Network security situation awareness method based on deep neural network

Abstract

The invention relates to a network security situation awareness method based on a deep neural network. The method comprises the following steps: acquiring and preprocessing a network security data set to obtain an initial data set; constructing a situation element extraction model, and inputting the initial data set into the situation element extraction model to obtain network security attack elements; carrying out feature extraction based on the network security attack elements, and carrying out feature-level data fusion to obtain a fused feature vector; constructing a network security situation assessment model, and inputting the fusion feature vector into the network security situation assessment model to obtain a situation assessment result; forming a multi-dimensional time sequence data set based on the network security attack elements and the situation assessment result, and training a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multi-dimensional time sequence data set; and inputting the current situation data into the trained deep neural network security situation prediction model, and outputting a network situation prediction result. And the network security situation awareness evaluation and prediction accuracy is improved.

Description

Technical Field

[0001] The present application relates to the technical field of network security situation awareness, and in particular to a network security situation awareness method based on deep neural network. Background Art

[0002] In recent years, cyber attacks have become increasingly fierce, and detection methods for single attacks can no longer fully meet the needs of network security. Therefore, corporate and national network security managers need to have a macro understanding of the current security status of information systems in order to respond to attack events more promptly and reasonably. Situational awareness is a technology that acquires a large amount of environmental information and understands the information to achieve the perception of the current and future status of the entire environment. The situational awareness system can help network security managers accurately grasp the security status of the system and the risks that may be encountered, so as to respond to possible attack events in a timely manner and make decisions, and improve the active defense capabilities of network security, which is crucial in the field of network security.

[0003] In the prior art, the network security situation awareness method is generally divided into three steps: situation element extraction, situation assessment and situation prediction, which involves anomaly detection, feature extraction, feature fusion, time series prediction and other steps. Situation element extraction generally uses unsupervised anomaly detection in the field of deep learning. Situation assessment usually uses tools such as mathematical models to evaluate the current state. Situation prediction usually uses the neural network method, using historical data to train the neural network so that it can learn the patterns and laws of the network situation and make a comprehensive prediction of the network operation status.

[0004] However, existing situation factor extraction methods have problems with data imbalance and adversarial attack samples, which will reduce the classification accuracy of extraction. At the same time, existing situation assessment methods have problems such as excessive human intervention and reliance on expert experience, which leads to subjective situation assessment results. In addition, existing situation prediction methods based on neural networks have problems such as difficulty in modeling long sequences and easy loss of information, making situation prediction inaccurate.

[0005] Therefore, in the relevant technologies, there is an urgent need for a method that can improve the accuracy of network security situation awareness assessment and prediction. Summary of the invention

[0006] Based on this, it is necessary to provide a network security situation awareness method based on deep neural networks that can improve the accuracy of network security situation awareness assessment and prediction in response to the above technical problems.

[0007] In a first aspect, the present application provides a network security situation awareness method based on a deep neural network. The method comprises:

[0008] Obtain a network security data set and preprocess it to obtain an initial data set;

[0009] Building a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, inputting the initial data set into the situation factor extraction model, and obtaining network security attack factors;

[0010] Based on the network security attack elements, a Bi-LSTM model is used to extract features, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector;

[0011] A network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result;

[0012] Based on the network security attack elements and situation assessment results, a multidimensional time series data set is formed, and based on the multidimensional time series data set, a deep neural network security situation prediction model based on sample convolution and interaction modules is trained;

[0013] Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

[0014] Optionally, in one embodiment of the present application, the step of constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder includes:

[0015] The training process of the situation factor extraction model is optimized using an integrated strategy of random weight averaging, and stochastic gradient variational Bayes is used as the loss function of the training.

[0016] Optionally, in one embodiment of the present application, inputting the initial data set into the situation factor extraction model to obtain the network security attack factor includes:

[0017] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0018] Optionally, in one embodiment of the present application, the feature-level data fusion using the concat feature fusion method based on the attention mechanism includes:

[0019] Use concat to concatenate feature vectors, and calculate the concatenated feature vectors with the attention matrix to obtain the attention score;

[0020] An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0021] Optionally, in one embodiment of the present application, inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further includes:

[0022] The situation value is calculated based on the probability of belonging to the situation category.

