Network security situation assessment method based on ACDAE-ResBiGRU

Abstract

The invention discloses a network security situation assessment method based on ACDAE-ResBiGRU, which belongs to the technical field of network security, and comprises the following steps: S1, data preprocessing: performing type conversion, one-hot coding and normalization processing on non-numerical columns in data, and then performing oversampling processing on a plurality of samples; s2, data reconstruction: constructing a convolutional noise reduction auto-encoder to obtain reconstructed data; s3, situation element extraction: constructing a situation element extraction module, and inputting the reconstruction data in the S2 into the situation element extraction module; and S4, situation value calculation and evaluation: calculating a network security situation value, and finally performing network security situation evaluation. According to the network security situation assessment method based on the ACDAE-ResBiGRU, spatial features of different attack types are efficiently and accurately extracted through the improved ACDAE, the problem of key feature loss during data reconstruction is effectively reduced, the ResBiGRU of a residual structure is adopted, the problem of important information loss of situation data is effectively relieved, the classification accuracy is improved, and the network security situation assessment efficiency is improved. And the situation assessment precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security situation assessment method based on ACDAE-ResBiGRU. Background Art

[0002] Network security situation assessment (NSSA) builds appropriate models through relevant security events, provides innovative perspectives for network behavior, helps with macro-understanding and intention identification, and provides strong support for network security decision-making. With the development of artificial intelligence, applying machine learning and deep learning to network security situation assessment has become a key research direction for experts and scholars.

[0003] Based on fuzzy theory, FAN et al. combined cognitive maps with hierarchical analysis to evaluate and quantify the level of network security situation and determine the situation status according to the situation value. Doynikova et al. used the CVSS scoring system to comprehensively evaluate network characteristics, attack characteristics, countermeasures and other indicators, analyzed the network security information status, and improved the accuracy and efficiency to a certain extent. Lin et al. proposed a network security situation assessment method based on the combination of Bayesian and attack graphs, and used advanced big data technology to integrate network security situation factors to infer the attacker's subsequent attack behavior. Li et al. used DS evidence theory to integrate the probability values ​​obtained by processing data from many models to analyze network security. ALALI et al. applied the idea of ​​fuzzy reasoning to network security situation assessment, and assessed the network security situation from four perspectives: vulnerability, threat, possibility and impact.

[0004] However, network security situation assessment methods based on mathematical statistics and knowledge reasoning are too dependent on prior knowledge or expert experience and are greatly influenced by human factors. Although the assessment accuracy is high, such methods require certain prior knowledge and involve a large amount of mathematical calculations and logical reasoning, are inefficient, and lack reasonable quantitative standards.

[0005] In recent years, some researchers have tried to improve deep learning networks using attention mechanisms and residual structures to improve the performance of security detection. However, the current network security situation assessment methods still have shortcomings in terms of the lack of representativeness of the selected features of the data set, feature extraction, model construction, etc. Therefore, in order to effectively and comprehensively assess the network security situation, it is necessary to propose a network security situation assessment method based on a denoising autoencoder model and a bidirectional gated recurrent unit. Summary of the invention

[0006] The purpose of the present invention is to provide a network security situation assessment method based on ACDAE-ResBiGRU to solve the problems in the above-mentioned background technology that the selected features of the data set are not representative and the accuracy of network attack classification is not high.

[0007] To achieve the above object, the present invention provides a network security situation assessment method based on ACDAE-ResBiGRU, which integrates a bidirectional gated recurrent unit (BiGRU) and an ACDAE-ResBiGRU based on a self-attention mechanism-improved convolutional denoising autoencoder (ACDAE), and includes the following steps: S1. Data preprocessing: convert the non-numeric columns in the data, perform one-hot encoding, and then perform normalization. This can help with the processing of sparse matrices in classification, reduce the inconsistency of the impact of different features on the model, and finally perform oversampling on a small number of samples to balance the category distribution, thereby improving model performance. S2, data reconstruction, building a convolutional denoising autoencoder, including an encoder module (mainly composed of convolutional layers, maximum pooling layers, and activation layers) and a decoder module with an ECA channel self-attention mechanism (mainly composed of convolutional layers, upsampling, activation layers, and ECA layers). Noise is added to the data processed by S1, encoded by the encoder module, and then decoded by the decoder module to obtain reconstructed data; S3, situation factor extraction, build a situation factor extraction module, and input the reconstructed data in S2 into the situation factor extraction module. On the one hand, BiGRU can be used to extract time features. Since the encoder contains multiple one-dimensional convolution modules, it can only extract data spatial features, thereby realizing the extraction of features in spatial and temporal dimensions; on the other hand, adding a residual structure can better retain situation information and alleviate the problem of situation information loss in the double-layer BiGRU. Finally, the classification result is output through the fully connected layer; S4: Calculate and evaluate the situation value, identify and classify attacks, calculate the network security situation value, and finally evaluate the network security situation.

