Network security situation awareness method based on deep neural network

Abstract

The present application relates to a network security situation awareness method based on a deep neural network. The method comprises: obtaining a network security data set and preprocessing it to obtain an initial data set; constructing a situation factor extraction model, inputting the initial data set into the situation factor extraction model to obtain network security attack factors; extracting features based on the network security attack factors, and performing feature-level data fusion to obtain a fused feature vector; constructing a network security situation assessment model, inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result; constructing a multidimensional time series data set based on the network security attack factors and the situation assessment result, and training a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set; and inputting the current situation data into the trained deep neural network security situation prediction model to output a network situation prediction result. This method improves the accuracy of network security situation awareness assessment and prediction.

Description

Technical Field

[0001] The present application relates to the technical field of network security situation awareness, and in particular to a network security situation awareness method based on deep neural network. Background Art

[0002] In recent years, cyberattacks have become increasingly ferocious, and detection methods targeting single attacks are no longer fully sufficient to meet network security needs. Therefore, cybersecurity managers at the enterprise and national levels need a comprehensive understanding of the current security status of information systems to enable more timely and effective responses to attack incidents. Situational awareness is a technology that uses extensive environmental information to understand the current and future state of the entire environment. A situational awareness system can help network security managers accurately grasp the security status of their systems and potential risks, enabling them to respond promptly to potential attacks and make informed decisions, thereby enhancing proactive defense capabilities. This is crucial in the field of cybersecurity.

[0003] In existing technologies, network security situational awareness methods generally consist of three steps: situational element extraction, situational assessment, and situational prediction. These steps involve anomaly detection, feature extraction, feature fusion, and time series prediction. Situational element extraction typically utilizes unsupervised anomaly detection from deep learning. Situational assessment typically uses tools such as mathematical models to assess the current state. Situational prediction typically employs neural network methods, training the neural network with historical data to learn patterns and regularities in network situations and provide a comprehensive forecast of network operational status.

[0004] However, existing situation factor extraction methods suffer from data imbalance and adversarial attack samples, which can reduce classification accuracy. Furthermore, existing situation assessment methods suffer from excessive manual intervention and reliance on expert experience, resulting in subjective situation assessment results. Furthermore, existing neural network-based situation prediction methods face difficulties in modeling long sequences and are prone to information loss, making situation predictions less accurate.

[0005] Therefore, in related technologies, there is an urgent need for a method that can improve the accuracy of network security situation awareness assessment and prediction. Summary of the Invention

[0006] Based on this, it is necessary to provide a network security situation awareness method based on deep neural networks that can improve the accuracy of network security situation awareness assessment and prediction in response to the above technical problems.

[0007] In a first aspect, the present application provides a method for network security situation awareness based on a deep neural network. The method comprises:

[0008] Obtain a network security dataset and preprocess it to obtain an initial dataset;

[0009] Constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, inputting the initial data set into the situation factor extraction model to obtain network security attack factors;

[0010] Based on the network security attack factors, a Bi-LSTM model is used to extract features, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector;

[0011] A network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result;

[0012] Based on the network security attack factors and situation assessment results, a multidimensional time series data set is formed, and based on the multidimensional time series data set, a deep neural network security situation prediction model based on sample convolution and interaction modules is trained;

[0013] Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

[0014] Optionally, in one embodiment of the present application, after constructing the situation factor extraction model based on the gated recurrent unit and the variational autoencoder, the method further includes:

[0015] The training process of the situation factor extraction model is optimized using an integration strategy of random weight averaging, and stochastic gradient variational Bayes is adopted as the loss function of the training.

[0016] Optionally, in one embodiment of the present application, inputting the initial data set into the situation factor extraction model to obtain network security attack factors includes:

[0017] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0018] Optionally, in one embodiment of the present application, the feature-level data fusion using the concat feature fusion method based on the attention mechanism includes:

[0019] Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain the attention score;

[0020] An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0021] Optionally, in one embodiment of the present application, inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further comprises:

[0022] The situation value is calculated based on the probability of belonging to the situation category.

