Network security early warning method and system based on deep learning
Through the deep learning-based network security early warning method, real-time detection and response to network security threats is achieved, and the problems of insufficient emergency response to new unknown network attacks in the existing technology and lag in security threat detection are solved, network security is improved and self-optimization and upgrading is achieved.
Patent Information
- Application Number
- CN202411470833.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-21
- Publication Date
- 2025-02-25
AI Technical Summary
The existing network security system relies on known attack signatures and rules for threat detection, lacks emergency response methods for new unknown cyber attacks, which affects network security and lacks self-growth and update methods, resulting in lag in security threat detection.
Using a deep learning-based network security early warning method, we can realize real-time detection and response of network security threats through six steps: network data collection and monitoring processing, network security threat detection and alarm generation, closed simulation and data analysis of unknown security threats, self-optimization and upgrading of network security systems, traceability processing of network attack behaviors and network security information sharing processing.
Effectively detect and respond to new unknown network attacks, improve network security, realize self-optimization and upgrading of network security systems, and reduce the lag of security threat detection.
Smart Images
Figure CN119520026A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and specifically to a network security early warning method and system based on deep learning. Background Art
[0002] Network security refers to a series of measures and practices to protect computer networks and their related technical equipment, data and services from unauthorized access, attack, damage or leakage. The goal of network security is to ensure the integrity, availability and confidentiality of network systems, protect the network from various threats and attacks, and ensure the security of data and communications. In order to achieve the purpose of network security protection, the network is equipped with a special network security system to handle network intrusions to ensure the security of network operation.
[0003] However, the existing network security systems for personal network use have the following problems during use: network security systems usually rely on known attack signatures and rules for threat detection, but lack corresponding emergency response measures for some new unknown network attack dangers, affecting the security of the network, and the existing network security protection measures lack self-growth and update measures for unknown network threats, and often require technicians to manually upgrade and optimize the network security protection system, which leads to the lag of network security protection systems in security threats. Therefore, it is necessary to design corresponding technical solutions to solve the existing technical problems. Summary of the invention
[0004] The purpose of the present invention is to provide a network security early warning method and system based on deep learning, which solves the problem that network security systems usually rely on known attack signatures and rules for threat detection, but lack corresponding emergency response measures for some new unknown network attack dangers, affecting the security of the network. In addition, existing network security protection measures lack self-growth and updating means for unknown network threats, and often require technical personnel to manually upgrade and optimize the network security protection system, which leads to the technical problem that the network security protection system is lagging behind security threats.
[0005] To achieve the above purpose, the present invention provides the following technical solution: a network security early warning method based on deep learning, and the specific security early warning processing steps are as follows:
[0006] Step 1: Network data collection and monitoring processing;
[0007] Step 2: Network security threat detection and alert generation;
[0008] Step 3: Closed simulation and data analysis of unknown security threats;
[0009] Step 4: Self-optimization and upgrade of network security system;
[0010] Step 5: Traceability of cyber attack behavior;
[0011] Step 6: Cybersecurity information sharing and processing;
[0012] Through the above six steps, network information data is collected, monitored, and network security threat behaviors are detected. The detection methods for network security threat behaviors are divided into known threat detection and unknown threat detection. Known security threat detection is processed by network security software, while for the detection of unknown threats, the data is transmitted to the virtual host for release, and the method and result of the unknown threat on the network attack is observed, and targeted processing is performed. The information parsed by the unknown threat is uploaded to the network security system for automatic optimization and upgrade processing, and the information is shared synchronously. In addition, the network attack behavior is traced and the actual accountability is handled.
[0013] As a preferred method of the present invention, step one: network data collection and monitoring processing, receiving network data and passing the received network data through a data collection library, and cooperating with a network security threat detection and alarm generation module to perform real-time detection and processing of data flow in the data collection library.
[0014] As a preferred method of the present invention, step two: network security threat detection and alarm generation is divided into two parts: a known security threat processing module and an unknown security threat processing module. The known security threat processing module processes the threat data contained in the data through a firewall, while the unknown security threat data module is processed through a location security threat processing module, wherein the unknown security threat data module is connected to the self-optimization upgrade module of the network security system.
[0015] As a preferred method of the present invention, step three: closed simulation and data analysis of unknown security threats, the unknown security threat data modules are centrally imported into an independent simulation host, and various types of useless data information are pre-stored in the simulation host, and then the unknown security threat data modules are released into the simulation host, and the harm of the unknown security threat data modules to various types of useless data information is observed. In the process of the above operation, the process, method and result of the operation of the unknown security threat data module are recorded in real time through the data detection module, and the recorded information is uploaded to the network data security center. The network data security center organizes the data and creates a corresponding processing program for the unknown security threat data module, and enters the security processing program into the known security threat processing module, thereby achieving self-optimization and upgrading of the network security system.
