A network attack detection method and system based on time series enhancement

Abstract

This invention provides a network attack detection method and system based on time series enhancement, relating to the field of network security. The method includes: acquiring network traffic data streams; extracting time series features from the network traffic data streams to obtain a set of feature vectors; calculating the Manhattan distance between each feature vector and constructing a distance matrix using the Manhattan distance; clustering the feature vector set using the distance matrix to obtain multiple clusters; calculating the outlier score of each feature vector in each cluster; and performing network attack detection using the outlier scores to obtain detection results. This invention can monitor and provide early warning for complex cross-time and cross-space attacks in real time, significantly improving the efficiency of network attack detection and reducing false positives and false negatives. Simultaneously, it can perform in-depth analysis based on multi-dimensional time series features, thereby improving the detection system's ability to identify unknown and variant attacks.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a network attack detection method and system based on time series enhancement. Background Technology

[0002] In recent years, with the continuous upgrading of cyberattack methods, cybersecurity issues have become increasingly complex and severe. Cyberattacks are typically highly time-dependent and dynamic, making it difficult for traditional detection methods based on static features to accurately identify complex attack behaviors. Especially in large-scale, high-frequency attack environments, existing detection methods have significant limitations in terms of response speed, detection accuracy, and resource consumption.

[0003] Analyzing the dynamic patterns of attack behavior based on the time-series characteristics of network traffic has become an important means to improve detection accuracy. Existing methods, such as rule matching and signature recognition, while effective in detecting known attacks, perform poorly against new and variant attacks. Furthermore, these methods are sensitive to noise in the traffic, easily leading to false positives or false negatives, and are unable to effectively cope with the current complex and ever-changing network attack landscape.

[0004] Currently, methods for measuring time series characteristics mainly include Dynamic Time Warping (DTW), Fourier Transform, and Wavelet Analysis. These methods can capture some dynamic information in time series, but they are inefficient and struggle to meet real-time detection requirements when dealing with high-dimensional, large-scale network traffic. In particular, existing time series analysis methods still fall short in noise suppression and anomaly detection for attacks spanning both time and space. Furthermore, existing network attack detection methods suffer from low detection accuracy, noise sensitivity, and an inability to effectively address novel attacks when handling large-scale, highly complex network traffic. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a network attack detection method and system based on time series enhancement, in order to solve the technical problems of low detection accuracy, noise sensitivity, and inability to effectively deal with new types of attacks in existing network attack detection methods when dealing with large-scale, highly complex network traffic.

[0006] This invention provides a network attack detection method based on time series enhancement, comprising the following steps:

[0007] S1: Obtain network traffic data stream, perform time series feature extraction on the network traffic data stream, and obtain a set of feature vectors;

[0008] S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix using the Manhattan distance;

[0009] S3: Cluster the feature vector set using the distance matrix to obtain multiple clusters;

[0010] S4: Calculate the outlier score of each feature vector in each cluster;

[0011] S5: Detect network attacks by using the scores of each outlier point to obtain the detection results.

[0012] Preferably, step S1 specifically includes:

[0013] S11: Sort the captured network traffic data stream according to time steps to form a time series data set X;

[0014] S12: Calculate the autocorrelation coefficients between time series data x and other time series data, and construct the feature vector F of time series data x using all the autocorrelation coefficients of time series data x. x ;

[0015] S13: Repeat step S12 until the feature vectors of all time series data are obtained, forming a feature vector set.

[0016] Preferred:

[0017] The formula for calculating the autocorrelation coefficient is:

[0018]

[0019] Where, r xy represents the autocorrelation coefficient between time series data x and time series data y; i is the time step number; n is the maximum value of the time step; x i Let y be the value of the time series data x at time step i; i Let y be the value of the time series data at time step i; x represents the average value of the time series data. y is the average value of the time series data;

[0020] eigenvector F x The expression is:

[0021] F x =[r x1 r x2 ,...,r xn ]

[0022] Where, r xn is the autocorrelation coefficient between time series data x and time series data n.

[0023] Preferably, step S2 specifically includes:

[0024] S21: Obtain the feature vector F from the feature vector set.x and eigenvector F y Calculate F x and F y Manhattan distance d between xy , will d xy As a matrix element in the distance matrix;

[0025] S22: Repeat step S21 until all matrix elements are calculated and the distance matrix D is constructed.