[0023] Optionally, in one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0024] Optionally, in one embodiment of the present application, the training of a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series dataset includes:

[0025] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0026] In a second aspect, the present application also provides a network security situation awareness device based on a deep neural network. The device includes:

[0027] A data acquisition module is used to acquire and preprocess the network security data set to obtain an initial data set;

[0028] A situation factor extraction module is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors;

[0029] A feature fusion module is used to extract features based on the network security attack elements using a Bi-LSTM model, and to fuse feature-level data using a concat feature fusion method based on an attention mechanism to obtain a fused feature vector;

[0030] A situation assessment module is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result;

[0031] A situation prediction model training module is used to form a multidimensional time series data set based on the network security attack factors and situation assessment results, and to train a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set;

[0032] The network security situation awareness module is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results.

[0033] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program and the processor executes the steps of the method described in each of the above embodiments.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in each of the above embodiments.

[0035] The above-mentioned network security situation awareness method based on deep neural network first obtains and preprocesses a network security data set to obtain an initial data set; then, a situation factor extraction model is constructed based on a gated recurrent unit and a variational autoencoder, and the initial data set is input into the situation factor extraction model to obtain network security attack factors; then, a Bi-LSTM model is used to extract features based on the network security attack factors, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; then, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; then, a multidimensional time series data set is constructed based on the network security attack factors and the situation assessment results, and a deep neural network security situation prediction model based on a sample convolution and interaction module is trained based on the multidimensional time series data set; finally, the current situation data is input into the trained deep neural network security situation prediction model to output a network situation prediction result.

[0036] Specifically, a method based on gated recurrent units and variational autoencoders is proposed for situational factor extraction. The model is trained using only normal data. Anomalous factors are determined by reconstructing the data using a variational autoencoder and calculating the reconstruction probability to determine whether the factor is abnormal. Gated recurrent units are also used to improve the encoder-decoder network of the variational autoencoder, enabling faster model convergence and reducing resource consumption. Finally, a single-model ensemble strategy with random weight averaging is used throughout the model training process to optimize model training, improving the robustness and generalization capabilities of the situational factor extraction model and preventing adversarial attacks. Secondly, a Bi-LSTM model is proposed to extract features for different situational factors. Bidirectional data processing is used to more comprehensively capture information in the data. Feature fusion techniques based on an attention mechanism are then used to obtain fused features. This further derives more critical and meaningful features for cybersecurity situation assessment, thereby more accurately reflecting the actual operation and risks faced by cyberspace and providing corresponding situation assessment values. In addition, a deep neural network model was built using sample convolution and interaction units, and the situation awareness and situation prediction task was modeled as a multi-dimensional time series prediction problem. The situation factor prediction and situation value for a period of time in the future were given based on the input situation factor data and situation assessment result data for a period of time. This solved the problems existing in the existing situation awareness and prediction technology based on deep neural networks, such as the inability to perform parallel calculations, the possibility of gradient disappearance or gradient explosion when modeling long sequences, and the easy loss of information in some models during the modeling process. This improved the accuracy of network security situation awareness assessment and prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a diagram of an application environment of a network security situation awareness method based on a deep neural network in one embodiment;

[0038] Figure 2 1 is a flowchart of a method for network security situation awareness based on a deep neural network in one embodiment;

[0039] Figure 3 1 is a flow chart of an abnormal element extraction method according to an embodiment;

[0040] Figure 4 1 is a flow chart of a situation assessment method according to an embodiment;

[0041] Figure 5 1 is a flow chart of a situation prediction method according to an embodiment;

[0042] Figure 6 1 is a flowchart illustrating specific steps of a method for network security situation awareness based on a deep neural network in one embodiment;

[0043] Figure 71 is a block diagram of a network security situation awareness device based on a deep neural network in one embodiment;

[0044] Figure 8 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0046] The network security situation awareness method based on deep neural network provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0047] In one embodiment, Figure 2 As shown in the figure, a network security situation awareness method based on deep neural network is provided. Figure 1 The following steps are used as an example to illustrate the server in the example:

[0048] S201: Acquire a network security dataset and perform preprocessing to obtain an initial dataset.

[0049] In an embodiment of the present application, a network security dataset is obtained and preprocessed to obtain an initial dataset, wherein the network security dataset refers to data related to security elements such as security logs, system logs, vulnerability data, and traffic data in the network. Preprocessing refers to extracting string-type classification features for one-hot encoding, and for other features, normalizing the numerical data.

[0050] S203: Construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors.

