A lightweight network attack detection method guided by deep feature aggregation

Abstract

The present invention relates to the field of network security technology, specifically to a lightweight network attack detection method guided by deep feature aggregation, comprising the following steps: collecting compressed data of a JPEG file and parsing the compressed domain structure, extracting discrete cosine transform coefficients for each compressed block in the compressed domain structure, dequantizing the coefficients in combination with a quantization table, recording the total amplitude of the frequency distribution of each block, and counting the change amplitude of the frequency amplitude between adjacent blocks to generate a frequency feature distribution table. In the present invention, by parsing the compressed domain structure of a JPEG file, extracting discrete cosine transform coefficients and dequantizing them in combination with a quantization table, the frequency characteristic values ​​and spatial distribution in the file can be more accurately restored. The sensitivity to changes in file characteristics is improved, especially the ability to capture subtle anomalies in frequency distribution. The local entropy value is calculated using the frequency change amplitude between adjacent blocks, and the entropy value change interval is marked and compared with a threshold, so that the abnormal local feature area can be accurately identified.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a lightweight network attack detection method guided by deep feature aggregation. Background Art

[0002] The field of network security technology is mainly used to protect the confidentiality, integrity and availability of network systems and their data, and to prevent, detect and respond to various network threats and attacks. This field covers encryption technology, access control, network protocol security, malware protection, intrusion detection and prevention, etc.

[0003] Among them, the network attack detection method refers to the method of identifying potential network attack behaviors or malware by analyzing network communication and file data characteristics through technical means. By detecting viruses in JPEG files and studying the format structure and abnormal characteristics of JPEG files, malicious codes embedded in images can be identified to prevent virus propagation and damage to information systems.

[0004] When detecting viruses in JPEG files, the existing technology relies more on static feature analysis of file data or matching of known feature patterns, which makes it difficult to deeply mine potential hidden information in the file. Due to the lack of detailed analysis of the internal features of the file compression domain, the dynamic relationship between the features is easily ignored, resulting in incomplete identification of attack behaviors with complex embedding methods. It is impossible to effectively quantify and judge the spatial changes in frequency distribution and abnormal fluctuations in local features, and it is easy to miss highly concealed malicious codes. In addition, the ability to analyze the periodic characteristics of the signal and its correlation with the spatial distribution characteristics is insufficient. This limitation makes the judgment of the embedding mode of advanced malicious code more vague. In the absence of multi-level feature extraction, it is impossible to intuitively mark the overall threat area of ​​the file, and it is difficult to quickly locate the attack hotspots, resulting in an expansion of the threat range and a decrease in detection efficiency. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and propose a lightweight network attack detection method guided by deep feature aggregation.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a lightweight network attack detection method guided by deep feature aggregation, comprising the following steps:

[0007] S1: Collect the compressed data of the JPEG file and parse the compressed domain structure, extract the discrete cosine transform coefficients for each compressed block in the compressed domain structure, dequantize the coefficients in combination with the quantization table, record the total amplitude of the frequency distribution of each block, count the change amplitude of the frequency amplitude between adjacent blocks, and generate a frequency feature distribution table;

[0008] S2: Based on the frequency feature distribution table, the entropy values ​​of all blocks are divided according to the gradient and the entropy value change intervals are marked, the entropy value change intervals exceeding the gradient change threshold are captured, and a selected gradient entropy distribution area table is generated;

[0009] S3: extracting the periodic characteristics of the discrete cosine transform coefficients in the selected gradient entropy distribution area table, analyzing the repetitive changes between the frequency components, judging the mutual enhancement degree between the periodic signal and the local entropy fluctuation according to the local entropy value fluctuation in the periodic signal distribution area, and generating a periodic signal enhancement area map;

[0010] S4: Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial positions in the enhanced signal coverage area are aggregated, the abnormality level of the feature points is calculated, and the abnormality level is mapped to the overall spatial distribution of the JPEG file to obtain a feature-aggregated JPEG network attack detection map.