[0026] Preferably, step S3 specifically includes:

[0027] S31: Use each feature vector in the feature vector set as a sample point;

[0028] S32: Obtaining the feature vector F based on the distance matrix x The set of points N within the neighborhood range ∈ ∈ (x), N ∈ The expression for (x) is:

[0029] N ∈ (x)={y∈X|d xy ≤∈}

[0030] Where, d xy For the eigenvector F x and eigenvector F y Manhattan distance between them;

[0031] If the point set N ∈ If the number of sample points in (x) is greater than or equal to the minimum number of points MinPts, then the feature vector F x Mark as core point;

[0032] S33: Repeat step S32 until all core points are obtained;

[0033] S34: If the core point F u If other core points exist within the neighborhood of a given core point, then all sample points within the neighborhood of those other core points are included in the core point F. u Within the corresponding cluster;

[0034] S35: Repeat step S34 until the number of sample points in each cluster no longer changes, thus obtaining multiple clusters.

[0035] Preferably, step S4 specifically includes:

[0036] S41: Calculate the density of each cluster using the following formula:

[0037]

[0038] Where j is the cluster number, ρ j Let m be the density of cluster j. j Let M be the number of sample points in cluster j, and M be the total number of sample points.

[0039] S42: The outlier score of each eigenvector is obtained through density calculation. The calculation formula is as follows:

[0040]

[0041] Among them, O x For the eigenvector F x outlier fraction, ρ x For the eigenvector F x The density of the cluster, ρ k Let be the density of the k-th cluster, and k be the total number of clusters.

[0042] A network attack detection system based on time series enhancement, used to implement the network attack detection method based on time series enhancement, includes: a network attack detection system, a database system, and an interactive system;

[0043] Network attack detection systems are used to obtain detection results by calculating network traffic data streams;

[0044] Database systems are used for saving, uploading, and downloading various types of data;

[0045] Interactive systems are used to provide visualization of detection results.

[0046] A network attack detection device based on time series enhancement includes: a processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement the network attack detection method based on time series enhancement.

[0047] The present invention has the following beneficial effects:

[0048] First, by extracting time-series features and performing autocorrelation analysis, the temporal dependencies and dynamic changes in network traffic data streams are captured, ensuring higher detection accuracy. Then, the feature vector set is clustered using a distance matrix to identify abnormal traffic and quantify the severity of attacks based on the clustering results. Finally, network attack detection is performed by calculating the outlier scores of each feature vector in each cluster. This invention can monitor and provide early warnings for complex cross-time and cross-space attacks in real time, significantly improving the efficiency of network attack detection and reducing false positives and false negatives. Simultaneously, it can perform in-depth analysis based on multi-dimensional time-series features, thereby improving the detection system's ability to identify unknown and variant attacks. It enables real-time detection and intelligent analysis of network traffic, enhancing the robustness and detection accuracy of network security protection. Attached Figure Description

[0049] Figure 1 This is a flowchart of a method according to an embodiment of the present invention;

[0050] Figure 2 This is a detailed flowchart of each step in the present invention;

[0051] Figure 3 This is a layout framework diagram of a time-series-enhanced network attack detection system.

[0052] Figure 4 This is a primary login example for a time-series-enhanced network attack detection system.

[0053] Figure 5 Here is a visual interface example of a time-series-enhanced network attack detection system;

[0054] Figure 6 This is a structural diagram of the device according to an embodiment of the present invention;

[0055] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0056] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0057] Reference Figure 1-2 This invention provides a network attack detection method based on time series enhancement, comprising the following steps:

[0058] S1: Obtain network traffic data stream, perform time series feature extraction on the network traffic data stream, and obtain a set of feature vectors;

[0059] Furthermore, step S1 specifically includes:

[0060] S11: Sort the captured network traffic data stream according to time steps to form a time series data set X;

[0061] Specifically, the original time series data is normalized; noise, duplicates, or invalid data are removed through filters.

[0062] S12: Calculate the autocorrelation coefficients between time series data x and other time series data, and construct the feature vector F of time series data x using all the autocorrelation coefficients of time series data x. x ;

[0063] Furthermore, for each time series, the autocorrelation coefficients with different time lags are calculated and a feature vector is generated to capture the dependencies between time points in the series.

