Network attack detection method and system based on time sequence enhancement

Abstract

The invention provides a network attack detection method and system based on time sequence enhancement, and relates to the field of network security, and the method comprises the steps: obtaining a network flow data flow, carrying out the time sequence feature extraction of the network flow data flow, and obtaining a feature vector set; calculating to obtain Manhattan distances among the feature vectors, and constructing a distance matrix through the Manhattan distances; clustering the feature vector set through the distance matrix to obtain a plurality of clusters; calculating to obtain an outlier score of each feature vector in each cluster; and carrying out network attack detection through each outlier score to obtain a detection result. According to the method, monitoring and early warning can be carried out on complex cross-time and cross-space attacks in real time, the network attack detection efficiency is remarkably improved, and the situations of false alarm and missing alarm are reduced. And meanwhile, deep analysis can be carried out according to the multi-dimensional time sequence features, so that the recognition capability of the detection system on unknown attacks and variant attacks is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network attack detection method and system based on time series enhancement. Background Art

[0002] In recent years, with the continuous escalation of cyber attack methods, network security issues have become increasingly complex and severe. Cyber ​​attacks are usually highly time-dependent and dynamic, which makes it difficult for traditional detection methods based on static features to accurately identify complex attack behaviors. Especially in large-scale, high-frequency attack environments, existing detection methods have significant limitations in response speed, detection accuracy, and resource consumption.

[0003] Starting from the time series characteristics of network traffic, analyzing the dynamic patterns of attack behaviors has become an important means to improve detection accuracy. Some existing methods, such as rule matching and signature recognition, are effective in detecting known attacks, but they perform poorly when facing new and variant attacks. In addition, these methods are sensitive to noise in traffic and are prone to false positives or false negatives, and cannot effectively cope with the current complex and changing network attack situation.

[0004] At present, the main methods used to measure time series characteristics include dynamic time warping (DTW), Fourier transform and wavelet analysis. These methods can capture some dynamic information in time series, but they are inefficient and difficult to meet real-time detection requirements when dealing with high-dimensional and large-scale network traffic. In particular, for attacks across time and space, existing time series analysis methods still have deficiencies in noise suppression and anomaly detection. In addition, existing network attack detection methods have technical problems such as low detection accuracy, noise sensitivity and inability to effectively respond to new attacks when dealing with large-scale and highly complex network traffic. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a network attack detection method and system based on time series enhancement, which aims to solve the technical problems of low detection accuracy, noise sensitivity and inability to effectively respond to new attacks in existing network attack detection methods when processing large-scale and high-complexity network traffic.

[0006] The present invention provides a network attack detection method based on time series enhancement, comprising the following steps:

[0007] S1: Obtain network traffic data stream, extract time series features from the network traffic data stream, and obtain a feature vector set;

[0008] S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix through the Manhattan distance;

[0009] S3: Cluster the feature vector set through the distance matrix to obtain multiple clusters;

[0010] S4: Calculate the outlier score of each feature vector in each cluster;

[0011] S5: Perform network attack detection based on the outlier scores to obtain detection results.

[0012] Preferably, step S1 specifically comprises:

[0013] S11: sort the captured network traffic data stream according to the time step to form a time series data set X;

[0014] S12: Calculate the autocorrelation coefficient between the time series data x and other time series data, and construct the characteristic vector F of the time series data x through all the autocorrelation coefficients of the time series data x. x ;

[0015] S13: Repeat step S12 until the feature vectors of all time series data are obtained to form a feature vector set.

[0016] Preferred:

[0017] The formula for calculating the autocorrelation coefficient is:

[0018]

[0019] Among them, r xy is the autocorrelation coefficient between time series data x and time series data y; i is the number of the time step; n is the maximum value of the time step; x i is the value of the time series data x at time step i; y i is the value of the time series data y at time step i; is the average value of the time series data x; is the average value of the time series data y;

[0020] Eigenvector F x The expression is:

[0021] F x =[r x1 , r x2 , ..., r xn ]

[0022] Among them, r xn is the autocorrelation coefficient between time series data x and time series data n.

[0023] Preferably, step S2 specifically comprises:

[0024] S21: Get feature vector F from feature vector setx and the eigenvector F y , calculate and obtain F x and F y The Manhattan distance d xy , d xy As a matrix element in the distance matrix;

[0025] S22: Repeat step S21 until all matrix elements are calculated and the distance matrix D is constructed.