[0051] In the embodiment of the present application, the gated recurrent unit is used to improve the encoder-decoder network of the variational autoencoder to construct a situation factor extraction model, such as Figure 3 As shown, the initial data set obtained after preprocessing is input into the situation factor extraction model to capture the time series characteristics, calculate the reconstruction loss to find the abnormal points as abnormal factors, and obtain the network security attack factors.

[0052] In one embodiment of the present application, the step of constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder includes:

[0053] The training process of the situation factor extraction model is optimized using an integration strategy of random weight averaging, and stochastic gradient variational Bayes is adopted as the loss function of the training.

[0054] In one embodiment of the present application, after the situation factor extraction model is constructed, the model needs to be trained. During the training process, the integration strategy of random weight averaging is used to optimize the training process to improve the generalization ability and anti-interference ability of the model. At the same time, the loss function adopts stochastic gradient variational Bayes, and the specific formula is expressed as:

[0055]

[0056] Among them, the two parts of the loss function are respectively to regularize the latent variable z. The first one uses KL divergence to measure the approximate posterior distribution of the latent variable z. and the prior distribution p θ (z) and tries to minimize it. The second term is obtained by extracting the posterior distribution of the latent variable z from Sampling in order to maximize the log-likelihood function p θ (x|z) is used to reconstruct x. The purpose of the entire training is to model the distribution parameters.

[0057] In one embodiment of the present application, inputting the initial data set into the situation factor extraction model to obtain network security attack factors includes:

[0058] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0059] In one embodiment of the present application, an initial dataset is fed into a trained situational factor extraction model, which outputs an anomaly score. Whether the result is abnormal is determined by presetting an anomaly threshold. When the anomaly score exceeds the anomaly threshold, it is considered a network security attack factor. The anomaly threshold is selected by dynamically selecting a threshold for a subsequence using a superthreshold model from extreme value theory. Data exceeding the anomaly threshold is considered an anomaly, i.e., a network security attack factor.

[0060] S205: Based on the network security attack factors, a Bi-LSTM model is used to perform feature extraction, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector.

[0061] In the embodiment of the present application, in order to comprehensively evaluate the network security situation, the network security attack factors are first divided into the operational situation factors, the attack situation factors and the harmful situation factors. The Bi-LSTM model is used to extract the features of different types of situation factor data to obtain the feature vectors of the network security situation factors, and the concat feature fusion method is used to splice the obtained feature vectors. The fused features are weighted by the attention mechanism to obtain the fused feature vectors. Specifically, the feature extraction is to first combine the situation factor data within a period of time to form X i =[f1,f2,f3,…,f i ],in Represents the data of the jth time in the i-th channel, with a dimension of D i Then, taking it as input, the two LSTMs independently calculate the input of each time step and generate a forward hidden state sequence H f ={h1,h2,…,h N} and a backward hidden state sequence H b ={h N ,h N-1 ,…,h1}. Finally, the two-layer calculation structure is combined to obtain the output result. The calculation process is as follows:

[0062] cf i =BiLTSM(X i )

[0063] Among them, cf i ∈R d represents the output feature vector of channel i, and d is the output vector dimension of the Bi-LSTM layer.

[0064] In one embodiment of the present application, the feature-level data fusion using the concat feature fusion method based on the attention mechanism includes:

[0065] S301: Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain an attention score.

[0066] S303: Determine an attention weight based on the attention score, and perform weighted summation based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0067] In one embodiment of the present application, first, the feature vector obtained by the concat feature fusion method is calculated with the attention matrix to obtain the attention score. The specific formula is as follows:

[0068]

[0069] Among them, F is the concatenated feature vector, and the attention matrix W a ∈R d×d , is the attention weight vector.

[0070] Afterwards, the attention weights are as follows:

[0071]

[0072] Afterwards, the attention weights and the feature vectors extracted by Bi-LSTM are weighted and summed to obtain the final fused feature vector. The specific formula is as follows:

[0073]

[0074] Among them, cf i is the output feature vector of channel i, a i is the attention weight.

[0075] S207: Using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function to construct a network security situation assessment model, inputting the fused feature vector into the network security situation assessment model, and obtaining a situation assessment result.

[0076] In the embodiment of the present application, in the network security situation assessment module, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, such as Figure 4 As shown in the figure, first, one-dimensional convolution is used to extract features from sequence data. Secondly, batch normalization is used to speed up model training and reduce the risk of overfitting. Finally, the ReLU function is used to activate the output convolution feature matrix M. The calculation formula is as follows:

[0077] M l =ReLU l (BN l (conv1D(F att ))

[0078] Where l represents the sequence.