[0016] As a preferred method of the present invention, step four: self-optimization and upgrading of the network security system. After the optimization of the network security system is completed, the process, method and result of the operation of the unknown security threat data module are recorded in real time and integrated with the corresponding processing program and uploaded to the network security information sharing processing module.
[0017] As a preferred method of the present invention, step five: tracing back network attack behaviors, performing IP address tracing for network security threat behaviors, finding the IP address location and uploading the information to the local network security department where the IP is located, and the network security department queries the initiator of the network data threat behavior based on the IP address, and finally holds the initiator accountable.
[0018] As a preferred method of the present invention, step six: network security information sharing processing, the process, method and result of the operation of the unknown security threat data module are uploaded to the cloud platform for sharing and the corresponding processing program is processed for network security entry, so as to achieve self-optimization and upgrade of the network security system.
[0019] As a preferred embodiment of the present invention, the specific network security early warning system executes steps one to six through a computer network to complete early warning processing for network data security.
[0020] Compared with the prior art, the present invention has the following beneficial effects:
[0021] 1. The present invention collects and monitors network information data and detects network security threat behaviors, wherein the detection methods for network security threat behaviors are divided into known threat detection and unknown threat detection. Known security threat detection is processed by network security software, while for the detection of unknown threats, data is transmitted to a virtual host for release, and the method and result of the unknown threat for network attack is observed, and targeted processing is performed. The information parsed by the unknown threat is uploaded to the network security system for automatic optimization and upgrade processing, and the information is shared synchronously. In addition, the network attack behavior is traced and the actual accountability is handled.
[0022] 2. In the process of routine monitoring and security processing of network data, the present invention provides targeted guidance and analysis processing for threat data not included in the security processing software, and performs targeted processing on threat data behavior. The process, method and result of the operation of the unknown security threat data module are recorded in real time and integrated with the corresponding processing program and uploaded to the network security information sharing processing module, so as to achieve self-optimization and upgrade processing of the network security system. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 It is a schematic diagram of the overall structural framework of the present invention;
[0024] Figure 2 It is the overall operation system diagram of the present invention. DETAILED DESCRIPTION
[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0026] See also Figure 1-2 The present invention provides a technical solution: a network security early warning method based on deep learning, and the specific security early warning processing steps are as follows:
[0027] Step 1: Network data collection and monitoring processing;
[0028] Step 2: Network security threat detection and alert generation;
[0029] Step 3: Closed simulation and data analysis of unknown security threats;
[0030] Step 4: Self-optimization and upgrade of network security system;
[0031] Step 5: Traceability of cyber attack behavior;
[0032] Step 6: Cybersecurity information sharing and processing;
[0033] Through the above six steps, network information data is collected, monitored, and network security threat behaviors are detected. The detection methods for network security threat behaviors are divided into known threat detection and unknown threat detection. Known security threat detection is processed by network security software, while for the detection of unknown threats, the data is transmitted to the virtual host for release, and the method and result of the unknown threat on the network attack is observed, and targeted processing is performed. The information parsed by the unknown threat is uploaded to the network security system for automatic optimization and upgrade processing, and the information is shared synchronously. In addition, the network attack behavior is traced and the actual accountability is handled.
[0034] Further improvement, such as Figure 1 As shown, step one: network data collection and monitoring processing, receiving network data and passing the received network data through the data collection library, and cooperating with the network security threat detection and alarm generation module to perform real-time detection and processing of data flow in the data collection library.
[0035] Further improvement, such as Figure 1As shown, step two: network security threat detection and alarm generation is divided into two parts: a known security threat processing module and an unknown security threat processing module. The known security threat processing module processes the threat data contained in the data through a firewall, while the unknown security threat data module is processed through a location security threat processing module, wherein the unknown security threat data module is connected to the self-optimization upgrade module of the network security system.
[0036] Further improvement, such as Figure 1 As shown, step three: closed simulation and data analysis of unknown security threats, import the unknown security threat data modules into an independent simulation host, and pre-store various types of useless data information in the simulation host, and then release the unknown security threat data modules into the simulation host, observe the harm of the unknown security threat data modules to various types of useless data information, and in the process of the above operations, use the data detection module to record the process, method and result of the operation of the unknown security threat data module in real time, and upload the recorded information to the network data security center, the network data security center organizes the data and creates a corresponding processing program for the unknown security threat data module, and enters the security processing program into the known security threat processing module, thereby achieving self-optimization and upgrading of the network security system.
[0037] Further improvement, such as Figure 1 As shown, step four: self-optimization and upgrading of the network security system. After the network security system is optimized, the process, method and result of the unknown security threat data module are recorded in real time and integrated with the corresponding processing procedures and uploaded to the network security information sharing processing module.