[0008] Preferably, the data reconstruction in S2 is specifically as follows: In order to extract features more effectively, based on the denoising autoencoder, a convolutional denoising autoencoder (ACDAE) with the ECA channel attention mechanism is proposed, which can better capture key features and improve the effects of denoising and encoding. The encoder module and the decoder module have three 1D convolutional layers, including: S21. The preprocessed data set Adding noise to generate a corrupted dataset Input convolutional denoising autoencoder, where The generation formula is as follows: ; in, is the original input data; is the data after adding noise; is Gaussian noise with a mean of 0 and a variance of ; S22, perform noise processing, output denoised traffic attack, use convolution layer to extract features, and use maximum pooling layer for downsampling. In this encoding task, the noise is suppressed while retaining the underlying structure. The calculation formula is: ; in, ReLU is the activation function; represents a one-dimensional convolution operation, is the convolution weight, is bias; It is a pooling operation, and step represents the step length; Indicates the internal coding module function, and the superscript 3 indicates that the above function operation is performed three times; Represents the function output of the last layer of the encoding part; S23, the decoder module performs convolution and upsampling to decode the compressed traffic attack. The ECA module can effectively update the retrieved features through cross-channel interaction, so that the network can pay more attention to the feature channels of relevant information; then reconstruct the output through 1D convolution and ECA modules , the calculation formula is: ; in, For the upsampling operation, Indicates the upsampling size; ECA Represents the ECA channel attention mechanism; represents the activation function; It indicates the internal decoding module function, and the superscript 3 indicates that the function operation is performed three times; Represents the function output of the last layer of the decoding part; Represents the reconstructed output after decoding.

[0009] Preferably, the situation element extraction module in S3 is a ResBiGRU module, specifically: in order to effectively alleviate the problem of important information loss caused by BiGRU in the process of situation information transmission, the residual connection idea of ​​ResNet is borrowed to bypass the BiGRU layer and directly pass part of the input situation data to the layer after the output of the BiGRU layer, realizing the residual structure; in this way, the constructed ResBiGRU module can learn residual information during information transmission, thereby effectively reducing the loss of key situation data, thereby improving the accuracy of situation assessment; wherein, the input data is transmitted between the two-layer BiGRU, and the two-layer BiGRU helps to fully extract the time features; the output of the ResBiGRU module is linearly transformed through a fully connected layer. In the BiGRU layer, due to its gating mechanism, the problem of important information loss will become more prominent as the number of layers increases. To solve this problem, a residual connection is added between the ResBiGRU module and the fully connected layer to retain and transmit the original situation information. Specifically, the input data is assigned to a variable, and after adding it to the ResBiGRU output, the ReLU activation function is used for nonlinear transformation, specifically: S31. Input data Input data First enter the first layer of BiGRU to generate the intermediate hidden state , the formula is: ; S32, the output of the first layer BiGRU Passed to the second layer BiGRU, the formula is: ; S33, the original input data Directly with the output of the second layer BiGRU Add together to form a residual connection, the formula is as follows: ; S34, the result of connecting the residual After the ReLU activation function, the nonlinear transformation is performed, and the formula is: ; S35, As the input of the fully connected layer, it is used for linear transformation of the fully connected layer and obtains the classification result.

[0010] The above method uses the original input information as a supplement to the BiGRU output, and the two are added to generate the final output of the module, thereby effectively alleviating the problem of important information loss in the BiGRU layer in the transmission of situation information.

[0011] Preferably, the situation value calculation and evaluation in S4 includes attack severity quantification, attack impact value quantification, network security situation calculation and network security situation evaluation, which are used to fully grasp the network security status and respond to potential threats in a timely manner.

