Network attack detection system and method based on deep learning

Abstract

The invention discloses a network attack detection system and method based on deep learning. The method comprises the following steps: collecting and obtaining network topology data, network flow data and equipment log data; setting data burying points on the key application program to obtain behavior data of a plurality of users; obtaining an abnormal user by using the user behavior pattern library, and marking a terminal device of the abnormal user as an abnormal operation device; acquiring network flow data and equipment log data of the abnormal operation equipment, inputting the network flow data and the equipment log data into the network attack detection model, and marking the abnormal operation equipment of which the output result is network attack as a network attack node; establishing a network topology model according to the network topology data, and analyzing the influence range of the plurality of network attack nodes by using the network topology model to obtain a plurality of influence nodes; and isolating the network attack node from the plurality of influence nodes. The invention belongs to the technical field of network security, and solves the technical problems of low efficiency and insufficient precision of the existing network attack detection method.

Description

Technical Field

[0001] The present invention belongs to the field of network security and relates to network attack detection technology, specifically a network attack detection system and method based on deep learning. Background Art

[0002] In the context of the digital age, network security has become a core element of stable enterprise operations. As a key infrastructure for information exchange, the internal network of an enterprise faces unique security needs and challenges. Compared with the public network, the internal network of an enterprise mainly serves specific enterprise areas, and its user groups are mainly authorized personnel such as enterprise employees and partners, while the public network covers a wide range and has complex and diverse user identities. In terms of usage and data types, the internal network of an enterprise mainly supports the business processes of the enterprise, and the data transmitted is mostly sensitive commercial information, while the public network has a variety of uses, diverse data types, and relatively low sensitivity. Therefore, the security requirements of the internal network of an enterprise are extremely high, and any security loopholes may have serious consequences for the enterprise.

[0003] Network attack detection plays a vital role in the internal network of an enterprise. It can not only monitor user behavior to detect internal abnormal operations, but also identify external attacks in a timely manner. On the one hand, by monitoring user behavior, enterprises can promptly detect internal threats, such as employee negligence or intentional behavior, such as former employees stealing data or risks caused by insufficient security awareness of current employees, which may pose a threat to network security. On the other hand, network attack detection can promptly detect external attacks through network-related data, such as DDoS attacks, phishing and malware infections, which will damage the enterprise's network infrastructure or steal important data. By analyzing network traffic, identifying abnormal patterns and behaviors, and monitoring potential threat indicators, the network attack detection system can provide enterprises with real-time alerts and response mechanisms, thereby reducing the impact of security incidents and effectively preventing data leaks.

[0004] However, existing technologies are insufficient in detecting network attacks within enterprises. A high false alarm rate is a prominent problem. Existing detection tools such as IDS and IPS are mostly based on rules or features to identify attacks, which can easily misjudge normal network activities as attacks, causing the security team to spend a lot of energy on troubleshooting. In addition, the accuracy of user behavior analysis is insufficient, making it difficult to accurately distinguish between normal and abnormal behaviors, and even more difficult to effectively identify and analyze complex coordinated attack behaviors. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a network attack detection system and method based on deep learning, which are used to solve the technical problems of low efficiency and insufficient accuracy of existing network attack detection methods.

[0006] To achieve the above objectives, the first aspect of the present invention provides a network attack detection system based on deep learning, comprising:

[0007] Data collection module: used to collect and obtain network topology data, network traffic data, device log data, and set data embedding points on key applications to obtain behavior data of several users;

[0008] Behavior analysis module: used to obtain abnormal operation devices according to the behavior data of several users using the user behavior pattern library; if yes, the user's terminal device is marked as an abnormal operation device; if no, the user's terminal device is marked as a normal operation device; wherein the user behavior pattern library is constructed based on a clustering algorithm;

[0009] Attack detection module: used to obtain the network traffic data and device log data of the several abnormal operation devices and input them into the network attack detection model to determine whether the network of the several abnormal operation devices is normal; if yes, the abnormal operation device is marked as a network attack node; if not, the abnormal operation device is marked as a normal node; wherein the network attack detection model is constructed based on a deep learning algorithm;

[0010] Emergency processing module: used to establish a network topology model based on network topology data, use the network topology model to analyze the impact range of several network attack nodes, obtain several impact nodes, and isolate the network attack nodes and several impact nodes.

[0011] Based on the above technical modules, the security protection and attack detection management of the enterprise local network is realized. The data collection module collects rich and diverse network-related data, laying the foundation for subsequent accurate analysis; the behavior analysis module uses clustering algorithms to build a user behavior pattern library, and by comparing the current behavior collected by the data collection module with the pattern library, it identifies abnormal behaviors and discovers internal threat operations or malicious user behaviors in the enterprise; the attack detection module uses deep learning algorithms to establish a detection model, conduct network attack detection on abnormal devices, determine whether the abnormal operation equipment is under network attack, quickly locate the attack source, and reduce losses; finally, the emergency response module builds a network topology model, calculates the impact range of the attack node and isolates it, effectively controls the spread of the attack, and ensures the stable operation of key parts of the network.

[0012] Furthermore, setting data tracking points on key applications includes:

[0013] A1, collects CPU usage, memory usage, disk read / write frequency, disk read / write data volume, network traffic, number of network connections, number of user accesses, and user roles of several applications within a preset time period to obtain several evaluation index data;

[0014] A2, using the analytic hierarchy process to calculate the comprehensive scores of several applications according to several evaluation index data to obtain several comprehensive scores;

[0015] A3, screening out corresponding applications whose comprehensive scores exceed a preset threshold to obtain key applications;

[0016] A4, set up data tracking points on key applications, record the operation user, operation time, operation type and operation object, and obtain some behavioral data.

[0017] By collecting multi-dimensional evaluation indicator data, using the hierarchical analysis method to calculate the comprehensive score and screen out key applications, we can accurately identify applications that are critical to network security and business operations, avoid blindly collecting data and security monitoring in a large number of applications, and concentrate limited resources on key areas, thereby improving the targeted nature of network security protection work and the efficiency of resource utilization.