[0023] Optionally, in one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0024] Optionally, in one embodiment of the present application, the training of a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multi-dimensional time series data set includes:

[0025] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0026] In a second aspect, the present application also provides a network security situation awareness device based on a deep neural network. The device comprises:

[0027] A data acquisition module is used to acquire and preprocess the network security data set to obtain an initial data set;

[0028] A situation factor extraction module is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors;

[0029] A feature fusion module, used to extract features based on the network security attack elements using a Bi-LSTM model, and to perform feature-level data fusion using a concat feature fusion method based on an attention mechanism to obtain a fused feature vector;

[0030] A situation assessment module, which is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result;

[0031] A situation prediction model training module, used to form a multidimensional time series data set based on the network security attack elements and situation assessment results, and to train a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set;

[0032] The network security situation awareness module is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

[0033] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the steps of the methods described in the above embodiments.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in each of the above embodiments are implemented.

[0035] The above-mentioned network security situation awareness method based on deep neural network first obtains and preprocesses a network security data set to obtain an initial data set; then, a situation factor extraction model is constructed based on a gated recurrent unit and a variational autoencoder, and the initial data set is input into the situation factor extraction model to obtain network security attack factors; then, a Bi-LSTM model is used to extract features based on the network security attack factors, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; then, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; then, a multidimensional time series data set is constructed based on the network security attack factors and the situation assessment results, and a deep neural network security situation prediction model based on a sample convolution and interaction module is trained based on the multidimensional time series data set; finally, the current situation data is input into the trained deep neural network security situation prediction model to output a network situation prediction result.

[0036] In other words, it is proposed to extract situational factors based on gated recurrent units and variational autoencoders. It only needs to use normal data to train the model. The abnormal factors are judged by reconstructing the data through the variational autoencoder to calculate the reconstruction probability to determine whether the factor is abnormal. At the same time, the gated recurrent unit is used to improve the encoder-decoder network of the variational autoencoder so that the model can converge faster and have less resource loss. Finally, in the training process of the entire model, the single model integration strategy of random weight average is used to optimize the model training to improve the robustness and generalization ability of the situational factor extraction model to prevent adversarial attacks. Secondly, it is proposed to use the Bi-LSTM model to extract features for different situational factors separately, and to capture the information in the data more comprehensively by bidirectionally processing the data. Then, the feature fusion technology based on the attention mechanism is used to obtain the fusion features, which can further obtain more critical and meaningful features for network security situation assessment, thereby more accurately reflecting the actual operation of the cyberspace and the risks faced, and giving the corresponding situation assessment value. In addition, a deep neural network model was built using sample convolution and interaction units, and the situation awareness and situation prediction task was modeled as a multi-dimensional time series prediction problem. The situation element prediction and situation value for a period of time in the future were given based on the input situation element data and situation assessment result data for a period of time. This solves the problems existing in the existing situation awareness and prediction technology based on deep neural networks, such as the inability to perform parallel calculations, the possibility of gradient vanishing or gradient explosion when modeling long sequences, and the easy loss of information in some models during the modeling process. This improves the accuracy of network security situation awareness assessment and prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is an application environment diagram of a network security situation awareness method based on a deep neural network in one embodiment;

[0038] Figure 2 A schematic diagram of a process of a network security situation awareness method based on a deep neural network in one embodiment;

[0039] Figure 3 A schematic diagram of a flow chart of an abnormal element extraction method in one embodiment;

[0040] Figure 4 A schematic diagram of a flow chart of a situation assessment method in one embodiment;

[0041] Figure 5 A schematic diagram of a flow chart of a situation prediction method in one embodiment;

[0042] Figure 6 The present invention is a flowchart of specific steps of a method for network security situation awareness based on a deep neural network in one embodiment;

[0043] Figure 7It is a structural block diagram of a network security situation awareness device based on a deep neural network in one embodiment;

[0044] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] The network security situation awareness method based on deep neural network provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0047] In one embodiment, Figure 2 As shown in the figure, a network security situation awareness method based on deep neural network is provided. Figure 1 The server in the example is used to illustrate the following steps:

[0048] S201: Acquire a network security data set and preprocess it to obtain an initial data set.