[0012] Preferably, the attack severity quantification is specifically as follows: Combining the weight coefficient generation theory and attack severity level to calculate the attack severity operator of different attack types, the nine attacks are divided into six attack severity levels from low to high. The calculation formula is as follows: ; in, Indicates Attack severity operator for each attack type; Indicates Attack severity level of each attack type; The degree of harm and prevalence of each attack type, as well as their impact on system and network security, are considered. The nine attack types are divided into six levels, including the highest level attack, high level attack, medium level attack, lower level attack, low level attack, and lowest level attack.

[0013] Highest level attacks: Exploits and Worms have a very high degree of harm and can directly lead to system intrusion or control, and may cause serious damage and data leakage to the entire network.

[0014] High-level attacks: Backdoors are usually used to install backdoor programs in the system, which can allow attackers to remotely access the system or application without authorization, so the degree of harm is relatively high.

[0015] Medium-level attacks: Dos attacks will not directly lead to system intrusion, but they can cause service interruption and have a serious impact on business and users. Shellcode attacks usually mean that the system has been invaded or attacked, so they are harmful to a certain extent.

[0016] Lower-level attacks: Reconnaissance attacks are used to gain information about target systems and networks to facilitate subsequent attacks. While they do not directly cause damage themselves, they provide attackers with an opportunity to gain insight into their targets.

[0017] Low-level attacks: Fuzzers are used to discover vulnerabilities in applications or systems, but do not attack directly. Analysis is used to analyze malware samples or attack behaviors to understand the attacker's behavior and purpose. They are low-level in harm, but still help strengthen defense measures.

[0018] Lowest level attack: Generic attacks are usually general threats or attack activities, which may involve unspecified attack methods or targets, and are usually general threats to network security. They are the least harmful, but still require vigilance; According to the attack severity operator, the attack severity is obtained , calculated as follows: ; in, Indicates the number of occurrences of different attack types.

[0019] Preferably, the attack impact value is quantified as follows: According to the latest common vulnerability scoring system (CVSS), the impact of network traffic data on confidentiality, integrity and availability is assessed, and then the attack impact values ​​of confidentiality (C), integrity (I) and availability (A) are graded and calculated as follows: ; in, , , are the normalized weights of C, I, and A respectively; , , They are the attack impact values ​​of C, I, and A for each attack type respectively.

[0020] Preferably, the network security situation value is calculated as follows: ; in, for the severity of the attack; It is the attack impact value.

[0021] Preferably, the calculated network security situation value is mapped to , and divide it into five levels: ultra-high risk, high risk, medium risk, low risk and safe: ; in ， Indicates the normalized network security situation value; and Respectively represent the maximum and minimum values ​​of the mapping interval; and Respectively represent the maximum and minimum values ​​of the network security situation value; Indicates the current network security status value.

[0022] Therefore, the present invention adopts the above-mentioned network security situation assessment method based on ACDAE-ResBiGRU, which has the following beneficial effects: (1) By combining the Convolutional Denoising Autoencoder (CDAE) and the Residual Bidirectional Gated Recurrent Unit (ResBiGRU) model, the shortcomings of traditional network security situation assessment methods in terms of feature representativeness and classification accuracy are solved; (2) The feature extraction capability is enhanced by introducing convolutional layers in the denoising autoencoder, aiming to more effectively capture spatial features and thus improve the accuracy of data reconstruction. At the same time, in order to reduce the loss of key features during the data reconstruction process, the channel attention mechanism (Efficient Channel Attention, ECA) is used to optimize the performance of the decoder; (3) In the situation factor extraction stage, residual connections are introduced to improve the traditional bidirectional gated recurrent unit (BiGRU) and a residual BiGRU module (ResBiGRU) is constructed. This can effectively alleviate the problem of situation information being lost during the transmission process and ensure the retention of important information, thereby improving the classification accuracy and the accuracy of situation prediction. This method not only provides an efficient solution for network security situation assessment, but also provides a valuable reference for future network security research. Future work can further explore the applicability and scalability of this method in different network environments and attack modes to cope with more complex and diverse network security threats.