[0018] Furthermore, the method of calculating the comprehensive scores of several applications according to several evaluation index data by using the hierarchical analysis method includes:

[0019] A21, evaluate the relative importance of several evaluation indicators, obtain aij, and construct the criterion layer judgment matrix A based on aij; where aij represents the importance of the i-th evaluation indicator relative to the j-th evaluation indicator, and aii=1, aji=1 / aij, the size of the relative importance matrix is ​​n×n, and n represents the number of evaluation indicators;

[0020] A22, evaluate the relative importance of several applications under several evaluation indicators, obtain bi_pq, and construct several solution-level judgment matrices Bi according to bi_pq; wherein Bi represents the solution-level judgment matrix of the i-th evaluation indicator, bi_pq represents the importance of the p-th application relative to the q-th application under the i-th evaluation indicator, and bi_pp=1, bi_qp=1 / bi_pq, the size of the judgment matrix is ​​m×m, and m represents the number of applications;

[0021] A23, using the square root method to calculate the weight vector of A, and perform consistency check on A to determine whether the consistency ratio is less than a preset threshold; if yes, obtain the weight vector W; if no, jump to A21; where W = (w1, w2, w3, ..., wn);

[0022] A24, calculate the weight vector of Bi using the square root method, and perform consistency check on Bi to determine whether the consistency ratio is less than a preset threshold; if yes, obtain the weight vector WB; if no, jump to A22; where WB = {(W11, W12, ..., W1m), (W21, W22, ..., W2m), ..., (Wn1, Wn2, ..., Wnm)};

[0023] A25, calculate the comprehensive score of the pth application according to the formula Rp=w1×W1p+w2×W2p+…+wn×Wnp, and traverse several applications to obtain several comprehensive scores.

[0024] Since the AHP method can be flexibly constructed and calculated according to different evaluation indicators and application characteristics, the method can well adapt to the needs of different enterprise network environments, business types and network security strategies. Whether it is an enterprise focusing on data processing or an enterprise mainly focusing on network services, it can adjust the evaluation indicators and their relative importance according to its own focus and needs, so as to obtain the key application screening results that meet its actual situation. In addition, the method based on the AHP method fully considers various complex factors and their interrelationships, reduces the influence of subjective arbitrariness on the evaluation results, and makes the final comprehensive score of the application truly and accurately reflect its actual importance in network security and business operations.

[0025] Furthermore, the user behavior pattern library is constructed based on a clustering algorithm, including:

[0026] B1, obtaining and preprocessing the historical behavior data of several users to obtain a historical behavior database;

[0027] B2, clustering the historical behavior database using a clustering algorithm to obtain several clusters;

[0028] B3, counting the number of data items of the plurality of clusters, and performing frequency classification on the plurality of clusters according to a data item number threshold to obtain a plurality of frequency categories; wherein the plurality of frequency categories include: high frequency behavior, medium frequency behavior, and low frequency behavior;

[0029] B4, obtains several behavior categories according to the departments of the operating users in several clusters, the range of operation time, the operation type and the operation object, and uses database technology to store several behavior categories and several frequency categories to obtain a user behavior pattern library; among which, the frequency category in the user behavior pattern library is used as the main category, and the behavior category is used as the subcategory.

[0030] In the network environment, user behaviors are complex and diverse and will change dynamically with time and other factors. Simply relying on fixed rules to judge whether a behavior is abnormal is often not accurate and comprehensive enough. By building a behavior pattern library through clustering algorithms, we can automatically discover the behavior patterns hidden in the massive historical behavior data, and classify and sort them according to reasonable frequencies and behavior dimensions. We can mine the common operation patterns and habits of users from a large amount of historical behavior data, which helps to more accurately grasp the normal user behavior "portrait" in the network and provide a reliable reference standard for abnormal behavior detection.

[0031] Furthermore, the method of obtaining a plurality of abnormal operation devices according to the behavior data of a plurality of users by using the user behavior pattern library includes:

[0032] C1, encode the user behavior pattern library and the behavior data of several users according to the department of the operating user, the operation time range, the operation type and the operation object, and obtain several standard feature vectors and several behavior feature vectors;

[0033] C2, using cosine similarity to calculate the similarity between the current user's behavior feature vector and several standard feature vectors, to obtain the similarity vector M between the current user's behavior and several behavior categories;

[0034] C3, weighted sum of several similarity values ​​in the similarity vector to obtain the behavior score of the current user;

[0035] C4, compare whether the current user's behavior score is lower than the preset behavior score threshold; if yes, get the abnormal operation device; if no, get the normal operation device;

[0036] C5, repeat C2C4 until the behavior data of several users are traversed and several abnormal operation devices are obtained.

[0037] In network security protection, accurately judging whether user behavior is abnormal is crucial for timely discovering internal security threats, such as employee illegal operations, account theft, and external malicious attacks using user rights. By conducting quantitative comparative analysis of current user behavior and the behavior pattern library built based on historical data, based on similarity calculation and threshold judgment processes, it is possible to make full use of existing behavior pattern information and accurately identify abnormal behavior in a way that conforms to the actual network operation rules, meeting the requirements of network security monitoring for accuracy, comprehensiveness, and dynamic adaptability of user behavior anomaly detection.

[0038] Furthermore, the network attack detection model is constructed based on a deep learning algorithm, including:

[0039] D1, obtaining and preprocessing historical network traffic data and historical device log data of several devices to obtain preprocessed data, and obtaining time series data based on the preprocessed data;

[0040] D2, according to the historical network attack records, the time series data is categorized and labeled to obtain labeled data; the categories of the labeled data include normal network and network attack;

[0041] D3, build a time series model based on the deep learning algorithm, input the time series data and the labeled data into the time series model according to the preset ratio for training, verification and testing, and obtain a pre-trained time series model that meets the test accuracy;

[0042] D4, taking the pre-trained time series model as the final model, obtains a network attack detection model whose input is the network traffic data and device log data of the device and whose output is the network status of the device.