[0064] The formula for calculating the autocorrelation coefficient is:

[0065]

[0066] Where, r xy represents the autocorrelation coefficient between time series data x and time series data y; i is the time step number; n is the maximum value of the time step; x i Let y be the value of the time series data x at time step i; i Let y be the value of the time series data at time step i; x represents the average value of the time series data. y is the average value of the time series data;

[0067] eigenvector F x The expression is:

[0068] F x =[r x1 r x2 ,...,r xn ]

[0069] Where, r xn is the autocorrelation coefficient between time series data x and time series data n.

[0070] S13: Repeat step S12 until the feature vectors of all time series data are obtained, forming a feature vector set.

[0071] Specifically, all generated feature vectors are stored in the time-series database TimescaleDB for distance matrix calculation and anomaly detection in subsequent steps.

[0072] S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix using the Manhattan distance;

[0073] Furthermore, step S2 specifically involves:

[0074] S21: Obtain the feature vector F from the feature vector set. x and eigenvector F y Calculate F x and F y Manhattan distance d between xy , will d xy As a matrix element in the distance matrix;

[0075] Specifically, Manhattan is far from d xy The calculation formula is:

[0076]

[0077] Where F xi and F yi The eigenvectors F are respectively x and F y The autocorrelation eigenvalues ​​are defined in the i-th dimension, where n is the dimension of the eigenvector. A distance matrix D is generated by calculating the Manhattan distance between all sample pairs, with matrix elements D... xy Represents the eigenvector F x and F y The distance between them;

[0078] S22: Repeat step S21 until all matrix elements are calculated and the distance matrix D is constructed.

[0079] S3: Cluster the feature vector set using the distance matrix to obtain multiple clusters;

[0080] Furthermore, step S3 specifically includes:

[0081] S31: Use each feature vector in the feature vector set as a sample point;

[0082] S32: Obtaining the feature vector F based on the distance matrix x The set of points N within the neighborhood range ∈ ∈ (x), N ∈ The expression for (x) is:

[0083] N ∈ (x)={y∈X|d xy ≤∈}

[0084] Where, d xy For the eigenvector F x and eigenvector F y Manhattan distance between them;

[0085] If the point set N ∈ If the number of sample points in (x) is greater than or equal to the minimum number of points MinPts, then the feature vector F x Mark as core point;

[0086] S33: Repeat step S32 until all core points are obtained;

[0087] S34: If the core point F u If other core points exist within the neighborhood of a given core point, then all sample points within the neighborhood of those other core points are included in the core point F. u Within the corresponding cluster;

[0088] Specifically, points that do not belong to the neighborhood of any core point are marked as noise points;

[0089] S35: Repeat step S34 until the number of sample points in each cluster no longer changes, thus obtaining multiple clusters.

[0090] S4: Calculate the outlier score of each feature vector in each cluster;

[0091] Furthermore, by using outlier scores, we can determine which feature vectors deviate from the normal clustering structure and identify anomalous behavior.

[0092] Step S4 is as follows:

[0093] S41: Calculate the density of each cluster using the following formula:

[0094]

[0095] Where j is the cluster number, ρ j Let m be the density of cluster j. j Let M be the number of sample points in cluster j, and M be the total number of sample points.

[0096] S42: The outlier score of each eigenvector is obtained through density calculation. The calculation formula is as follows:

[0097]

[0098] Among them, O x For the eigenvector F x outlier fraction, ρ x For the eigenvector F x The density of the cluster, ρ k Let be the density of the k-th cluster, and k be the total number of clusters.

[0099] S5: Detect network attacks by using the scores of each outlier point to obtain the detection results.

[0100] Specifically, outlier scores are compared with preset thresholds to determine the type and severity of network attacks; based on the detection results, attack reports are generated and notified to security administrators through an interactive system.

[0101] Step S5 includes:

[0102] S51: For each outlier, based on its outlier score and a preset threshold O... threshold Compare the data to determine if it is abnormal traffic: If O x ≥O threshold If O x <O threshold If so, the feature vector is considered to be normal traffic.

[0103] S52: Attack type identification; based on the feature vector F of abnormal traffic. x Match against a known attack signature database;

[0104] The known attack signature database includes: DDoS attacks (sudden surge in traffic, abnormal request frequency), intrusion detection (abnormal traffic patterns, unauthorized access attempts), and data leakage (abnormal transmission of sensitive data);

[0105] S53: Severity Assessment; The severity of a network attack is assessed based on the outlier score and the characteristics of the attack type.