[0023] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a network security situation assessment method based on ACDAE-ResBiGRU of the present invention; Figure 2 This is a schematic diagram of the structure of the ACDAE module of the present invention; Figure 3 Schematic diagram of the ResBiGRU module structure of the present invention; Figure 4 This is a schematic diagram of situation value calculation and evaluation of the present invention; Figure 5 This is a schematic diagram of the training loss function of the present invention; Figure 6 A schematic diagram for comparing experimental results of an embodiment of the present invention; Figure 7 A schematic diagram of a confusion matrix according to an embodiment of the present invention; Figure 8 Schematic diagram of comparison of multi-classification confusion matrices of embodiments of the present invention, wherein (a) is a support vector machine, (b) is a random forest, (c) is a convolutional neural network, (d) is a bidirectional gated recurrent unit, and (e) is a convolutional denoising autoencoder that combines a residual bidirectional gated recurrent unit and an improved attention mechanism. Fig. 9 This is a schematic diagram comparing 15 groups of experimental network security situation values ​​according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] Example In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0026] like Figure 1-Figure 4 As shown, a network security situation assessment method based on ACDAE-ResBiGRU includes the following steps: S1. Data preprocessing: convert the non-numeric columns in the data, perform one-hot encoding, and then perform normalization. This can help with the processing of sparse matrices in classification, reduce the inconsistency of the impact of different features on the model, and finally perform oversampling on a small number of samples to balance the category distribution, thereby improving model performance. S2, data reconstruction, building a convolutional denoising autoencoder, including an encoder module (mainly composed of convolutional layers, maximum pooling layers, and activation layers) and a decoder module with an ECA channel self-attention mechanism (mainly composed of convolutional layers, upsampling, activation layers, and ECA layers). Noise is added to the data processed by S1, encoded by the encoder module, and then decoded by the decoder module to obtain reconstructed data; S3, situation factor extraction, build a situation factor extraction module, and input the reconstructed data in S2 into the situation factor extraction module. On the one hand, BiGRU can be used to extract time features. Since the encoder contains multiple one-dimensional convolution modules, it can only extract data spatial features, thereby realizing the extraction of features in spatial and temporal dimensions; on the other hand, adding a residual structure can better retain situation information and alleviate the problem of situation information loss in the double-layer BiGRU. Finally, the classification result is output through the fully connected layer; S4, situation value calculation and evaluation, including Attack severity quantification: Combining the weight coefficient generation theory and attack severity level to calculate the attack severity operator of various attack types, the nine attack types are divided into 6 levels, including the highest level attack, high level attack, medium level attack, lower level attack, low level attack, and lowest level attack, as shown in Table 1: Table 1 Attack severity levels and attack severity operators for nine attack types ;

[0027] According to the severity operator, the attack severity can be obtained.

[0028] Quantification of attack impact value: According to the latest common vulnerability scoring system, the network traffic data is evaluated for the impact of these three main aspects, including C, I, and A, and the attack impact of C, I, and A is further graded, as shown in Table 2: Table 2 C, I, A impact values ;

[0029] Network security posture calculation.

[0030] Network security situation assessment: Based on the characteristics of various network threats and attacks, the security situation assessment level is mapped to the interval 0 to 1, and divided into five situation level intervals: ultra-high risk, high risk, medium risk, low risk and safe. The specific level division is shown in Table 3: Table 3 Network security situation assessment levels ;

[0031] In this embodiment, this method is verified by experiments, and the experimental environment is set as shown in Table 4: Table 4 Experimental environment ;

[0032] The test data set uses the UNSW-NB15 data set, as shown in Table 5: Table 5 UNSW-NB15 dataset categories and numbers ;

[0033] Data preprocessing One-hot encoding: The UNSW-NB15 dataset has categorical features, so the categorical features need to be converted into numerical values ​​to give good prediction results. Therefore, in the preprocessing part, the get-dummies function of the pandas library in python is used to convert these non-numeric columns into numerical values. Since the label encoder will produce multiple numbers in the same column, one-hot encoding is chosen instead of the label encoder.

[0034] Normalization: In this process, in order to eliminate the impact of the large range difference between the maximum and minimum values ​​of some features on the model, numerical normalization is used to make the features fall into the same range, which can be expressed as: ; in, represents the original value of the feature, represents the minimum characteristic value, Indicates the maximum value of a feature.

[0035] Oversampling: Random oversampling randomly copies data points from the minority class, which reduces the imbalance of the data and improves the prediction accuracy of the minority class. The UNSW NB15 dataset has extremely low number of records for categories such as Worms and Fuzzers. To address this issue, oversampling technique is used in the training set to ensure that each attack class has a considerable number of records. In the UNSW NB15 dataset, the number of samples of the minority class Worms is 173, which is relatively small compared to the total number of samples of 257,673. This imbalance reduces the prediction accuracy of the minority class. The random oversampling technique significantly improves the accuracy and detection rate of the Worms class.

