting current network attack data, the model can output information such as the type and intensity of network attacks that may occur in the future. This information can provide strong support for network security protection, helping network administrators to promptly identify potential attack risks and take corresponding protective measures.

[0113] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0114] Improve prediction accuracy: Bidirectional recurrent neural networks can simultaneously utilize the previous and next information of the sequence to capture more comprehensive contextual features, thereby improving prediction accuracy.

[0115] Enhanced adaptability: The model is built based on deep learning technology, has strong adaptability and generalization capabilities, and can cope with complex and changing network attack environments.

[0116] Reduce computational complexity: Through reasonable network structure design and parameter optimization, the computational complexity of the model can be reduced and the prediction speed can be improved.

[0117] Easy to expand: The model has good scalability and can add new features or adjust the network structure according to actual needs to adapt to different application scenarios.

[0118] like Figure 3 As shown, an embodiment of the present invention provides a network attack trend prediction model construction device, which may include:

[0119] A data processing unit 310, configured to collect network attack data from at least one data source and pre-process the network attack data;

[0120] A parameter extraction unit 320, configured to extract at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack;

[0121] The parameter application unit 330 is used to construct an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer, and train the attack trend prediction model through the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

[0122] Optionally, the data processing unit 310 is specifically configured to execute:

[0123] Collect the network attack data from at least one of a network log, a security device, and a firewall, wherein the network attack data includes at least one attack type, different countries or regions, attack source IP, attack target IP, at least one time range, and attack danger level information;

[0124] The network attack data is cleaned to remove at least one of duplicate records, process missing values, and identify and remove outliers.

[0125] Optionally, the parameter extraction unit 320 is specifically configured to execute:

[0126] Extracting characteristic parameters including attack frequency, attack intensity and attack duration from the network supply data through deep learning automatic feature extraction technology or feature engineering method;

[0127] Feature selection is performed through a statistical method, a model-based method, or an information gain-based method to screen the feature parameters used for training. The feature parameters include: time features, attack frequency features, calculating the number of attacks per unit time; attack type distribution features, statistically analyzing the proportion of different attack types within a period of time, and other related features.

[0128] Optionally, the parameter extraction unit 320 is further configured to execute:

[0129] Determining a numerical feature in the feature parameter;

[0130] The data of the numerical feature is scaled according to a preset ratio so that its value falls within a specific range.

[0131] Optionally, the parameter application unit 330, when executing the construction of the initial prediction model consisting of the input layer, the bidirectional recurrent neural network layer, the fully connected layer and the output layer, specifically performs:

[0132] Embedding the normalized data into a high-dimensional vector at the input layer;

[0133] Using LSTM as the basic unit of the bidirectional recurrent neural network layer;

[0134] Determining model parameters, including the number of hidden layers, the number of neurons in the hidden layers, and a learning rate; initializing network parameters, including a weight matrix and a bias term;

[0135] At each time step, the forward recurrent neural network receives the input of the current time step and the hidden state of the previous time step, and calculates the forward hidden state; the backward recurrent neural network receives the input of the current time step and the hidden state of the next time step, and calculates the backward hidden state; the forward and backward hidden states are concatenated to obtain the complete hidden state of the current time step;

[0136] The output layer is set to receive the output of the fully connected layer and output the predicted value through a linear activation function;

[0137] Set the loss function and optimization algorithm.

[0138] Optionally, the parameter application unit 330, when training the attack trend prediction model using the characteristic parameters, specifically performs:

[0139] Dividing the characteristic parameters into a training set, a validation set and a test set;

[0140] The model is trained using the training set, and the network parameters are updated through a back-propagation algorithm and a selected optimization algorithm.

[0141] After each iteration cycle, the model is evaluated using the validation set, and the loss value and performance index are recorded;

[0142] Adjust hyperparameters based on the performance metrics on the validation set or use early stopping to avoid overfitting.

[0143] Optionally, the parameter application unit 330 is further configured to execute:

[0144] Use the trained model to predict the test set and get the prediction results.

[0145] Use at least one metric among accuracy, recall, and F1 value to evaluate the prediction results and compare them with the benchmark model;

[0146] Further optimize or adjust the model based on the evaluation results.