[0043] Use deep learning algorithms to build a model architecture suitable for processing time series data, then divide the data set (training set, validation set, and test set) according to a certain ratio, use the training set to let the model learn the features and patterns in the data, adjust the model's hyperparameters through the validation set to optimize performance, and finally use the test set to evaluate whether the model meets the preset accuracy requirements, thereby obtaining a network attack detection model with reliable performance that can be used for actual detection.

[0044] Furthermore, obtaining time series data based on preprocessed data includes:

[0045] D11, determining a time window size according to a preset time interval, and dividing the preprocessed data into a plurality of time windows based on the time window;

[0046] D12, counting the total traffic volume, total data packets, proportion of different types of protocols, and usage frequency of different ports within several time windows to obtain network traffic data characteristics;

[0047] D13, count the number of different types of events and the proportion of different HTTP response codes in several time windows to obtain the device log data characteristics;

[0048] D14, the network traffic data features and device log data features in several time windows are combined into several feature vectors in chronological order to obtain time series data.

[0049] The preprocessed historical network traffic and device log data are divided into time windows according to preset time intervals. Multiple features related to network traffic and device logs are extracted in each window, and these features are combined into feature vectors in chronological order. Ultimately, time series data is formed that can comprehensively reflect the changes in network status over time, providing a rich and representative data foundation for subsequent model training.

[0050] Furthermore, the use of a network topology model to analyze the impact range of several network attack nodes includes:

[0051] E1, calculates several edge weights in the network topology model according to the weight distribution formula;

[0052] E2, using a path search algorithm, obtains several shortest attack paths starting from several network attack nodes and greater than a preset weight threshold;

[0053] E3, count several nodes on several shortest attack paths and obtain several impact nodes.

[0054] Through the path search algorithm, we focus on the links and nodes whose weights exceed the preset threshold, and can quickly locate the links and node sets that are in a high-risk state due to abnormal traffic fluctuations, weak security protection, and a high historical attack frequency.

[0055] Furthermore, the weight distribution formula is: Wuv = (Fuv × Suv × Huv) / [√∑ (Fuk × Suk × Huk + ∈) ^ 2]; wherein the summation range is all nodes k adjacent to the node i, ∈ represents a correction constant, which is used to prevent the denominator from being 0;

[0056] Wuv represents the edge weight between node u and node v;

[0057] Fuv represents the flow rate change rate, and Fuv = |Quv(t2)Quv(t1)| / Quv(t1), where Quv(t2) and Quv(t1) represent the flow size from node u to node v at time t1 and t2 respectively;

[0058] Suv represents the node risk factor, and Suv = 1 / (1+∑w_sd×Cud×Cvd), the summation range is all safety configuration items, w_sd represents the weight of the d-th safety configuration, Cud and Cvd represent the scores of node u and node v on the d-th safety configuration respectively;

[0059] Huv represents the historical attack frequency, and Huv=Nuv / N, N represents the total number of network attacks within the historical preset time range, and Nuv represents the number of network attacks on the link between node u and node v within the historical preset time range.

[0060] In a network environment, the degree to which a link between nodes is affected by a network attack is determined by multiple interrelated factors. The traffic change rate can reflect whether there is abnormal traffic fluctuation on the link, which may indicate attack behavior. The greater the traffic change rate, the greater the impact of network attacks; the node risk factor reflects the security protection level of the nodes at both ends of the link. The higher the node risk factor, the greater the impact of network attacks; the historical attack frequency records the attacks on the link in the past. The higher the historical attack frequency, the greater the impact of network attacks; therefore, the larger the edge weight value, the greater the impact of network attacks.

[0061] A second aspect of the present invention provides a network attack detection method based on deep learning, comprising:

[0062] S1, collect and obtain network topology data, network traffic data and device log data;

[0063] S2, set up data tracking points on key applications to obtain behavioral data of several users;

[0064] S3, using the user behavior pattern library to obtain abnormal operation devices according to the behavior data of several users; if yes, the user's terminal device is marked as an abnormal operation device; if no, the user's terminal device is marked as a normal operation device; wherein the user behavior pattern library is constructed based on a clustering algorithm;

[0065] S4, obtaining the network traffic data and device log data of the abnormal operation device, obtaining abnormal data, and using the network attack detection model to determine whether the network status of the abnormal operation device is normal according to the abnormal data; if yes, marking the abnormal operation device as a network attack node; if no, marking the abnormal operation device as a normal node; wherein the network attack detection model is constructed based on a deep learning algorithm

[0066] S5, establishing a network topology model according to the network topology data, and using the network topology model to analyze the influence range of several network attack nodes to obtain several influence nodes;

[0067] S6, isolate the network attack node and several affected nodes.

[0068] Compared with the prior art, the present invention has the following beneficial effects:

[0069] The user behavior pattern library built by clustering algorithm can mine normal user behavior patterns from historical data to provide accurate reference for abnormal behavior detection. The behavior analysis module accurately identifies abnormal behaviors that are significantly different from normal patterns through quantitative comparative analysis, and gives priority to abnormal operation devices; the attack detection module is then used to perform network attack detection on abnormal operation devices, effectively narrowing the detection scope and improving the efficiency of network attack detection, thereby concentrating resources on more in-depth analysis of potential network attack nodes.