[0036] Evaluation indicators It is very important to select appropriate evaluation indicators. In order to accurately identify various types of attacks faced by the network and improve the accuracy of network security situation assessment, this embodiment uses accuracy, precision, recall and F-score as evaluation indicators. The specific calculation formula is as follows: Accuracy refers to the ratio of the number of samples correctly classified by the classifier to the total number of samples. Accuracy can be used as an overall evaluation indicator, reflecting the classification performance of the classifier for all categories. It can be expressed as: ; Precision refers to the proportion of samples that are actually positive among the samples predicted by the classifier as positive. Precision can help evaluate the false positives in the prediction results of the classifier, that is, the classifier mistakenly predicts samples that are actually negative as positive. It can be expressed as: ; Recall rate refers to the proportion of samples that are actually positive examples that are correctly predicted as positive examples by the classifier. In the industrial Internet data set, recall rate can help evaluate the classifier's ability to identify positive samples, that is, whether the classifier can correctly predict all true positive examples. It can be expressed as: ; The F value is the harmonic mean of precision and recall, which comprehensively considers the accuracy and recall of the classifier. The F value can be used as a comprehensive performance evaluation indicator, balancing the accuracy and comprehensiveness of the classifier, and can be expressed as: ; Among them, TP (True Positive) represents the number of normal samples correctly identified, TN (True Negative) represents the number of abnormal samples correctly identified, FP (False Positive) represents the number of normal samples incorrectly identified, and FN (False Negative) represents the number of abnormal samples incorrectly identified.

[0037] In order to effectively classify network traffic data attacks, this embodiment uses the denoising autoencoder improved by integrating the attention mechanism and the bidirectional gated recurrent unit model improved by the residual network structure for training. The model training loss function is shown in the figure below: Figure 5 shown.

[0038] Depend on Figure 5 It can be observed that as the number of training times gradually increases, the training loss rate of the model continues to decrease. This fully demonstrates that after multiple rounds of training iterations, the prediction error of the model gradually decreases, and the model's ability to fit the data gradually increases. In particular, when the number of training times approaches 40, the loss rate of the model drops to a low level of about 0.1. More importantly, in subsequent training, the loss rate did not rebound or fluctuate significantly, but remained in this low range. Such curve changes not only confirm the stability and robustness of the model, but also show that the model has reached a fairly high level of fitting optimization after a series of training.

[0039] The model performs very well in multi-category classification tasks, especially in some categories (such as Generic, Normal, Shellcode, and Reconnaissance), the model achieves almost perfect classification performance. However, for some categories (such as Analysis, Backdoor, and DoS), although the performance is still good, there is still room for improvement. Overall, the model is very effective and accurate in distinguishing different categories of the dataset.

[0040] Comparative experiment The SVM model, RandomForest model, CNN model and BiGRU are used as comparisons with the model of this embodiment. The default network parameters of the five models are set the same, and the training set and test set provided by the UNSW-NB15 dataset are used for training and testing. The accuracy, precision, The value result comparison is Figure 6As shown, it can be seen that the accuracy, precision, The values ​​are better than the other four models, among which the accuracy is 4.56 higher than BiGRU, which has a larger improvement; the precision is 3.88 higher than BiGRU. The model of this embodiment achieved a high accuracy of 83.40% and a high precision of 84.77%. In addition, the F value of this article is also significantly better than the other four models, indicating that the method is effective. In order to further verify the effectiveness of the method of this embodiment, the overall confusion matrix of multi-classification detection is first displayed. It can be seen that the overall accuracy is high, such as Figure 7 Then, a set of network traffic attack data is randomly selected, as shown in Table 6, showing seven attack categories and corresponding quantities. In addition, this embodiment uses five sets of confusion matrices to intuitively show the predicted and actual values, as shown in Table 6. Figure 8 As shown in Figure 2, it can be seen that the predictions of various attack types by the proposed method are basically consistent.

[0041] Table 6 Network traffic attack data ;

[0042] From the comparison of the five sets of confusion matrices, it can be seen that both SVM and RandomForest predict Normal as Exploit. Normal is the normal type, and Exploit is the highest level attack type. The severity of these two attacks is quite different, which will lead to a large deviation in the situation value and affect the situation assessment effect. Although CNN and BiGRU avoid the above problems, the precision of Exploit is not high, and there are two or three types of attack prediction errors, which will also affect the situation assessment effect to a certain extent. The method in this paper has only one prediction error, predicting Fuzzers as Generic. Since the severity of the attacks of both are relatively low and the attack impact factors are not much different, the final situation value will not be too different, and the network security situation can be reasonably evaluated.