[0147] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the network attack trend prediction model construction device. In other embodiments of the present invention, the network attack trend prediction model construction device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0148] The information interaction, execution process and other contents between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0149] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0150] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0151] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0152] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a network attack trend prediction model construction method.

[0153] In some embodiments, the network attack trend prediction model construction method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network attack trend prediction model construction method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the network attack trend prediction model construction method in any other appropriate manner (for example, by means of firmware).

[0154] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0155] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0156] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0157] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0158] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0159] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0160] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0161] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for constructing a network attack trend prediction model, characterized in that: include: Collect network attack data from at least one data source and pre-process the network attack data; Extracting at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack; An initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer is constructed, and the attack trend prediction model is trained by the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

2. The method according to claim 1, characterized in that The collecting of network attack data from at least one data source and preprocessing of the network attack data includes: Collect the network attack data from at least one of a network log, a security device, and a firewall, wherein the network attack data includes at least one attack type, different countries or regions, attack source IP, attack target IP, at least one time range, and attack danger level information; The network attack data is cleaned to remove at least one of duplicate records, process missing values, and identify and remove outliers.

3. The method according to claim 1, characterized in that The extracting at least one characteristic parameter from the pre-processed network attack data includes: Extracting characteristic parameters including attack frequency, attack intensity and attack duration from the network supply data through deep learning automatic feature extraction technology or feature engineering method; Feature selection is performed through a statistical method, a model-based method, or an information gain-based method to screen the feature parameters used for training. The feature parameters include: time features, attack frequency features, calculating the number of attacks per unit time; attack type distribution features, statistically analyzing the proportion of different attack types within a period of time, and other related features.

4. The method according to claim 1, characterized in that: Further including: Determining a numerical feature in the feature parameter; The data of the numerical feature is scaled according to a preset ratio so that its value falls within a specific range.

5. The method according to claim 1, characterized in that The initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer is constructed, including: Embedding the normalized data into a high-dimensional vector at the input layer; Using LSTM as the basic unit of the bidirectional recurrent neural network layer; Determining model parameters, including the number of hidden layers, the number of neurons in the hidden layers, and a learning rate; initializing network parameters, including a weight matrix and a bias term; At each time step, the forward recurrent neural network receives the input of the current time step and the hidden state of the previous time step, and calculates the forward hidden state; the backward recurrent neural network receives the input of the current time step and the hidden state of the next time step, and calculates the backward hidden state; the forward and backward hidden states are concatenated to obtain the complete hidden state of the current time step; The output layer is set to receive the output of the fully connected layer and output the predicted value through a linear activation function; Set the loss function and optimization algorithm.

6. The method according to claim 1, characterized in that The training of the attack trend prediction model by using the characteristic parameters includes: Dividing the characteristic parameters into a training set, a validation set and a test set; The model is trained using the training set, and the network parameters are updated through a back-propagation algorithm and a selected optimization algorithm. After each iteration cycle, the model is evaluated using the validation set, and the loss value and performance index are recorded; Adjust hyperparameters based on the performance metrics on the validation set or use early stopping to avoid overfitting.

7. The method according to claim 1, characterized in that Further including: Use the trained model to predict the test set and get the prediction results. Use at least one metric among accuracy, recall, and F1 value to evaluate the prediction results and compare them with the benchmark model; Further optimize or adjust the model based on the evaluation results.

8. A network attack trend prediction model construction device, characterized in that: include: A data processing unit, configured to collect network attack data from at least one data source and pre-process the network attack data; A parameter extraction unit, configured to extract at least one characteristic parameter from the preprocessed network attack data, wherein the characteristic parameter represents a parameter corresponding to an attack trend related to the network attack; The parameter application unit is used to construct an initial prediction model consisting of an input layer, a bidirectional recurrent neural network layer, a fully connected layer and an output layer, and train the attack trend prediction model through the characteristic parameters to obtain a network attack trend prediction model, wherein the bidirectional recurrent neural network layer includes a forward recurrent neural network and a backward recurrent neural network.

9. An electronic device, characterized in that include: at least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network attack trend prediction model construction method described in any one of claims 1-7.

10. A computer readable medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network attack trend prediction model construction method described in any one of claims 1 to 7 when executed.

Images