[0070] Through multi-source data collection and integration, network topology, traffic, and log data are comprehensively collected to provide a rich information foundation for deep learning models, thereby improving the comprehensiveness and accuracy of detection. The network attack detection model built using deep learning algorithms can automatically learn and identify complex attack patterns, reduce false positives and false negatives, and improve detection efficiency. In addition, through the emergency response module, the impact range of network attacks can be quickly located and isolated, effectively controlling the spread of attacks and ensuring stable network operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 A schematic diagram of the process flow of the network attack detection system based on deep learning provided by the present invention;

[0073] Figure 2 A schematic diagram of the framework of the network attack detection system based on deep learning provided by the present invention;

[0074] Figure 3 This is a schematic diagram of the operation of the behavior analysis module in the deep learning-based network attack detection system provided by the present invention. DETAILED DESCRIPTION

[0075] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0076] See also Figure 1-Figure 3 The first aspect of the present invention provides a network attack detection system based on deep learning, including:

[0077] Data collection module: used to collect and obtain network topology data, network traffic data, device log data, and set data embedding points on key applications to obtain behavior data of several users;

[0078] Behavior analysis module: used to obtain abnormal operation devices according to the behavior data of several users using the user behavior pattern library; if yes, the user's terminal device is marked as an abnormal operation device; if no, the user's terminal device is marked as a normal operation device; wherein the user behavior pattern library is constructed based on a clustering algorithm;

[0079] Attack detection module: used to obtain network traffic data and device log data of abnormal operation devices, obtain abnormal data, and use the network attack detection model to determine whether the network of the abnormal operation device is normal based on the abnormal data; if yes, the abnormal operation device is marked as a network attack node; if not, the abnormal operation device is marked as a normal node; wherein, the network attack detection model is built based on a deep learning algorithm;

[0080] Emergency processing module: used to establish a network topology model based on network topology data, use the network topology model to analyze the impact range of several network attack nodes, obtain several impact nodes, and isolate the network attack nodes and several impact nodes.

[0081] It should be noted that the data acquisition module, the behavior analysis module, the attack detection module and the emergency processing module are in communication connection, and the output of the data acquisition module can be input into the behavior analysis module, the attack detection module and the emergency processing module.

[0082] As the business of enterprises expands, the number of terminal devices connected to the local network of enterprises continues to increase, covering various types such as computers and mobile devices. At the same time, the running applications are becoming more and more complicated, and the network topology structure is becoming more complicated. Traditional simple detection methods are difficult to cope with such a complex and dynamically changing network environment. A system that can comprehensively collect multi-type data is needed to accurately grasp the network status and then detect possible attacks.

[0083] In this system, network topology data, network traffic data, device log data and user behavior data are collected through the data acquisition module to provide data support for subsequent network attack detection.

[0084] Specifically, in this embodiment, the data acquisition module uses a network scanning tool, such as Nmap, to scan all devices in the enterprise local network, covering various network node devices such as routers, switches, servers, workstations, etc., and records their IP addresses, MAC addresses, device types, and connection relationships between devices in detail, thereby building a preliminary network connection topology map; then further analyzes the configuration information of the network devices, such as the routing table of the router, the VLAN configuration of the switch, etc., and integrates it into the network topology data to obtain complete enterprise local network topology data;

[0085] For the collection of network traffic data, in this system, by deploying network traffic monitoring equipment or enabling traffic monitoring software functions at key nodes of the enterprise local network, such as core switches and mirror ports of routers, all network data packets flowing through the node are captured; and the captured network data packets are parsed to extract key information such as the source IP address, destination IP address, source port, destination port, protocol type (such as TCP, UDP, ICMP, etc.), data packet size, and data packet transmission time of the data packet to obtain network traffic data;

[0086] For various devices in the enterprise local network (servers, routers, switches, etc.), the logging mechanisms of different devices may be different. Some devices may store logs in specific local files (such as various log files in the / var / log directory of Linux servers), while some devices may support sending logs to a dedicated log server. For device logs stored locally, they can be collected regularly by writing special log collection scripts or using existing log management tools (such as Logstash, etc.). For devices that support remote log transmission, configure the corresponding receiving service on the log server to receive log data from network devices, a complete set of device log data;

[0087] For the collection of user behavior data, we set up several data points on key applications to obtain data;

[0088] First, we need to evaluate the importance of several applications and obtain the key applications by using the hierarchical analysis method to obtain the comprehensive scores of the applications:

[0089] Specifically, we first collect the CPU usage, memory usage, disk read / write frequency, disk read / write data volume, network traffic, number of network connections, user access times, and user roles of several applications within a preset time period to obtain several evaluation indicator data;

[0090] Then construct the criterion layer judgment matrix: through expert evaluation, team discussion or combining past experience, the relative importance of each evaluation indicator in the criterion layer is compared pairwise to obtain aij. The 1-9 scale method can be used for assignment, where 1 means that the two indicators are equally important, 9 means that one indicator is extremely important than the other indicator, and the intermediate values ​​represent different degrees of relative importance. For example, if you think that the CPU occupancy rate is slightly more important than the memory occupancy rate, you can assign a value of 3; if you think that the amount of disk read and write data is much more important than the disk read and write frequency, you can assign a value of 7, etc.; then construct the criterion layer judgment matrix A based on the results of the pairwise comparison aij; where aij represents the importance of the i-th evaluation indicator relative to the j-th evaluation indicator, and aii=1, aji=1 / aij, aij>0, the size of the relative importance matrix is ​​n×n, and n represents the number of evaluation indicators;

[0091] Then, a scheme-level judgment matrix is ​​constructed: for each evaluation indicator, the relative advantages and disadvantages of each application under the indicator are compared to obtain bi_pq, and several scheme-level judgment matrices Bi are constructed based on bi_pq; wherein Bi represents the scheme-level judgment matrix of the i-th evaluation indicator, bi_pq represents the importance of the p-th application relative to the q-th application under the i-th evaluation indicator, and bi_pp = 1, bi_qp = 1 / bi_pq, the size of the judgment matrix is ​​m×m, and m represents the number of applications;

[0092] Next, the criterion layer weight vector is calculated and consistency checked:

[0093] The weight vector of A is calculated using the square root method, and A is checked for consistency to determine whether the consistency ratio is less than a preset threshold; if yes, the weight vector W = (w1, w2, w3, ..., wn) is obtained; if not, jump to the step of constructing the criterion layer judgment matrix for re-evaluation and construction;

[0094] In this embodiment, the specific operation process of obtaining the weight vector of A by using the square root method is as follows: first, the elements of each row in the criterion layer judgment matrix A are multiplied to obtain a new vector M, whose element mi=∏aij, and the product range is j=1,2,3...,n; then, the elements in M ​​are taken to the nth square root to obtain a vector AW, whose element awi=n√mi, where n√ represents the nth square root, that is, the number of square roots is the number of elements in each row of the matrix A; finally, AW is normalized to obtain the weight vector W;

[0095] Similarly, the square root method is used to calculate the weight vector of Bi, and a consistency check is performed on Bi to determine whether the consistency ratio is less than a preset threshold; if yes, the weight vector WB = {(W11, W12, ..., W1m), (W21, W22, ..., W2m), ..., (Wn1, Wn2, ..., Wnm)} is obtained; if not, jump to the step of constructing the scheme layer judgment matrix for re-evaluation and construction;

[0096] Finally, the comprehensive score of the pth application is calculated according to the formula Rp=w1×W1p+w2×W2p+…+wn×Wnp, and the formula is applied to several applications to obtain several comprehensive scores;

[0097] Filter out the corresponding applications whose comprehensive scores exceed the preset threshold to obtain key applications; then, set data points on the key applications to record the operating user, operation time, operation type and operation object to obtain some behavioral data. For example, for a financial software identified as a key application, record that user Zhang San performed the "account query" (operation type) operation at 14:30 on November 19, 2024, and queried the "November sales account" (operation object) and other behavioral information. By recording similar data of multiple key applications, we can finally summarize and obtain more comprehensive behavioral data.

[0098] Next, in the behavior analysis module, the user's behavior data will be compared with the data in the user behavior pattern library to screen out users with abnormal behavior;

[0099] Specifically, we first obtain and preprocess the historical behavior data of several users, and then obtain the user behavior pattern library based on the clustering algorithm:

[0100] Taking the KMeans algorithm as an example, suppose that some normal user behaviors need to be divided into 10 categories. The algorithm will randomly initialize 10 cluster centers, and then use metrics such as Euclidean distance to calculate the distance from the data point (that is, the vector representation corresponding to each user's historical behavior record, the dimension of the vector is composed of key features such as the user's department, operation time, operation type, and operation object) to each cluster center, and divide each data point into the cluster with the closest cluster center;

[0101] Then, the centers of each cluster are recalculated and iterated continuously until the cluster centers no longer change significantly or the preset number of iterations is reached. Finally, all the data in the historical behavior database are divided into corresponding clusters to obtain several clusters with similar behavior characteristics.

[0102] Count the number of data items in several clusters, perform frequency classification on the clusters according to the data item number threshold, and obtain several frequency categories; for example, set the threshold of high-frequency behavior to be more than 1000 data items, the threshold of medium-frequency behavior to be between 200 and 1000 data items, and the threshold of low-frequency behavior to be less than 200 data items (the thresholds here are only examples and can be adjusted according to actual business conditions); thereby dividing all clusters into different frequency categories of high-frequency behavior, medium-frequency behavior, and low-frequency behavior.

[0103] For each cluster, further analyze the key features such as the department to which the operating user belongs, the approximate range of the operation time (for example, whether it is concentrated during working hours, lunch break or after get off work), the operation type and the operation object, and combine these features to define specific behavior categories. For example, for a cluster of high-frequency behaviors, the behavior categories it contains may include "the R&D department performs code submission and test-related operations in the afternoon on weekdays";

[0104] Next, these behavior categories and corresponding frequency categories are stored using database technology to obtain a "user behavior pattern library" table containing fields such as "frequency category", "operating user", "operation time", "operation type", "operation object", and "behavior category description". In this library, the frequency category is used as the main category and the behavior category is used as the subcategory to facilitate subsequent query and matching operations;

[0105] In the behavior analysis module, the behavior data of several users are judged to be abnormal based on the user behavior pattern library, including:

[0106] C1. For each behavior category record in the user behavior pattern library, extract the key information, namely the department of the operating user, the operation time range, the operation type and the operation object, and convert this information into a feature vector in digital form according to certain coding rules to obtain a standard feature vector; similarly, for the behavior data of several users that need to be judged, also follow the same coding rules to convert the corresponding information in each behavior data into a behavior feature vector.

[0107] C2, for each current user's behavior feature vector, calculate the cosine similarity between it and all standard feature vectors in the user behavior pattern library according to the cosine similarity calculation formula; obtain a set of similarity values ​​corresponding to each behavior category to form a similarity vector M, which reflects the similarity between the current user behavior and different behavior categories;

[0108] C3, assigns a corresponding weight to each similarity value in the similarity vector M. These weights can be pre-set based on factors such as business importance, or obtained through expert evaluation; then the weighted sum of several similarity values ​​in M ​​is taken to obtain the behavior score of the current user;

[0109] C4, compares whether the current user's behavior score is lower than the preset behavior score threshold; if yes, the current user's behavior data is marked as abnormal; if no, the current user's behavior data is marked as normal;

[0110] C5, repeat C2C4 until the behavior data of several users are traversed.

[0111] Hackers or malicious attackers often try to disguise themselves as legitimate users to enter the enterprise network system. Their operating behaviors may be significantly different from the behavior patterns of normal users. For example, external attackers may try to access sensitive data in large quantities during non-normal working hours, or frequently log in to key applications from abnormal IP addresses. By collecting user behavior data and comparing it with the normal behavior pattern library, these behaviors that do not conform to the normal pattern can be discovered in time to effectively prevent external network attacks; at the same time, there may also be security risks within the enterprise, such as employee misoperation or malicious behavior of internal personnel, which may threaten the security of the enterprise network. Through the behavior analysis module, these abnormal behaviors can be monitored.