[0038] Further improvement, such as Figure 1 As shown, step five: tracing back network attack behaviors, tracing back IP addresses for network security threat behaviors, finding the IP address location and uploading the information to the local network security department where the IP is located. The network security department queries the initiator of the network data threat behavior based on the IP address, and finally holds the initiator accountable.
[0039] Further improvement, such as Figure 1 As shown, step six: network security information sharing processing, the operation process, method and result of the unknown security threat data module are uploaded to the cloud platform for sharing and the corresponding processing program is processed for network security entry, so as to achieve self-optimization and upgrade of the network security system.
[0040] Specifically, the specific network security early warning system executes steps one to six through a computer network to complete early warning processing for network data security.
[0041] In the description of the present invention, it is necessary to understand that the terms "coaxial", "bottom", "one end", "top", "middle", "the other end", "upper", "one side", "top", "inside", "front", "center", "both ends" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.
[0042] In addition, the terms "first", "second", "third" and "fourth" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first", "second", "third" and "fourth" explicitly or implicitly include at least one of such features.
[0043] In the present invention, unless otherwise clearly stipulated and limited, the terms such as "installation", "setting", "connection", "fixation" and "screw-on" should be understood in a broad sense, for example, fixed connection, detachable connection, or integrated; mechanical connection, electrical connection; direct connection, indirect connection through an intermediate medium, internal connection between two elements or interaction between two elements. Unless otherwise clearly defined, for ordinary technicians in this field, the specific meanings of the above terms in the present invention will be understood according to the specific circumstances.
[0044] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for a person skilled in the art to modify the technical solutions described in the aforementioned embodiments or to replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A network security early warning method based on deep learning, characterized by: The specific steps for handling security warnings are as follows: Step 1: Network data collection and monitoring processing; Step 2: Network security threat detection and alert generation; Step 3: Closed simulation and data analysis of unknown security threats; Step 4: Self-optimization and upgrade of network security system; Step 5: Traceability of cyber attack behavior; Step 6: Cybersecurity information sharing and processing; Through the above six steps, network information data is collected, monitored, and network security threat behaviors are detected. The detection methods for network security threat behaviors are divided into known threat detection and unknown threat detection. Known security threat detection is processed by network security software, while for the detection of unknown threats, the data is transmitted to the virtual host for release, and the method and result of the unknown threat on the network attack is observed, and targeted processing is performed. The information parsed by the unknown threat is uploaded to the network security system for automatic optimization and upgrade processing, and the information is shared synchronously. In addition, the network attack behavior is traced and the actual accountability is handled.
2. The network security early warning method based on deep learning according to claim 1 is characterized in that: Step 1: Network data collection and monitoring processing, receiving network data and passing the received network data through the data collection library, and cooperating with the network security threat detection and alarm generation module to perform real-time detection and processing of data flow in the data collection library.
3. The network security early warning method based on deep learning according to claim 1 is characterized in that: Step 2: Network security threat detection and alarm generation is divided into two parts: a known security threat processing module and an unknown security threat processing module. The known security threat processing module processes the threat data contained in the data through a firewall, while the unknown security threat data module is processed through a location security threat processing module, wherein the unknown security threat data module is connected to the self-optimization upgrade module of the network security system.
4. The network security early warning method based on deep learning according to claim 1 is characterized in that: Step 3: Closed simulation and data analysis of unknown security threats. Import the unknown security threat data modules into an independent simulation host, and pre-store various types of useless data information in the simulation host. Then release the unknown security threat data modules into the simulation host, observe the harm of the unknown security threat data modules to various types of useless data information, and use the data detection module to record the process, method and result of the unknown security threat data module in real time during the above operation. Upload the recorded information to the network data security center, the network data security center organizes the data and creates a corresponding processing program for the unknown security threat data module, and enters the security processing program into the known security threat processing module, thereby achieving self-optimization and upgrading of the network security system.
5. The network security early warning method based on deep learning according to claim 1 is characterized in that: Step 4: Self-optimization and upgrading of the network security system. After the network security system is optimized, the process, method and result of the unknown security threat data module are recorded in real time and integrated with the corresponding processing procedures and uploaded to the network security information sharing processing module.
6. The network security early warning method based on deep learning according to claim 1 is characterized by: Step 5: Trace back network attack behaviors. Perform IP address traceback for network security threats. Find the IP address location and upload the information to the local network security department where the IP is located. The network security department will query the initiator of the network data threat behavior based on the IP address, and finally hold the initiator accountable.
7. The network security early warning method based on deep learning according to claim 1 is characterized by: Step 6: Network security information sharing and processing, upload and share the operation process, method and results of the unknown security threat data module on the cloud platform and perform network security entry processing on the corresponding processing program to achieve self-optimization and upgrade of the network security system.
8. A network security early warning system based on deep learning, characterized by: The specific network security early warning system is to execute steps one to six through a computer network to complete the early warning processing of network data security.