[0049] In an embodiment of the present application, a network security data set is obtained and preprocessed to obtain an initial data set, wherein the network security data set refers to data related to security elements such as security logs, system logs, vulnerability data, and traffic data in the network, and the preprocessing refers to extracting string-type classification features for one-hot encoding, and for other features, normalizing the numerical data.

[0050] S203: construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors.

[0051] In the embodiment of the present application, the encoder-decoder network of the variational autoencoder is improved by using a gated recurrent unit to construct a situation factor extraction model, such as Figure 3 As shown, after that, the initial data set obtained after preprocessing is input into the situation factor extraction model to capture the time series characteristics, calculate the reconstruction loss to find the abnormal points as abnormal factors, and obtain the network security attack factors.

[0052] In one embodiment of the present application, the step of constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder includes:

[0053] The training process of the situation factor extraction model is optimized using an integrated strategy of random weight averaging, and stochastic gradient variational Bayes is used as the loss function of the training.

[0054] In one embodiment of the present application, after the situation factor extraction model is constructed, the model needs to be trained. During the training process, the training process is optimized using the integration strategy of random weight averaging to improve the generalization ability and anti-interference ability of the model. At the same time, the loss function adopts stochastic gradient variational Bayes, and the specific formula is expressed as:

[0055]

[0056] The two parts of the loss function are respectively to regularize the latent variable z. The first part uses KL divergence to measure the approximate posterior distribution of the latent variable z. and the prior distribution p θ (z) and tries to minimize it. The second term is obtained by extracting the posterior distribution of the latent variable z from Sampling in order to maximize the log-likelihood function p θ (x|z) is used to reconstruct x. The purpose of the entire training is to model the distribution parameters.

[0057] In one embodiment of the present application, inputting the initial data set into the situation factor extraction model to obtain the network security attack factor includes:

[0058] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0059] In one embodiment of the present application, the initial data set is input into the trained situation factor extraction model, and an abnormal score is output. The method for determining whether the result is abnormal is to pre-set an abnormal threshold. When the abnormal score is greater than the abnormal threshold, it is determined to be a network security attack factor. The selection of the abnormal threshold is to dynamically select a threshold for the subsequence through the super-threshold model in the extreme value theory. Data exceeding the abnormal threshold is an abnormal factor, that is, a network security attack factor.

[0060] S205: Based on the network security attack elements, a Bi-LSTM model is used to extract features, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector.

[0061] In the embodiment of the present application, in order to comprehensively evaluate the network security situation, the network security attack elements are first divided into operation situation elements, attack situation elements and harmful situation elements. The Bi-LSTM model is used to extract features of different types of situation element data to obtain feature vectors of network security situation elements, and the concat feature fusion method is used to splice the obtained feature vectors, and the fused features are weighted by the attention mechanism to obtain a fused feature vector. Specifically, feature extraction is to first combine the situation element data within a period of time to form X i =[f1,f2,f3,…,f i ],in Represents the data of the jth time in the i-th channel, with dimension D i Then, taking it as input, the two LSTMs independently calculate the input at each time step and generate a forward hidden state sequence H f ={h1,h2,…,h N} and a backward hidden state sequence H b ={h N ,h N-1 ,…,h1}. Finally, the two layers of calculation structure are combined to get the output result. The calculation process is as follows:

[0062] cf i =BiLTSM(X i )

[0063] Among them, cf i ∈R d represents the output feature vector of channel i, and d is the output vector dimension of the Bi-LSTM layer.

[0064] In one embodiment of the present application, the feature-level data fusion using the concat feature fusion method based on the attention mechanism includes:

[0065] S301: Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain an attention score.