[0112] User devices with abnormal behavior data will be identified as abnormal operation devices. Then, the attack detection module will retrieve the network traffic data and device log data of the corresponding device in the data collection module, and then determine whether the network of the abnormal operation device is under network attack based on the network attack detection model;

[0113] Among them, the network attack detection model is built based on the deep learning algorithm:

[0114] D1, obtaining and preprocessing historical network traffic data and historical device log data of several devices to obtain preprocessed data;

[0115] D11, determine the time window: determine the time window size according to a preset time interval (for example, set every 5 minutes as a time interval), and divide the preprocessed data into several time windows based on this time window;

[0116] D12, extract network traffic data features: for each time window, count the total internal traffic of each device (i.e., the sum of all network traffic passing through the monitoring node during this time period), the total number of data packets (the number of data packets captured in this time window), the proportion of different types of protocols (such as the proportion of TCP protocol traffic in the total traffic, the proportion of UDP protocol traffic, etc.), and the usage frequency of different ports (such as port 80, port 443, etc.), and obtain the network traffic data features;

[0117] D13, extracting device log data features: Counting the number of different types of events (such as the number of occurrences of device login events, permission change events, etc.) and the proportion of different HTTP response codes (such as the proportion of 200 response code, 404 response code, etc. in all HTTP responses) in each time window to obtain device log data features;

[0118] D14, combining the network traffic data features and the device log data features in each time window in chronological order to form a number of feature vectors, and arranging them in chronological order to obtain time series data;

[0119] D2, based on historical network attack records, the time series data is labeled with the categories of normal network and network attack to obtain labeled data;

[0120] D3, builds a time series model based on the deep learning algorithm, configures the relevant parameters of the model, such as the number of network layers, the number of neurons in each layer, the type of activation function (commonly used are ReLU, Sigmoid, etc.), etc., and builds an initial time series model architecture, whose input is the time series data generated previously, and the output is the corresponding network state category;

[0121] When building a time series model based on a deep learning algorithm, you can combine the GANLSTM architecture to build a model that can generate similar and diverse time series data in the real network environment based on the existing time series data, so as to expand the training data set and improve the model's generalization ability and ability to respond to complex network attack scenarios. You can also directly design a time series model that meets the needs of network attack detection based on LSTM, RNN and other models, combined with model fusion strategies or model accuracy improvement techniques, such as combining attention modules, multi-scale strategies, skip connections, etc.;

[0122] Then, the time series data and the labeled data are input into the constructed time series model in a preset ratio (divided into training set, validation set and test set in a ratio of 7:2:1) for training, validation and testing. In the training stage, the model continuously adjusts its own parameters (through mechanisms such as the back propagation algorithm) according to the input training data to minimize the difference between the predicted results and the actual annotations (such as using the cross entropy loss function to measure the degree of difference); in the validation stage, the validation set data is used to evaluate the performance of the model on unseen data, and the model is adjusted (such as adjusting hyperparameters, etc.) according to the validation results (such as accuracy, recall rate, F1 value and other evaluation indicators); in the testing stage, the test set data is used to finally test the generalization ability of the model to see whether it can accurately classify new time series data correctly, and the training process is continuously iterated until a pre-trained time series model that meets the test accuracy is obtained;

[0123] D4, taking the pre-trained time series model as the final application model, we obtain the network attack detection model.

[0124] If the network traffic data and device log data of the abnormally operating device are input into the network attack detection model, and the output network status is a network attack, the abnormally operating device will be marked as a network attack node, and the emergency processing module will be started to further analyze the network attack node to reduce the impact scope of the network attack.

[0125] Specifically, in the emergency processing module, first, the network topology data in the data acquisition module is obtained, and the network modeling tool or the self-written modeling program is used to abstract these devices into nodes in the network topology model, and the connection relationship between them is abstracted into edges to build a network topology model;

[0126] E1 then calculates several edge weights in the network topology model:

[0127] Calculate the traffic change rate Fuv: For each edge in the network topology model (i.e., the link connecting two nodes u and v), collect the traffic size data from node u to node v at different times, and calculate the traffic change rate from t1 to t2 using the formula Fuv = |Quv(t2)Quv(t1)| / Quv(t1);

[0128] Calculate the node risk coefficient S_{uv}: For each node in the network, first determine all security configuration items (such as whether the firewall is turned on, whether access control settings are made, whether system patches are updated regularly, etc.), and pre-set the corresponding weight w_sd for each security configuration (the weight value can be determined based on security expert evaluation or industry experience). At the same time, scan each node through the security detection tool to obtain the scores Cud and Cvd of each node in each security configuration, and then calculate the node risk coefficient between node u and node v according to the formula Suv = 1 / (1+∑w_sd×Cud×Cvd) (the sum range is all security configuration items). For example, suppose there are three safety configurations with weights w_s1=0.4, w_s2=0.3, and w_s3=0.3. The scores of node A and node B on these three safety configurations are CA1=1, CB1=1, CA2=0, CB2=1, CA3=1, and CB3=1, respectively. Then SAB=1 / [1+(0.4×1×1+0.3×0×1+0.3×1×1)]≈0.59. Similarly, the node risk coefficients corresponding to all edges can be calculated.