[0026] Preferably, step S3 specifically comprises:

[0027] S31: taking each feature vector in the feature vector set as a sample point;

[0028] S32: Get feature vector F based on distance matrix x The point set N within the neighborhood range ∈ ∈ (x), N ∈ The expression of (x) is:

[0029] N ∈ (x) = {y∈X|d xy ≤∈}

[0030] Among them, d xy is the eigenvector F x and the eigenvector F y The Manhattan distance between

[0031] If the point set N ∈ If the number of sample points in (x) is greater than or equal to the minimum number of points MinPts, then the feature vector F x Mark as core point;

[0032] S33: Repeat step S32 until all core points are obtained;

[0033] S34: If the core point F u If there are other core points in the neighborhood of F, all sample points in the neighborhood of other core points will be included in the core point F. u The corresponding cluster;

[0034] S35: Repeat step S34 until the number of sample points in each cluster no longer changes, and obtain multiple clusters.

[0035] Preferably, step S4 is specifically:

[0036] S41: Calculate the density of each cluster, the calculation formula is:

[0037]

[0038] Among them, j is the number of the cluster, ρ j is the density of cluster j, m j is the number of sample points in cluster j, and M is the total number of sample points;

[0039] S42: Obtain the outlier score of each eigenvector by density calculation, and the calculation formula is:

[0040]

[0041] Among them, O x is the eigenvector F x The outlier score, ρ x is the eigenvector F x The density of the cluster, ρ k is the density of the kth cluster, and k is the total number of clusters.

[0042] A network attack detection system based on time series enhancement, used to implement the network attack detection method based on time series enhancement, comprising: a network attack detection system, a database system and an interactive system;

[0043] The network attack detection system is used to obtain detection results through network traffic data flow calculation;

[0044] The database system is used to save, upload and download various data;

[0045] The interactive system is used to provide visualization of the detection results.

[0046] A network attack detection device based on time series enhancement includes: a processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement the network attack detection method based on time series enhancement.

[0047] The present invention has the following beneficial effects:

[0048] First, through time series feature extraction and autocorrelation analysis, the time dependency and dynamic changes in the network traffic data flow are captured to ensure higher detection accuracy. Then, the feature vector set is clustered through the distance matrix to identify abnormal traffic and quantify the severity of the attack based on the clustering results. Finally, network attack detection is performed by calculating the outlier score of each feature vector in each cluster. The present invention can monitor and warn complex cross-time and cross-space attacks in real time, significantly improve the efficiency of network attack detection, and reduce false positives and false negatives. At the same time, it can perform in-depth analysis based on multidimensional time series features, thereby improving the detection system's ability to identify unknown attacks and variant attacks. It can perform real-time detection and intelligent analysis of network traffic, improving the robustness and detection accuracy of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flow chart of a method according to an embodiment of the present invention;

[0050] Figure 2 Detailed flow chart of each step of the present invention;

[0051] Figure 3 This is a layout framework diagram of a network attack detection system based on time series enhancement;

[0052] Figure 4 This is an example of the main login for a network attack detection system based on time series enhancement;

[0053] Figure 5 This is an example of a visualization interface for a network attack detection system based on time series enhancement;

[0054] Figure 6 This is a structural diagram of the device according to an embodiment of the present invention;

[0055] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0056] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0057] Reference Figure 1-2 The present invention provides a network attack detection method based on time series enhancement, comprising the following steps:

[0058] S1: Obtain network traffic data stream, extract time series features from the network traffic data stream, and obtain a feature vector set;

[0059] Furthermore, step S1 is specifically as follows:

[0060] S11: sort the captured network traffic data stream according to the time step to form a time series data set X;

[0061] Specifically, the original time series data is normalized; noise, duplication or invalid data in the data is removed through filters;

[0062] S12: Calculate the autocorrelation coefficient between the time series data x and other time series data, and construct the characteristic vector F of the time series data x through all the autocorrelation coefficients of the time series data x. x ;

[0063] Furthermore, for each time series, the autocorrelation coefficients at different time lags are calculated and a feature vector is generated to capture the dependencies between time points in the series;

[0064] The formula for calculating the autocorrelation coefficient is:

[0065]

[0066] Among them, r xy is the autocorrelation coefficient between time series data x and time series data y; i is the number of the time step; n is the maximum value of the time step; x i is the value of the time series data x at time step i; y i is the value of the time series data y at time step i; is the average value of the time series data x; is the average value of the time series data y;

[0067] Eigenvector F x The expression is:

[0068] F x =[r x1 , r x2 , ..., r xn ]

[0069] Among them, r xn is the autocorrelation coefficient between time series data x and time series data n.