[0066] S303: Determine an attention weight based on the attention score, and perform weighted summation based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0067] In one embodiment of the present application, first, for the feature vector obtained by the concat feature fusion method, it is operated with the attention matrix to obtain the attention score. The specific formula is as follows:

[0068]

[0069] Among them, F is the concatenated feature vector, and the attention matrix W a ∈R d×d , is the attention weight vector.

[0070] After that, the attention weights are as follows:

[0071]

[0072] After that, the attention weights and the feature vectors extracted by Bi-LSTM are weighted summed to obtain the final fused feature vector. The specific formula is as follows:

[0073]

[0074] Among them, cf i is the output feature vector of channel i, a i is the attention weight.

[0075] S207: A network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result.

[0076] In the embodiment of the present application, in the network security situation assessment module, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, such as Figure 4 As shown in the figure, first, one-dimensional convolution is used to extract features from sequence data. Secondly, batch normalization is used to speed up the training of the model and reduce the risk of overfitting. Finally, the ReLU function is used to activate the feature matrix M after the convolution. The calculation formula is as follows:

[0077] M l =ReLU l (BN l (conv1D(F att ))

[0078] Among them, l represents the layer sequence.

[0079] Subsequently, the output features are downsampled using the maximum pooling layer, and the calculation formula is as follows:

[0080] gm=MaxPooling(M l )

[0081] Finally, the features are fully connected and the softmax function is used to output the level of network security situation within the time period, that is, the situation assessment result.

[0082] In one embodiment of the present application, inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further includes:

[0083] The situation value is calculated based on the probability of belonging to the situation category.

[0084] In one embodiment of the present application, in order to better reflect the network situation, the probability of the obtained situation category is processed to generate a corresponding situation value, which is convenient for subsequent experimental comparison and evaluation. The specific situation value calculation formula is as follows:

[0085] value=∑a i ·x i

[0086] Among them, a i is the standard value of security situation corresponding to this category, x i is the predicted situation category probability.

[0087] S209: Construct a multidimensional time series data set based on the network security attack elements and situation assessment results, and train a deep neural network security situation prediction model based on sample convolution and interaction modules based on the multidimensional time series data set.

[0088] In the present application embodiment, Figure 5 As shown in the figure, firstly, the network security attack elements and situation assessment results are preprocessed, and the time information is supplemented to form a multi-dimensional time series data set for situation prediction. Then, the data set is used to train the deep neural network security situation prediction model based on sample convolution and interaction module.

[0089] Specifically, in one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0090] In one embodiment of the present application, Figure 5As shown in the figure, the deep neural network security situation prediction model is based on the combination of sample convolution and interaction units (SCI-Block). By combining multiple SCI-Blocks through a binary tree structure, SCINet can effectively model and predict time series data. After L layers of SCI-Block processing, all subsequences are reversed parity segmentation and residual linking to form a new sequence representation. At this time, this sequence has captured and expressed the local and global time series relationships in the original time series data. The number of operations required for the time convolution network TCN commonly used to solve time series data prediction is T*log2T, while the number of operations required for the neural network structure based on sample convolution and interaction is L*2T, where T is the size of the parameter look-back window and L is the number of layers of SCI-Block. The deep neural network security situation prediction model based on the sample convolution and interaction module stacks multiple neural networks based on sample convolution and interaction to form a deep neural network based on sample convolution and interaction, further improving the prediction accuracy of the model.

[0091] In one embodiment of the present application, the training of a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multi-dimensional time series data set includes:

[0092] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0093] In one embodiment of the present application, during the training process of SCInet, the relay supervision technology is used to optimize the training of the network, and the real value is used as the supervision signal to help the model better learn the intermediate time series features, thereby improving the prediction accuracy of the model. The training uses the mean square error MSE (MSE) as the loss function, and the loss function of the kth layer can be expressed as the following formula:

[0094]

[0095] in, represents the output of the k-th layer network at time step i, x i represents the true value, and τ represents the length of the time series data.

[0096] The loss function of the entire model can be expressed as follows:

[0097]

[0098] S211: Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction result.