[0106] The severity level includes: mild (outlier score of 0). x Low (indicating the traffic deviates from the normal pattern but does not pose a serious threat), Medium (outlier score 0) x In the moderate range (indicating a potential threat requiring further monitoring); severe (outlier score of 0). x A high level indicates that the traffic may be a clear attack and immediate action is required.

[0107] S54: Summarize the detection results, including the characteristics of abnormal traffic, the types and severity of identified attacks, generate an attack detection report, and send it to the network administrator.

[0108] To further verify the effectiveness of the embodiments of the present invention, the following experiments were conducted: publicly available network attack intrusion detection system datasets were selected, including the ISCX-URL (2016), CIC-EVSE (2024), and CIC-Modbus (2023) datasets. Table 1 lists the attack sample information for each dataset in detail.

[0109] To objectively evaluate the detection performance of this invention, several mainstream models were introduced into the experiment, and their detection accuracy, recall, and F1 score were compared on three datasets: ISCX-URL, CIC-EVSE, and CIC-Modbus. Table 2 summarizes the experimental results of each model. The experimental results show that the model of this invention performs excellently on all datasets, especially achieving the highest F1 score of 99.2% on the ISCX-URL dataset, demonstrating outstanding attack detection capabilities. In the CIC-EVSE dataset, the model of this invention ranks second in both recall (83.2%) and F1 score (79.2%), demonstrating good balance and robustness. In the CIC-Modbus dataset, the model of this invention ranks among the top with an accuracy of 79.7%, showing extremely high detection precision and reliability.

[0110] Table 1. Details of the attack samples used in the experiment.

[0111]

[0112]

[0113] Table 2 Comparison of detection performance of different algorithm models on three public datasets

[0114]

[0115]

[0116] refer to Figure 3 , Figure 3 This diagram illustrates the layout framework of a time-series-based enhanced network attack detection system. The system comprises a network attack detection system, a database system, and an interactive system. The network attack detection system extracts data from network traffic, performs feature extraction and cluster analysis, and ultimately obtains detection results, generating network traffic events based on these results. These events are classified as normal or abnormal traffic and tagged according to attack timestamps and event types. The database system includes a local database and cloud backup, supporting database synchronization and updates. Database data can be uploaded and downloaded via the cloud to ensure data integrity and availability. The interactive system provides a visualization platform for network attack detection, presenting the detected data in a visual format and generating network attack detection reports.

[0117] refer to Figure 4 , Figure 4 This is an example diagram of the main login interface of the interactive system in this application embodiment. Specifically, on the login screen, the user needs to enter the corresponding username and password in the "Username" and "Password" input boxes respectively. After entering the information, the user clicks the "Login" button below to submit the information, and the system will verify the user's identity. If the verification is successful and the user is a legitimate user, the system will enter the main interface, allowing the user to access the system's main functions and interface.

[0118] refer to Figure 5 , Figure 5This is an example of the visualization interface of the network attack detection system based on time series enhancement in this application embodiment. The visualization interface allows administrators to view detected abnormal traffic information, attack types, and severity, and supports historical data querying and analysis. Specifically, the top of the interface displays the total number of network traffic acquired in real time by the system (81483) and the number of attacks identified (643). The pie chart on the left side of the interface uses color to distinguish the severity of current network attack events, divided into three categories: minor, moderate, and severe. The bar chart at the bottom of the interface shows the alarm distribution of different types of attacks on the day, including "URL attacks," "port scanning," "brute-force guessing," and "illegal mining," etc., which helps administrators understand the attack types and frequencies of the day. In addition, the pie chart shows the proportion of suspicious traffic in abnormal traffic (26%), and the list of key events on the right side records detailed information on typical high-risk network attack events, including attack time, attack method, severity, and risk description of the attack behavior. Another part of the interface displays the key parameters of the detection model. Finally, the system also displays the current status of the known attack signature database, including 75,423 samples and 39 novel samples uploaded in the last 24 hours, ensuring the system has continuous update and learning capabilities. Meanwhile, a bar chart shows the detection time for each epoch.

[0119] The database system is used to store and manage raw traffic data, cluster analysis results, and generated data during the network attack detection process, including information such as IP, Port, and Stage.