[0070] S13: Repeat step S12 until the feature vectors of all time series data are obtained to form a feature vector set.

[0071] Specifically, all generated feature vectors are stored in the time series database TimescaleDB for distance matrix calculation and anomaly detection in subsequent steps.

[0072] S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix through the Manhattan distance;

[0073] Furthermore, step S2 is specifically as follows:

[0074] S21: Get feature vector F from feature vector set x and the eigenvector F y , calculate and obtain F x and F y The Manhattan distance d xy , d xy As a matrix element in the distance matrix;

[0075] Specifically, the Manhattan distance d xy The calculation formula is:

[0076]

[0077] where F xi and F yi The eigenvectors F x and F y The autocorrelation eigenvalue in the i-th dimension, n is the dimension of the eigenvector. By calculating the Manhattan distance between all sample pairs, the distance matrix D is generated. The matrix element D xy Denotes the eigenvector F x and F y The distance between

[0078] S22: Repeat step S21 until all matrix elements are calculated and the distance matrix D is constructed.

[0079] S3: Cluster the feature vector set through the distance matrix to obtain multiple clusters;

[0080] Furthermore, step S3 is specifically as follows:

[0081] S31: taking each feature vector in the feature vector set as a sample point;

[0082] S32: Get feature vector F based on distance matrix x The point set N within the neighborhood range ∈ ∈ (x), N ∈ The expression of (x) is:

[0083] N ∈ (x) = {y∈X|d xy ≤∈}

[0084] Among them, d xy is the eigenvector F x and the eigenvector F y The Manhattan distance between

[0085] If the point set N ∈ If the number of sample points in (x) is greater than or equal to the minimum number of points MinPts, then the feature vector F x Mark as core point;

[0086] S33: Repeat step S32 until all core points are obtained;

[0087] S34: If the core point F u If there are other core points in the neighborhood of F, all sample points in the neighborhood of other core points will be included in the core point F. u The corresponding cluster;

[0088] Specifically, for points that do not belong to the neighborhood of any core point, they are marked as noise points;

[0089] S35: Repeat step S34 until the number of sample points in each cluster no longer changes, and obtain multiple clusters.

[0090] S4: Calculate the outlier score of each feature vector in each cluster;

[0091] Furthermore, the outlier score is used to determine which feature vectors deviate from the normal clustering structure and identify abnormal behaviors;

[0092] Step S4 is specifically as follows:

[0093] S41: Calculate the density of each cluster, the calculation formula is:

[0094]

[0095] Among them, j is the number of the cluster, ρ j is the density of cluster j, m j is the number of sample points in cluster j, and M is the total number of sample points;

[0096] S42: Obtain the outlier score of each eigenvector by density calculation, and the calculation formula is:

[0097]

[0098] Among them, O x is the eigenvector F x The outlier score, ρ x is the eigenvector F x The density of the cluster, ρ k is the density of the kth cluster, and k is the total number of clusters.

[0099] S5: Perform network attack detection based on the outlier scores to obtain detection results.

[0100] Specifically, the outlier score is compared with the preset threshold to determine the type and severity of the network attack; based on the detection results, an attack report is generated and notified to the security administrator through the interactive system;

[0101] Step S5 includes:

[0102] S51: For each outlier, according to its outlier score and the preset threshold O threshold Compare and determine whether it is abnormal traffic: If O x ≥O threshold , then the network traffic corresponding to the feature vector is marked as abnormal; if O x <O threshold , then the feature vector is considered to be normal traffic;

[0103] S52: Attack type identification; based on the feature vector F of abnormal traffic x Match with known attack signature database;

[0104] The known attack feature library includes: DDoS attack (traffic surge, abnormal request frequency), intrusion detection (abnormal traffic pattern, illegal access attempt) and data leakage (abnormal sensitive data transmission);

[0105] S53: Severity assessment: Evaluate the severity of network attacks based on the size of the outlier score and the characteristics of the attack type.