[0099] In an embodiment of the present application, the current situation data to be predicted, that is, the data processed by the situation element extraction module and the situation assessment module in sequence, is input into the trained deep neural network security situation prediction model to obtain the network situation prediction result, that is, the future prediction result.

[0100] In the above-mentioned network security situation awareness method based on deep neural network, first, a network security data set is obtained and preprocessed to obtain an initial data set; then, a situation factor extraction model is constructed based on a gated recurrent unit and a variational autoencoder, and the initial data set is input into the situation factor extraction model to obtain network security attack factors; then, a Bi-LSTM model is used to extract features based on the network security attack factors, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; then, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; then, a multidimensional time series data set is constructed based on the network security attack factors and the situation assessment results, and a deep neural network security situation prediction model based on a sample convolution and interaction module is trained based on the multidimensional time series data set; finally, the current situation data is input into the trained deep neural network security situation prediction model to output a network situation prediction result.

[0101] In other words, it is proposed to extract situational factors based on gated recurrent units and variational autoencoders. It only needs to use normal data to train the model. The abnormal factors are judged by reconstructing the data through the variational autoencoder to calculate the reconstruction probability to determine whether the factor is abnormal. At the same time, the gated recurrent unit is used to improve the encoder-decoder network of the variational autoencoder so that the model can converge faster and have less resource loss. Finally, in the training process of the entire model, the single model integration strategy of random weight average is used to optimize the model training to improve the robustness and generalization ability of the situational factor extraction model to prevent adversarial attacks. Secondly, it is proposed to use the Bi-LSTM model to extract features for different situational factors separately, and to capture the information in the data more comprehensively by bidirectionally processing the data. Then, the feature fusion technology based on the attention mechanism is used to obtain the fusion features, which can further obtain more critical and meaningful features for network security situation assessment, thereby more accurately reflecting the actual operation of the cyberspace and the risks faced, and giving the corresponding situation assessment value. In addition, a deep neural network model was built using sample convolution and interaction units, and the situation awareness and situation prediction task was modeled as a multi-dimensional time series prediction problem. The situation element prediction and situation value for a period of time in the future were given based on the input situation element data and situation assessment result data for a period of time. This solves the problems existing in the existing situation awareness and prediction technology based on deep neural networks, such as the inability to perform parallel calculations, the possibility of gradient vanishing or gradient explosion when modeling long sequences, and the easy loss of information in some models during the modeling process. This improves the accuracy of network security situation awareness assessment and prediction.

[0102] The following is a specific example to illustrate the specific implementation steps of the network security situation awareness method based on deep neural network of the present application. Figure 6 As shown, first, S401, obtain a network security data set and preprocess it to obtain an initial data set. Then, S403, construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors. S405, use an integrated strategy of random weight averaging to optimize the training process of the situation factor extraction model, and use stochastic gradient variational Bayes as the loss function for training. S407, the situation factor extraction model outputs an anomaly score, and determines the network security attack factor based on the anomaly score and a preset anomaly threshold.

[0103] Afterwards, in S409, a Bi-LSTM model is used to extract features based on the network security attack elements, and a concat feature fusion method based on the attention mechanism is used to fuse feature-level data to obtain a fused feature vector. Specifically, in S411-S413, concat is used to concatenate feature vectors, and the concatenated feature vectors are operated with the attention matrix to obtain an attention score; an attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0104] Then, in step S415, a network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result. In step S417, a situation value is calculated based on the probability of the situation category.

[0105] Afterwards, S419, a multidimensional time series data set is formed based on the network security attack elements and situation assessment results, and a deep neural network security situation prediction model based on sample convolution and interaction modules is trained based on the multidimensional time series data set. S421, the deep neural network security situation prediction model based on sample convolution and interaction modules is composed of a plurality of neural network stacks based on sample convolution and interaction units. S423, the training of the network is optimized using relay supervision technology, the true value is used as the supervision signal, and the mean square error MSE is used as the loss function of the training. Finally, S425, the current situation data is input into the trained deep neural network security situation prediction model, and the network situation prediction result is output.