[0043] Next, this embodiment randomly extracts 200 groups of test data with the same number of items from the test set, and uses SVM, RandomForest, CNN, BiGRU and the model of this method for threat detection respectively. The network security situation value is calculated and compared using the attack severity operator and the attack impact value. It can be found that the situation value calculated by the model of this embodiment is closest to the real situation value. Fig. 9 The figure shows the comparison of network situation values ​​of 15 groups of experiments.

[0044] Depend on Fig. 9 It can be seen that although the network security situation value calculated by each model is close to the actual value, the situation evaluated by the method of this embodiment is more consistent with the actual situation. Fig. 9A detailed analysis revealed: (1) The network security situation value obtained by this model and the real situation value are always in the same situation assessment range, and the error is minimal. In most groups, the situation assessment results of the five models are the same as the real situation assessment results, but the situation values ​​of this model are closer to the real situation values.

[0045] (2) The situation assessment results of the four models based on SVM, RandomForest, CNN, and BiGRU are different from the actual situation results. For example, in Group 1, the assessment results of the SVM and RandomForest models are high risk, while the situation of this model and the actual situation are both medium risk; in Group 5, the assessment result of the SVM model is high risk, while the situation of this model and the actual situation are both medium risk; in Group 10, the assessment results of the SVM, RandomForest, CNN, and BiGRU models are all ultra-high risk, while the situation of this model and the actual situation are both high risk.

[0046] In addition, this embodiment analyzes and compares the root mean square error calculation results of the five models of SVM, RandomForest, CNN and BiGRU on the test set, and lists the MSE indicators of each model in detail, as shown in Table 7. Among them, the MSE of the model proposed in this embodiment is the lowest, reaching 0.111, which is significantly better than other models, especially compared with the traditional SVM and RandomForest models, the performance is significantly improved. Compared with CNN and BiGRU, there are also obvious advantages. This result illustrates the powerful ability of this method in handling network security tasks and shows its superior performance in network security situation value assessment.

[0047] Table 7 Root mean square error calculation results ;

[0048] According to the above analysis, the situation value obtained by this method can basically reflect the real situation value result. It is more accurate and reliable than other methods and has the lowest mean square error. This fully demonstrates that this model can effectively evaluate the network security situation.

[0049] Ablation experiment In order to quantitatively evaluate the effectiveness of the ACDAE-ResBiGRU integrated model proposed in this embodiment, an ablation experiment was performed on the balanced dataset, as shown in Table 8.

[0050] Table 8 Ablation experiment results ;

[0051] In the experiment, when replacing or removing ACDAE, ECA, ResBiGRU, and ResNet, the parameters of all replaced models were kept unchanged. The model of this embodiment performs well in feature extraction and recognition classification. Compared with the BiGRU model, the detection accuracy of the ACDAE-BiGRU model has been greatly improved, which verifies the effectiveness of the ACDAE module. In addition, when our model incorporates the ECA attention mechanism on the basis of integrating CDAE-ResBiGRU, it weights the importance of different types of attack traffic, thereby increasing the multi-classification accuracy by 1.28%, further proving the rationality of the attention mechanism. By comparing BiGRU and ResBiGRU, as well as ACDAE-BiGRU and this method, it was found that the accuracy of adding Resnet increased by 1.5% and 1.94% respectively, indicating that the effect of adding Resnet is significant. In summary, the model of this embodiment is more suitable for the task of network security situation assessment.

[0052] Therefore, the present invention adopts the above-mentioned ACDAE-ResBiGRU-based network security situation assessment method, and efficiently and accurately extracts the spatial features of different attack types by adding the improved convolutional denoising automatic encoder with channel attention mechanism, and effectively reduces the problem of key feature loss when reconstructing data. Then, the BiGRU network (ResBiGRU) with residual structure improvement is adopted, and then the improved network model is used to extract network security situation elements, which effectively alleviates the problem of loss of important information in situation data, improves classification accuracy, and thus improves the accuracy of situation assessment. Finally, the quantitative value of network security situation is calculated according to the network security situation assessment result.