[0106] The severity levels include: Mild (outlier score 0 x Low (indicates that the traffic deviates from the normal pattern but does not pose a serious threat), medium (outlier score O x In the medium range, indicating a potential threat that requires further monitoring); severe (outlier score O x A high value indicates that the traffic may be an obvious attack behavior and immediate measures must be taken);

[0107] S54: Summarize the detection results, including the characteristics of abnormal traffic, the identified attack type and severity, generate an attack detection report and send it to the network administrator.

[0108] To further verify the effectiveness of the embodiments of the present invention, the following experiments were conducted: Public network attack intrusion detection system datasets were selected, including ISCX-URL (2016), CIC-EVSE (2024) and CIC-Modbus (2023). Table 1 lists the attack sample information of each dataset in detail.

[0109] In order to objectively evaluate the detection effect of the present invention, the experiment introduced a variety of mainstream models, and compared their detection accuracy (Accuracy), recall rate (Recall) and F1 score (F1-score) on three data sets: ISCX-URL, CIC-EVSE and CIC-Modbus. Table 2 summarizes the experimental results of each model. The experimental results show that the model of the present invention performs well on all data sets, especially on the ISCX-URL data set, achieving the highest F1 score of 99.2%, demonstrating excellent attack detection capabilities. In the CIC-EVSE data set, the recall rate (83.2%) and F1 score (79.2%) of the model of the present invention ranked second, showing good balance and robustness. In the CIC-Modbus data set, the model of the present invention ranks among the top with an accuracy rate of 79.7%, showing extremely high detection accuracy and reliability.

[0110] Table 1 Details of attack samples of the dataset used in the experiment

[0111]

[0112]

[0113] Table 2 Comparison of detection performance of different algorithm models on three public datasets

[0114]

[0115]

[0116] refer to Figure 3 , Figure 3 The present invention is a layout framework diagram of a network attack detection system based on time series enhancement, and the system includes: a network attack detection system, a database system and an interactive system. The network attack detection system is responsible for extracting data from network traffic, performing feature extraction and cluster analysis, and finally obtaining detection results, and generating network traffic events through the detection results. These events are classified as normal traffic or abnormal traffic, and are marked according to the attack timestamp and event type; the database system includes a local database and cloud backup, and supports database synchronization and update operations. Database data can be uploaded and downloaded through the cloud to ensure data integrity and availability; the interactive system provides a visualization platform for network attack detection, presents the detected data in a visual form, and generates a network attack detection report.

[0117] refer to Figure 4 , Figure 4 This is an example diagram of the main login of the interactive system in the embodiment of the present application. Specifically, in the login interface, the user needs to enter the corresponding user name and password in the "User Name" input box and the "Password" input box in sequence. After the input is completed, click the "Login" button below to submit the information, and the system will verify the user's identity. If the verification is passed and the user is a legitimate user, the system will enter the main interface, allowing the user to access the main functions and interfaces of the system.

[0118] refer to Figure 5 , Figure 5This is an example diagram of the visualization interface of the network attack detection system based on time series enhancement in the embodiment of the present application. The visualization interface allows administrators to view the detected abnormal traffic information, attack type and severity, and supports the query and analysis of historical data. Specifically, the top of the interface shows the total number of network traffic acquired by the system in real time (81483) and the number of detected attack identifications (643). The pie chart on the left side of the interface shows the severity of the current network attack event by color distinction, which is divided into three categories: mild, medium and severe. The bar chart at the bottom of the interface shows the alarm distribution of different types of attacks on the day, including "URLs attack", "port scanning", "brute force guessing" and "illegal mining", etc. This information helps administrators understand the types and frequencies of attacks on the day. In addition, the donut chart shows the proportion of suspicious traffic in abnormal traffic (26%), and the list of key events on the right records the detailed information of typical high-risk network attack events in detail, including attack time, attack method, severity and risk introduction of attack behavior. Another part of the interface shows the key parameters of the detection model. Finally, the system also displays the current status of the known attack signature library, including 75,423 samples and 39 new samples uploaded in the last 24 hours, to ensure that the system has the ability to continuously update and learn. At the same time, the bar chart shows the detection time consumption of each epoch.

[0119] The database system is used to store and manage the original traffic data, cluster analysis results and generation in the process of network attack detection, including information such as IP, Port and Stage.

[0120] See also Figure 6 , Figure 6 4 is a schematic diagram of the working of the hardware device of an embodiment of the present invention, wherein the hardware device specifically comprises: a network attack detection device 401 based on time series enhancement, a processor 402 and a storage medium 403.