[0106] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0107] Based on the same inventive concept, the embodiment of the present application also provides a network security situation awareness device based on a deep neural network for implementing the network security situation awareness method based on a deep neural network involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the network security situation awareness device based on a deep neural network provided below can refer to the limitations of the network security situation awareness method based on a deep neural network above, and will not be repeated here.

[0108] In one embodiment, Figure 7 As shown, a network security situation awareness device 700 based on a deep neural network is provided, comprising: a data acquisition module 701, a situation element extraction module 703, a feature fusion module 705, a situation assessment module 707, a feature fusion module 709 and a situation assessment module 711, wherein:

[0109] The data acquisition module 701 is used to acquire and pre-process a network security data set to obtain an initial data set.

[0110] The situation factor extraction module 703 is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors.

[0111] The feature fusion module 705 is used to extract features based on the network security attack elements using the Bi-LSTM model, and to perform feature-level data fusion using the concat feature fusion method based on the attention mechanism to obtain a fused feature vector.

[0112] The situation assessment module 707 is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result.

[0113] The situation prediction model training module 709 is used to form a multidimensional time series data set based on the network security attack elements and situation assessment results, and to train a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set.

[0114] The network security situation awareness module 711 is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction result.

[0115] In one embodiment of the present application, the situation factor extraction module is also used to:

[0116] The training process of the situation factor extraction model is optimized using an integrated strategy of random weight averaging, and stochastic gradient variational Bayes is used as the loss function of the training.

[0117] In one embodiment of the present application, the situation factor extraction module is also used to:

[0118] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0119] In one embodiment of the present application, the feature fusion module is further used to:

[0120] Use concat to concatenate feature vectors, and calculate the concatenated feature vectors with the attention matrix to obtain the attention score;

[0121] An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0122] In one embodiment of the present application, the situation assessment module is further used to:

[0123] The situation value is calculated based on the probability of belonging to the situation category.

[0124] In one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0125] In one embodiment of the present application, the situation prediction model training module is also used to:

[0126] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0127] Each module in the above-mentioned network security situation awareness device based on deep neural network can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0128] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a network security situation awareness method based on a deep neural network is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0129] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0132] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0134] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0135] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security situation awareness method based on deep neural network, characterized in that: The method comprises: Obtain a network security data set and preprocess it to obtain an initial data set; Building a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, inputting the initial data set into the situation factor extraction model, and obtaining network security attack factors; Based on the network security attack elements, a Bi-LSTM model is used to extract features, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; A network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; Based on the network security attack elements and situation assessment results, a multidimensional time series data set is formed, and based on the multidimensional time series data set, a deep neural network security situation prediction model based on sample convolution and interaction modules is trained; Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

2. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The method of constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder includes: The training process of the situation factor extraction model is optimized using an integrated strategy of random weight averaging, and stochastic gradient variational Bayes is used as the loss function of the training.

3. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The inputting the initial data set into the situation factor extraction model to obtain the network security attack factors includes: The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

4. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The concat feature fusion method based on the attention mechanism for feature-level data fusion includes: Use concat to concatenate feature vectors, and calculate the concatenated feature vectors with the attention matrix to obtain the attention score; An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

5. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: Inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further comprises: The situation value is calculated based on the probability of belonging to the situation category.

6. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

7. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The deep neural network security situation prediction model based on the sample convolution and interaction module trained based on the multi-dimensional time series data set includes: Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

8. A network security situation awareness device based on deep neural network, characterized in that: The device comprises: A data acquisition module is used to acquire and preprocess the network security data set to obtain an initial data set; A situation factor extraction module is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors; A feature fusion module, used to extract features based on the network security attack elements using a Bi-LSTM model, and to perform feature-level data fusion using a concat feature fusion method based on an attention mechanism to obtain a fused feature vector; A situation assessment module, which is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result; A situation prediction model training module, used to form a multidimensional time series data set based on the network security attack elements and situation assessment results, and to train a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set; The network security situation awareness module is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images