[0079] Subsequently, the output features are downsampled using the maximum pooling layer, and the calculation formula is as follows:

[0080] gm=MaxPooling(M l )

[0081] Finally, the features are fully connected and the softmax function is used to output the level of network security situation within the time period, that is, the situation assessment result.

[0082] In one embodiment of the present application, inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further includes:

[0083] The situation value is calculated based on the probability of belonging to the situation category.

[0084] In one embodiment of the present application, in order to better reflect the network situation, the obtained situation category probability is processed to generate a corresponding situation value to facilitate subsequent experimental comparison and evaluation. The specific situation value calculation formula is as follows:

[0085] value=∑a i ·x i

[0086] Among them, a i is the standard value of security situation corresponding to this category, x i is the predicted probability of the situation category.

[0087] S209: Construct a multidimensional time series data set based on the network security attack elements and situation assessment results, and train a deep neural network security situation prediction model based on sample convolution and interaction modules based on the multidimensional time series data set.

[0088] In the embodiment of this application, Figure 5 As shown in the figure, first, the network security attack elements and situation assessment results are preprocessed and supplemented with time information to form a multidimensional time series dataset for situation prediction. Then, this dataset is used to train a deep neural network security situation prediction model based on sample convolution and interaction modules.

[0089] Specifically, in one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0090] In one embodiment of the present application, Figure 5As shown, the deep neural network security situation prediction model is based on a combination of sample convolution and interaction units (SCI-Blocks). By combining multiple SCI-Blocks in a binary tree structure, SCINet can effectively model and predict time series data. After L layers of SCI-Block processing, all subsequences are subjected to inverted parity segmentation and residual linking to form a new sequence representation that captures and expresses both local and global temporal relationships in the original time series data. The Temporal Convolutional Network (TCN), commonly used for time series data prediction, requires T*log2T operations, while the neural network architecture based on sample convolution and interaction requires L*2T operations, where T is the size of the look-back window parameter and L is the number of SCI-Block layers. The deep neural network security situation prediction model based on the sample convolution and interaction module stacks multiple neural networks based on sample convolution and interaction to form a single deep neural network based on sample convolution and interaction, further improving the model's prediction accuracy.

[0091] In one embodiment of the present application, the training of a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series dataset includes:

[0092] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0093] In one embodiment of the present application, during the SCInet training process, relay supervision technology is used to optimize network training, using true values ​​as supervisory signals to help the model better learn intermediate time series features, thereby improving the model's prediction accuracy. The training uses the mean squared error (MSE) as the loss function. The loss function for the kth layer can be expressed as the following formula:

[0094]

[0095] in, represents the output of the k-th layer network at time step i, x i represents the true value, and τ represents the length of the time series data.

[0096] The loss function of the entire model can be expressed as the following formula:

[0097]

[0098] S211: Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction result.

[0099] In an embodiment of the present application, the current situation data to be predicted, that is, the data processed in sequence by the situation element extraction module and the situation assessment module, is input into the trained deep neural network security situation prediction model to obtain the network situation prediction result, that is, the future prediction result.

[0100] In the above-mentioned network security situation awareness method based on deep neural network, first, a network security data set is obtained and preprocessed to obtain an initial data set; then, a situation factor extraction model is constructed based on a gated recurrent unit and a variational autoencoder, and the initial data set is input into the situation factor extraction model to obtain network security attack factors; then, a Bi-LSTM model is used to extract features based on the network security attack factors, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; then, a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function are used to construct a network security situation assessment model, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; then, a multidimensional time series data set is constructed based on the network security attack factors and the situation assessment results, and a deep neural network security situation prediction model based on a sample convolution and interaction module is trained based on the multidimensional time series data set; finally, the current situation data is input into the trained deep neural network security situation prediction model, and a network situation prediction result is output.