[0129] Calculate the historical attack frequency Huv: Collect the total number of network attacks on the entire network within the historical preset time range N, and count the number of network attacks on the link between node u and node v within the historical preset time range Nuv. Then calculate the historical attack frequency using the formula Huv = Nuv / N. For example, the enterprise network has been attacked 10 times in total in the past month, and the link between node C and node D has been attacked 2 times, then HCD = 0.2;

[0130] Calculate the edge weight Wuv: The edge weight between node u and node v is obtained according to the formula Wuv = (Fuv × Suv × Huv) / [√∑ (Fuk × Suk × Huk + ∈)^2]; where the summation range is all nodes k adjacent to node i, ∈ represents a correction constant to avoid the situation where the denominator is 0, which can be 10e-6; calculate the weights of all edges in the network topology model in turn;

[0131] E2, then based on the edge weights and combined with the path search algorithm, obtains the shortest attack path starting from the network attack node and greater than the preset weight threshold:

[0132] Taking the Dijkstra algorithm as an example, the network attack node is used as the starting point to search for paths in the network topology model where the edge weights have been calculated. During the search process, only those paths whose edge weights are greater than the preset weight threshold are recorded to filter out nodes with high security configurations and difficult to attack, and obtain the shortest attack path;

[0133] E3, count all nodes on the shortest attack path to obtain several impact nodes.

[0134] After obtaining the network attack node and several affected nodes, these nodes need to be isolated. For example, you can configure port security policies on the access layer switch to limit the node's network connection, such as directly shutting down the switch port to which the node is connected so that it can no longer communicate with other devices in the network; or use firewall rules to block all inbound and outbound network traffic of the node to prevent the impact from further expanding and reduce the losses caused by network attacks.

[0135] A second aspect of the present invention provides a network attack detection method based on deep learning, comprising:

[0136] S1, collect and obtain network topology data, network traffic data and device log data;

[0137] S2, set up data tracking points on key applications to obtain behavioral data of several users;

[0138] S3, using the user behavior pattern library to obtain abnormal operation devices according to the behavior data of several users; if yes, the user's terminal device is marked as an abnormal operation device; if no, the user's terminal device is marked as a normal operation device; wherein the user behavior pattern library is constructed based on a clustering algorithm;

[0139] S4, obtain the network traffic data and device log data of the abnormal operation device, obtain the abnormal data, and use the network attack detection model to determine whether the network of the abnormal operation device is normal according to the abnormal data; if yes, mark the abnormal operation device as a network attack node; if no, mark the abnormal operation device as a normal node; the network attack detection model is built based on the deep learning algorithm

[0140] S5, establishing a network topology model according to the network topology data, and using the network topology model to analyze the influence range of several network attack nodes to obtain several influence nodes;

[0141] S6, isolate the network attack node and several affected nodes.

[0142] Part of the data in the above formula is calculated by removing the dimension and taking its numerical value. The formula is a formula closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0143] Working principle of the present invention:

[0144] The data collection module obtains network topology data, network traffic data, and device log data, and sets data embedding points on key applications to obtain user behavior data, achieving comprehensive data collection and obtaining detailed information on network status and user behavior;

[0145] Through the behavior analysis module, the user behavior pattern library built based on the clustering algorithm is used to compare the similarity between the user behavior data and the data in the behavior pattern library, identify abnormal behaviors, and obtain abnormal operation devices;

[0146] Through the attack detection module, the network attack detection model built based on the deep learning algorithm is used to analyze the network traffic data and device log data of abnormal operation devices to determine whether the network status of the abnormal operation device is under attack;

[0147] Through the emergency processing module, a network topology model is established based on the network topology data. The model is used to analyze the impact range of network attack nodes, quickly locate the affected nodes, and isolate the network attack nodes and affected nodes to control the spread of the attack.

[0148] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network attack detection system based on deep learning, characterized in that: include: Data collection module: used to collect and obtain network topology data, network traffic data, device log data, and set data embedding points on key applications to obtain behavior data of several users; Behavior analysis module: used to obtain several abnormal operation devices according to the behavior data of several users by using the user behavior pattern library; wherein the user behavior pattern library is constructed based on the clustering algorithm; Attack detection module: used to obtain the network traffic data and device log data of the several abnormal operation devices and input them into the network attack detection model to determine whether the network of the several abnormal operation devices is normal; if yes, the abnormal operation device is marked as a network attack node; if not, the abnormal operation device is marked as a normal node; wherein the network attack detection model is constructed based on a deep learning algorithm; Emergency processing module: used to establish a network topology model based on network topology data, use the network topology model to analyze the influence range of several network attack nodes, obtain several affected nodes, and isolate several network attack nodes and several affected nodes.

2. The network attack detection system based on deep learning according to claim 1 is characterized in that: Setting data tracking points on key applications includes: A1, collects CPU usage, memory usage, disk read / write frequency, disk read / write data volume, network traffic, number of network connections, number of user accesses, and user roles of several applications within a preset time period to obtain several evaluation index data; A2, using the analytic hierarchy process to calculate the comprehensive scores of several applications according to several evaluation index data to obtain several comprehensive scores; A3, screening out corresponding applications whose comprehensive scores exceed a preset threshold to obtain key applications; A4, set up data tracking points on key applications, record the operation user, operation time, operation type and operation object, and obtain some behavioral data.

3. The network attack detection system based on deep learning according to claim 2 is characterized in that: The method uses the hierarchical analysis method to calculate the comprehensive scores of several applications according to several evaluation index data, including: A21, evaluate the relative importance of several evaluation indicators, obtain aij, and construct the criterion layer judgment matrix A based on aij; where aij represents the importance of the i-th evaluation indicator relative to the j-th evaluation indicator, and aii=1, aji=1 / aij, the size of the relative importance matrix is ​​n×n, and n represents the number of evaluation indicators; A22, evaluate the relative importance of several applications under several evaluation indicators, obtain bi_pq, and construct several solution-level judgment matrices Bi according to bi_pq; wherein Bi represents the solution-level judgment matrix of the i-th evaluation indicator, bi_pq represents the importance of the p-th application relative to the q-th application under the i-th evaluation indicator, and bi_pp=1, bi_qp=1 / bi_pq, the size of the judgment matrix is ​​m×m, and m represents the number of applications; A23, using the square root method to calculate the weight vector of A, and perform consistency check on A to determine whether the consistency ratio is less than a preset threshold; if yes, obtain the weight vector W; if no, jump to A21; where W = (w1, w2, w3, ..., wn); A24, calculate the weight vector of Bi using the square root method, and perform consistency check on Bi to determine whether the consistency ratio is less than a preset threshold; if yes, obtain the weight vector WB; if no, jump to A22; where WB = {(W11, W12, ..., W1m), (W21, W22, ..., W2m), ..., (Wn1, Wn2, ..., Wnm)}; A25, calculate the comprehensive score of the pth application according to the formula Rp=w1×W1p+w2×W2p+…+wn×Wnp, and traverse several applications to obtain several comprehensive scores.