[0120] Please see Figure 6 , Figure 6 This is a schematic diagram of the hardware device in operation according to an embodiment of the present invention. The hardware device specifically includes: a network attack detection device 401 based on time series enhancement, a processor 402, and a storage medium 403.

[0121] A network attack detection device 401 based on time series enhancement: The network attack detection device 401 based on time series enhancement implements the network attack detection method based on time series enhancement.

[0122] Processor 402: The processor 402 loads and executes the instructions and data in the storage medium 403 to implement the network attack detection method based on time series enhancement.

[0123] Storage medium 403: The storage medium 403 stores instructions and data; the storage medium 403 is used to implement the network attack detection method based on time series enhancement.

[0124] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0125] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. In the unit claims listing several devices, several of these devices may be embodied by the same hardware item. The use of the terms first, second, and third, etc., does not indicate any order and can be interpreted as identifiers.

[0126] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A network attack detection method based on time series enhancement, characterized in that, Includes the following steps: S1: Obtain network traffic data stream, perform time series feature extraction on the network traffic data stream, and obtain a set of feature vectors; specifically: S11: Sort the captured network traffic data stream according to time steps to form a time series data set. ; S12: Calculate the autocorrelation coefficients between time series data x and other time series data, and construct the feature vector of time series data x using all the autocorrelation coefficients of time series data x. ; S13: Repeat step S12 until the feature vectors of all time series data are obtained, forming a feature vector set; S2: Calculate the Manhattan distance between each feature vector and construct a distance matrix using the Manhattan distance; S3: Cluster the feature vector set using the distance matrix to obtain multiple clusters; S4: Calculate the outlier scores for each feature vector in each cluster; specifically: S41: Calculate the density of each cluster using the following formula: Where j is the cluster number, Let the density of cluster j be , Let M be the number of sample points in cluster j, and M be the total number of sample points. S42: The outlier score of each eigenvector is obtained through density calculation. The calculation formula is as follows: in, For feature vectors outlier scores, For feature vectors The density of the cluster it belongs to, For the first The density of each cluster, The total number of clusters; S5: Detect network attacks by using the scores of each outlier point to obtain the detection results.

2. The network attack detection method based on time series enhancement according to claim 1, characterized in that: The formula for calculating the autocorrelation coefficient is: in, represents the autocorrelation coefficient between time series data x and time series data y; i is the time step number; n is the maximum value of the time step; Let x be the value of the time series data at time step i; Let y be the value of the time series data at time step i; x represents the average value of the time series data. y is the average value of the time series data; Feature vector The expression is: in, is the autocorrelation coefficient between time series data x and time series data n.

3. The network attack detection method based on time series enhancement according to claim 1, characterized in that, Step S2 is as follows: S21: Obtain feature vectors from the feature vector set and eigenvectors Calculation obtained and Manhattan distance ,Will As a matrix element in the distance matrix; S22: Repeat step S21 until all matrix elements are obtained, and construct the distance matrix. .

4. The network attack detection method based on time series enhancement according to claim 2, characterized in that, Step S3 is as follows: S31: Use each feature vector in the feature vector set as a sample point; S32: Obtaining Feature Vectors Based on Distance Matrix Within the neighborhood Point set within , The expression is: in, For feature vectors and eigenvectors Manhattan distance between them; If point set The number of sample points in the middle is greater than or equal to the minimum number of points. Then the feature vector Mark as core point; S33: Repeat step S32 until all core points are obtained; S34: If the core point If other core points exist within the neighborhood of a given core point, then all sample points within the neighborhood of those other core points are classified as core points. Within the corresponding cluster; S35: Repeat step S34 until the number of sample points in each cluster no longer changes, thus obtaining multiple clusters.

5. A network attack detection system based on time series enhancement, used to implement the network attack detection method based on time series enhancement as described in any one of claims 1 to 4, characterized in that: include: Network attack detection systems, database systems, and interactive systems; Network attack detection systems are used to obtain detection results by calculating network traffic data streams; Database systems are used for saving, uploading, and downloading various types of data; Interactive systems are used to provide visualization of detection results.

6. A network attack detection device based on time series enhancement, characterized in that: include: A processor and a storage medium; the processor loads and executes instructions and data in the storage medium to implement the network attack detection method based on time series enhancement as described in any one of claims 1 to 4.

Images