[0101] Specifically, a method based on gated recurrent units and variational autoencoders is proposed for situational factor extraction. The model is trained using only normal data. Anomalous factors are determined by reconstructing the data using a variational autoencoder and calculating the reconstruction probability to determine whether the factor is abnormal. Gated recurrent units are also used to improve the encoder-decoder network of the variational autoencoder, enabling faster model convergence and reducing resource consumption. Finally, a single-model ensemble strategy with random weight averaging is used throughout the model training process to optimize model training, improving the robustness and generalization capabilities of the situational factor extraction model and preventing adversarial attacks. Secondly, a Bi-LSTM model is proposed to extract features for different situational factors. Bidirectional data processing is used to more comprehensively capture information in the data. Feature fusion techniques based on an attention mechanism are then used to obtain fused features. This further derives more critical and meaningful features for cybersecurity situation assessment, thereby more accurately reflecting the actual operation and risks faced by cyberspace and providing corresponding situation assessment values. In addition, a deep neural network model was built using sample convolution and interaction units, and the situation awareness and situation prediction task was modeled as a multi-dimensional time series prediction problem. The situation factor prediction and situation value for a period of time in the future were given based on the input situation factor data and situation assessment result data for a period of time. This solved the problems existing in the existing situation awareness and prediction technology based on deep neural networks, such as the inability to perform parallel calculations, the possibility of gradient disappearance or gradient explosion when modeling long sequences, and the easy loss of information in some models during the modeling process. This improved the accuracy of network security situation awareness assessment and prediction.

[0102] The following is a specific example to illustrate the specific implementation steps of the network security situation awareness method based on deep neural network of this application. Figure 6 As shown, first, S401, a network security dataset is acquired and preprocessed to obtain an initial dataset. Then, S403, a situation factor extraction model is constructed based on a gated recurrent unit and a variational autoencoder, and the initial dataset is input into the situation factor extraction model to obtain network security attack factors. S405, an integration strategy of random weight averaging is used to optimize the training process of the situation factor extraction model, and stochastic gradient variational Bayes is used as the training loss function. S407, the situation factor extraction model outputs an anomaly score, and the network security attack factors are determined based on the anomaly score and a preset anomaly threshold.

[0103] Next, in step S409, a Bi-LSTM model is used to extract features based on the cybersecurity attack factors, and a concat feature fusion method based on the attention mechanism is used to fuse feature-level data to obtain a fused feature vector. Specifically, in steps S411-S413, concatenate the feature vectors using concat, and then perform an operation on the concatenated feature vector and the attention matrix to obtain an attention score. An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0104] Then, in step S415, a network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result. In step S417, a situation value is calculated based on the probability of the situation category.

[0105] Afterwards, S419, a multidimensional time series data set is formed based on the network security attack elements and situation assessment results, and a deep neural network security situation prediction model based on the sample convolution and interaction module is trained based on the multidimensional time series data set. S421, the deep neural network security situation prediction model based on the sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units. S423, the training of the network is optimized using relay supervision technology, using the true value as the supervision signal, and using the mean square error MSE as the loss function of the training. Finally, S425, the current situation data is input into the trained deep neural network security situation prediction model, and the network situation prediction result is output.

[0106] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0107] Based on the same inventive concept, the embodiments of the present application also provide a deep neural network-based network security situation awareness device for implementing the aforementioned deep neural network-based network security situation awareness method. The implementation solution provided by the device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations of one or more embodiments of the deep neural network-based network security situation awareness device provided below can be found in the above-mentioned limitations of the deep neural network-based network security situation awareness method, and will not be repeated here.

[0108] In one embodiment, Figure 7 As shown, a network security situation awareness device 700 based on a deep neural network is provided, comprising: a data acquisition module 701, a situation factor extraction module 703, a feature fusion module 705, a situation assessment module 707, a feature fusion module 709 and a situation assessment module 711, wherein:

[0109] The data acquisition module 701 is used to acquire and pre-process a network security data set to obtain an initial data set.

[0110] The situation factor extraction module 703 is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors.

[0111] The feature fusion module 705 is used to extract features based on the network security attack elements using the Bi-LSTM model, and to perform feature-level data fusion using the concat feature fusion method based on the attention mechanism to obtain a fused feature vector.

[0112] The situation assessment module 707 is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result.

[0113] The situation prediction model training module 709 is used to form a multidimensional time series data set based on the network security attack elements and situation assessment results, and to train a deep neural network security situation prediction model based on the sample convolution and interaction module based on the multidimensional time series data set.

[0114] The network security situation awareness module 711 is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction result.

[0115] In one embodiment of the present application, the situation factor extraction module is further configured to:

[0116] The training process of the situation factor extraction model is optimized using an integration strategy of random weight averaging, and stochastic gradient variational Bayes is adopted as the loss function of the training.