4. The network attack detection system based on deep learning according to claim 1 is characterized in that: The user behavior pattern library is constructed based on a clustering algorithm and includes: B1, obtaining and preprocessing the historical behavior data of several users to obtain a historical behavior database; B2, clustering the historical behavior database using a clustering algorithm to obtain several clusters; B3, counting the number of data items in a number of clusters, and performing frequency classification on the number of clusters according to a data item number threshold to obtain a number of frequency categories; B4, obtaining several behavior categories according to the departments of the operating users in several clusters, the range of operation time, the operation type and the operation object, and using database technology to store several behavior categories and several frequency categories to obtain a user behavior pattern library.

5. The network attack detection system based on deep learning according to claim 1 is characterized in that: The method of using the user behavior pattern library to obtain a number of abnormal operation devices according to the behavior data of a number of users includes: C1, encode the user behavior pattern library and the behavior data of several users according to the department of the operating user, the operation time range, the operation type and the operation object, and obtain several standard feature vectors and several behavior feature vectors; C2, using cosine similarity to calculate the similarity between the current user's behavior feature vector and several standard feature vectors, to obtain the similarity vector M between the current user's behavior and several behavior categories; C3, weighted sum of several similarity values ​​in the similarity vector to obtain the behavior score of the current user; C4, compare whether the current user's behavior score is lower than the preset behavior score threshold; if yes, get the abnormal operation device; if no, get the normal operation device; C5, repeat C2C4 until the behavior data of several users are traversed and several abnormal operation devices are obtained.

6. The network attack detection system based on deep learning according to claim 1 is characterized in that: The network attack detection model is built based on a deep learning algorithm and includes: D1, obtaining and preprocessing historical network traffic data and historical device log data of several devices to obtain preprocessed data, and obtaining time series data based on the preprocessed data; D2, according to the historical network attack records, the time series data is categorized and labeled to obtain labeled data; the categories of the labeled data include normal network and network attack; D3, build a time series model based on the deep learning algorithm, input the time series data and the labeled data into the time series model according to the preset ratio for training, verification and testing, and obtain a pre-trained time series model that meets the test accuracy; D4, taking the pre-trained time series model as the final model, obtains a network attack detection model whose input is the network traffic data and device log data of the device and whose output is the network status of the device.

7. The deep learning-based network attack detection system according to claim 6, characterized in that: The step of obtaining time series data based on preprocessed data includes: D11, determining a time window size according to a preset time interval, and dividing the preprocessed data into a plurality of time windows based on the time window; D12, counting the total traffic volume, total data packets, proportion of different types of protocols, and usage frequency of different ports within several time windows to obtain network traffic data characteristics; D13, count the number of different types of events and the proportion of different HTTP response codes in several time windows to obtain the device log data characteristics; D14, the network traffic data features and device log data features in several time windows are combined into several feature vectors in chronological order to obtain time series data.

8. The network attack detection system based on deep learning according to claim 1 is characterized in that: The use of a network topology model to analyze the impact range of several network attack nodes includes: E1, calculates several edge weights in the network topology model according to the weight distribution formula; E2, using a path search algorithm, obtains several shortest attack paths starting from several network attack nodes and greater than a preset weight threshold; E3, count several nodes on several shortest attack paths and obtain several influential nodes.

9. A network attack detection system based on deep learning according to claim 8, characterized in that: The weight distribution formula is: Wuv = (Fuv × Suv × Huv) / [√∑ (Fuk × Suk × Huk + ∈) ^ 2]; where the summation range is all nodes k adjacent to the node i, ∈ represents a correction constant; Wuv represents the edge weight between node u and node v; Fuv represents the flow rate change rate, and Fuv = |Quv(t2)Quv(t1)| / Quv(t1), where Quv(t2) and Quv(t1) represent the flow size from node u to node v at time t1 and t2 respectively; Suv represents the node risk factor, and Suv = 1 / (1+∑w_sd×Cud×Cvd), the summation range is all safety configuration items, w_sd represents the weight of the d-th safety configuration, Cud and Cvd represent the scores of node u and node v on the d-th safety configuration respectively; Huv represents the historical attack frequency, and Huv=Nuv / N, N represents the total number of network attacks within the historical preset time range, and Nuv represents the number of network attacks on the link between node u and node v within the historical preset time range.

10. A network attack detection method based on deep learning, applied to the network attack detection system based on deep learning according to any one of claims 1 to 9, characterized in that: include: S1, collect and obtain network topology data, network traffic data and device log data; S2, set up data tracking points on key applications to obtain behavioral data of several users; S3, using the user behavior pattern library to obtain abnormal operation devices according to the behavior data of several users; If yes, the user's terminal device is marked as an abnormal operation device; If not, the user's terminal device is marked as a normal operating device; wherein the user behavior pattern library is constructed based on a clustering algorithm; S4, obtaining the network traffic data and device log data of the abnormal operation device, obtaining abnormal data, and using the network attack detection model to determine whether the network status of the abnormal operation device is normal according to the abnormal data; if yes, marking the abnormal operation device as a network attack node; if no, marking the abnormal operation device as a normal node; wherein the network attack detection model is constructed based on a deep learning algorithm S5, establishing a network topology model according to the network topology data, and using the network topology model to analyze the influence range of several network attack nodes to obtain several influence nodes; S6, isolate the network attack node and several affected nodes.

Images