[0053] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A network security situation assessment method based on ACDAE-ResBiGRU, characterized in that: The following steps are involved: S1. Data preprocessing: convert the non-numeric columns in the data, perform unique-hot encoding and normalization, and then oversample several samples to balance the category distribution; S2, data reconstruction, building a convolutional denoising autoencoder, including an encoder module and a decoder module with an ECA channel self-attention mechanism, adding noise to the data processed by S1, encoding it through the encoder module, and then decoding it through the decoder module to obtain reconstructed data; S3, situation factor extraction, constructing a situation factor extraction module, and inputting the reconstructed data in S2 into the situation factor extraction module; S4: Calculate and evaluate the situation value, identify and classify attacks, calculate the network security situation value, and finally evaluate the network security situation.

2. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 1 is characterized in that: The data reconstruction in S2 is as follows: S21. The preprocessed data set Adding noise to generate a corrupted dataset Input convolutional denoising autoencoder, where The generation formula is as follows: ； in, is the original input data; is the data after adding noise; is Gaussian noise with a mean of 0 and a variance of ; S22, perform noise processing, output denoised traffic attack, use the convolution layer of the convolutional denoising autoencoder to extract features, and use the maximum pooling layer of the convolutional denoising autoencoder for downsampling. The calculation formula is: ； in, ReLU is the activation function; represents a one-dimensional convolution operation, is the convolution weight, is bias; It is a pooling operation, and step represents the step length; Indicates the internal coding module function, and the superscript 3 indicates that the function operation is performed three times; Represents the function output of the last layer of the encoding part; S23, the decoder module performs convolution and upsampling to decode the compressed traffic attack. The calculation formula is: ； in, For the upsampling operation, Indicates the upsampling size; ECA Represents the ECA channel attention mechanism; represents the activation function; It indicates the internal decoding module function, and the superscript 3 indicates that the function operation is performed three times; Represents the function output of the last layer of the decoding part; Represents the reconstructed output after decoding.

3. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 1 is characterized in that: The situation factor extraction module in S3 is a ResBiGRU module, which includes a double-layer BiGRU layer. The output of the ResBiGRU module is linearly transformed through a fully connected layer, and a residual connection is added between the ResBiGRU module and the fully connected layer, specifically: S31. Input data Input data First enter the first layer of BiGRU to generate the intermediate hidden state , the formula is: ； S32, the output of the first layer BiGRU Passed to the second layer BiGRU, the formula is: ； S33, the original input data Directly with the output of the second layer BiGRU Add together to form a residual connection, the formula is as follows: ； S34, the result of connecting the residual After the ReLU activation function, the nonlinear transformation is performed, and the formula is: ； S35, As the input of the fully connected layer, it is used for linear transformation of the fully connected layer and obtains the classification result.

4. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 1 is characterized in that: The situation value calculation and evaluation in S4 includes attack severity quantification, attack impact value quantification, network security situation calculation and network security situation evaluation.

5. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 4 is characterized in that: The attack severity quantification is as follows: Combining the weight coefficient generation theory and attack severity level, the attack severity operator of different attack types is calculated. The calculation formula is as follows: ； in, Indicates Attack severity operator for each attack type; Indicates Attack severity level of each attack type; According to the attack severity operator, the attack severity is obtained , calculated as follows: ； in, Indicates the number of occurrences of different attack types.

6. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 5 is characterized in that: The attack impact value is quantified as follows: According to the Common Vulnerability Scoring System, the impact of network traffic data on confidentiality, integrity and availability is assessed, and then the attack impact values ​​of confidentiality, integrity and availability are graded and calculated as follows: ； in, is the attack impact value; , , are the normalized weights of confidentiality, integrity, and availability, respectively; , , The attack impact values ​​for confidentiality, integrity, and availability for each attack type, respectively.

7. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 6 is characterized in that: The specific calculation of network security situation value is as follows: ； in, Indicates the normalized network security situation value; for the severity of the attack; It is the attack impact value.

8. The network security situation assessment method based on ACDAE-ResBiGRU according to claim 7 is characterized in that: Map the calculated network security situation value to , used for network security situation classification: ； in ， Indicates the normalized network security situation value; and Respectively represent the maximum and minimum values ​​of the mapping interval; and Respectively represent the maximum and minimum values ​​of the network security situation value; Indicates the current network security status value.

Images