[0117] In one embodiment of the present application, the situation factor extraction module is further configured to:

[0118] The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold.

[0119] In one embodiment of the present application, the feature fusion module is further configured to:

[0120] Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain the attention score;

[0121] An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

[0122] In one embodiment of the present application, the situation assessment module is further configured to:

[0123] The situation value is calculated based on the probability of belonging to the situation category.

[0124] In one embodiment of the present application, the deep neural network security situation prediction model based on sample convolution and interaction module is composed of a plurality of neural network stacks based on sample convolution and interaction units.

[0125] In one embodiment of the present application, the situation prediction model training module is further used to:

[0126] Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

[0127] Each module in the aforementioned deep neural network-based network security situational awareness device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device's memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0128] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a network security situation awareness method based on a deep neural network is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0129] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0130] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0132] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0134] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0135] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0136] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A network security situation awareness method based on deep neural network, characterized in that: The method comprises: Obtain a network security dataset and preprocess it to obtain an initial dataset; Constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, inputting the initial data set into the situation factor extraction model to obtain network security attack factors; Based on the network security attack factors, a Bi-LSTM model is used to extract features, and a concat feature fusion method based on an attention mechanism is used to perform feature-level data fusion to obtain a fused feature vector; A network security situation assessment model is constructed using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, and the fused feature vector is input into the network security situation assessment model to obtain a situation assessment result; Based on the network security attack factors and situation assessment results, a multidimensional time series data set is formed, and based on the multidimensional time series data set, a deep neural network security situation prediction model based on sample convolution and interaction modules is trained; Input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results; Inputting the initial data set into the situation factor extraction model to obtain network security attack factors includes: The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold; The feature-level data fusion method using the concat feature fusion method based on the attention mechanism includes: Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain the attention score; An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

2. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The method of constructing a situation factor extraction model based on a gated recurrent unit and a variational autoencoder includes: The training process of the situation factor extraction model is optimized using an integration strategy of random weight averaging, and stochastic gradient variational Bayes is adopted as the loss function of the training.

3. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: Inputting the fused feature vector into the network security situation assessment model to obtain a situation assessment result further comprises: The situation value is calculated based on the probability of belonging to the situation category.

4. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The deep neural network security situation prediction model based on sample convolution and interaction modules is composed of a plurality of neural network stacks based on sample convolution and interaction units.

5. The network security situation awareness method based on deep neural network according to claim 1 is characterized in that: The deep neural network security situation prediction model based on the sample convolution and interaction module trained based on the multi-dimensional time series data set includes: Relay supervision technology is used to optimize network training, using true values ​​as supervision signals and mean square error (MSE) as the loss function for training.

6. A network security situation awareness device based on deep neural network, characterized in that: The device comprises: A data acquisition module is used to acquire and preprocess the network security data set to obtain an initial data set; A situation factor extraction module is used to construct a situation factor extraction model based on a gated recurrent unit and a variational autoencoder, input the initial data set into the situation factor extraction model, and obtain network security attack factors; A feature fusion module is used to extract features based on the network security attack elements using a Bi-LSTM model, and to fuse feature-level data using a concat feature fusion method based on an attention mechanism to obtain a fused feature vector; A situation assessment module is used to construct a network security situation assessment model using a one-dimensional convolutional neural network, a batch normalization layer, and a ReLU function, input the fused feature vector into the network security situation assessment model, and obtain a situation assessment result; A situation prediction model training module is used to form a multidimensional time series data set based on the network security attack factors and situation assessment results, and to train a deep neural network security situation prediction model based on a sample convolution and interaction module based on the multidimensional time series data set; The network security situation awareness module is used to input the current situation data into the trained deep neural network security situation prediction model and output the network situation prediction results; Inputting the initial data set into the situation factor extraction model to obtain network security attack factors includes: The situation factor extraction model outputs an anomaly score, and a network security attack factor is determined based on the anomaly score and a preset anomaly threshold; The feature-level data fusion method using the concat feature fusion method based on the attention mechanism includes: Use concat to concatenate feature vectors, and perform operations on the concatenated feature vectors and the attention matrix to obtain the attention score; An attention weight is determined based on the attention score, and a weighted sum is performed based on the attention weight and the concatenated feature vector to obtain a fused feature vector.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images