[0121] A network attack detection device 401 based on time series enhancement: The network attack detection device 401 based on time series enhancement implements the network attack detection method based on time series enhancement.

[0122] Processor 402: The processor 402 loads and executes the instructions and data in the storage medium 403 to implement the network attack detection method based on time series enhancement.

[0123] Storage medium 403: The storage medium 403 stores instructions and data; the storage medium 403 is used to implement the network attack detection method based on time series enhancement.

[0124] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0125] The serial numbers of the embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. In a unit claim that lists several means, several of these means may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order and these words may be interpreted as identifiers.

[0126] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A network attack detection method based on time series enhancement, characterized in that: The following steps are involved: S1: Obtain network traffic data stream, extract time series features from the network traffic data stream, and obtain a feature vector set; S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix through the Manhattan distance; S3: Cluster the feature vector set through the distance matrix to obtain multiple clusters; S4: Calculate the outlier score of each feature vector in each cluster; S5: Perform network attack detection based on the outlier scores to obtain detection results.

2. The network attack detection method based on time series enhancement according to claim 1 is characterized in that: Step S1 is specifically as follows: S11: sort the captured network traffic data stream according to the time step to form a time series data set X; S12: Calculate the autocorrelation coefficient between the time series data x and other time series data, and construct the characteristic vector F of the time series data x through all the autocorrelation coefficients of the time series data x. x ; S13: Repeat step S12 until the feature vectors of all time series data are obtained to form a feature vector set.

3. The network attack detection method based on time series enhancement according to claim 2 is characterized in that: The formula for calculating the autocorrelation coefficient is: Among them, r xy is the autocorrelation coefficient between time series data x and time series data y; i is the number of the time step; n is the maximum value of the time step; x i is the value of the time series data x at time step i; y i is the value of the time series data y at time step i; is the average value of the time series data x; is the average value of the time series data y; Eigenvector F x The expression is: F x ＝[r x1 ,r x2 ,…,r xn ] Among them, r xn is the autocorrelation coefficient between time series data x and time series data n.

4. The network attack detection method based on time series enhancement according to claim 1 is characterized in that: Step S2 is specifically as follows: S21: Get feature vector F from feature vector set x and the eigenvector F y , calculate and obtain F x and F y The Manhattan distance d xy , d xy As a matrix element in the distance matrix; S22: Repeat step S21 until all matrix elements are calculated and the distance matrix D is constructed.

5. The network attack detection method based on time series enhancement according to claim 3 is characterized in that: Step S3 is specifically as follows: S31: taking each feature vector in the feature vector set as a sample point; S32: Get feature vector F based on distance matrix x The point set N within the neighborhood range ∈ ∈ (x), N ∈ The expression of (x) is: N ∈ (x)={y∈X|d xy ≤∈} Among them, d xy is the eigenvector F x and the eigenvector F y The Manhattan distance between If the point set N ∈ If the number of sample points in (x) is greater than or equal to the minimum number of points MinPts, then the feature vector F x Mark as core point; S33: Repeat step S32 until all core points are obtained; S34: If the core point F u If there are other core points in the neighborhood of , all sample points in the neighborhood of other core points are included in the core point F. u The corresponding cluster; S35: Repeat step S34 until the number of sample points in each cluster no longer changes, and obtain multiple clusters.

6. The network attack detection method based on time series enhancement according to claim 1 is characterized in that: Step S4 is specifically as follows: S41: Calculate the density of each cluster, the calculation formula is: Among them, j is the number of the cluster, ρ j is the density of cluster j, m j is the number of sample points in cluster j, and M is the total number of sample points; S42: Obtain the outlier score of each eigenvector by density calculation, and the calculation formula is: Among them, O x is the eigenvector F x The outlier score, ρ x is the eigenvector F x The density of the cluster, ρ k is the density of the kth cluster, and k is the total number of clusters.

7. A network attack detection system based on time series enhancement, used to implement the network attack detection method based on time series enhancement according to any one of claims 1 to 6, characterized in that: include: Network attack detection systems, database systems and interactive systems; The network attack detection system is used to obtain detection results through network traffic data flow calculation; The database system is used to save, upload and download various data; The interactive system is used to provide visualization of the detection results.

8. A network attack detection device based on time series enhancement, characterized in that: include: Processor and storage medium; the processor loads and executes instructions and data in the storage medium to implement the network attack detection method based on time series enhancement as described in any one of claims 1 to 6.

Images