[0011] As a further solution of the present invention, the step of obtaining the total amplitude of the frequency distribution of each block is specifically as follows:

[0012] S111: Based on the compressed data of the JPEG file, parse the file header to extract the image metadata, record the frequency component weight value in the quantization table, reconstruct the coding mapping relationship according to the Huffman table, obtain the block division information to locate the position and dimension of each image block, and extract the discrete cosine transform coefficient of each block to generate a frequency coefficient matrix;

[0013] S112: Based on the frequency coefficient matrix, the weight values ​​in the quantization table are matched item by item for inverse quantization, the frequency characteristic value and the total amplitude of each image block are obtained, and all image blocks are processed cyclically to generate a frequency amplitude data table for each block.

[0014] As a further solution of the present invention, the step of obtaining the frequency characteristic distribution table is specifically as follows:

[0015] S121: For the frequency amplitude data table of each block, the formula is used:

[0016]

[0017] Calculates the average change in the total amplitude of the normalized frequency distribution , get the frequency distribution change data between adjacent blocks;

[0018] in, is the total number of adjacent block pairs, Indicates the block pair number of the current statistics. It is the current Centering block The total amplitude of the frequency distribution, It is the current Centering and Blocks The total amplitude of the frequency distribution of adjacent blocks, and Respectively represent the index of the block in the horizontal and vertical directions;

[0019] S122: Based on the frequency distribution change data between the adjacent blocks, the image blocks are organized according to their spatial positions, the normalized frequency difference values ​​are mapped into a matrix, the change trend in the row and column directions of the matrix is ​​analyzed and statistics are performed, and a frequency feature distribution table is generated.

[0020] As a further solution of the present invention, the step of obtaining the selected gradient entropy distribution area table is specifically:

[0021] S211: Based on the data in the frequency characteristic distribution table, the formula is used:

[0022]

[0023] Calculate the The local entropy of the block , get the entropy value data of local adjacent blocks;

[0024] in, Indicates the frequency change amplitude category of the current statistics. It is In the block, the frequency change value belongs to The probability value of the category, is the total number of categories of frequency variation amplitude, Respectively represent the row index and column index of the block in the image;

[0025] S212: Based on the local adjacent block entropy data, the entropy value is divided into intervals according to the gradient range, and the number of blocks in each interval and their changes are counted, compared with the preset gradient change threshold, the significant gradient change interval is marked, and the selected gradient entropy distribution area table is generated.

[0026] As a further solution of the present invention, the step of acquiring the repeatability change between the analysis frequency components is specifically:

[0027] S311: based on the region information in the selected gradient entropy distribution region table, locate the index range of each image block, parse the discrete cosine transform coefficients of the block from the JPEG file, extract the coefficients according to the index order of the image block, and establish a discrete cosine transform coefficient matrix for the selected region;

[0028] S312: Based on the discrete cosine transform coefficient matrix of the selected area, the formula is:

[0029]

[0030] Calculate the repetition rate of a frequency component , and obtain the repeatability variation analysis results;

[0031] in, represents the block number within the cycle, Indicates The number of consistent frequency components between the blocks and the reference block, Indicates the total number of blocks involved in the comparison within the cycle.

[0032] As a further solution of the present invention, the step of acquiring the periodic signal enhancement area map is specifically:

[0033] S321: Based on the repeatability change analysis result, analyze the joint distribution of entropy value fluctuation and repetition rate block by block, determine the mutual enhancement degree between the periodic signal and the entropy fluctuation, and generate enhanced area range data;

[0034] S322: Based on the enhanced area range data, the position and features of the enhanced signal block are extracted, and the positions and features are organized into a data table including multiple attributes such as position index, enhanced signal strength, and fluctuation amplitude. Feature points are annotated by data visualization to obtain a periodic signal enhancement area map.

[0035] As a further solution of the present invention, the step of obtaining the abnormality level of the calculated feature point is specifically:

[0036] S411: Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial position data in the enhanced signal coverage area are extracted and archived, and the frequency component values, entropy value gradient changes and spatial position coordinates are aggregated and classified to establish the joint distribution data of frequency points and entropy value gradient changes;

[0037] S412: Based on the joint distribution data of the frequency points and the entropy value gradient change, the formula is used:

[0038]

[0039] Calculating the anomaly level , get the abnormal level data of the feature points;

[0040] in, is the weight of the frequency feature, is the frequency component of the feature point, is the weight of the spatial position, is the spatial position index of the feature point.

[0041] As a further solution of the present invention, the steps of obtaining the feature-aggregated JPEG network attack detection graph are specifically as follows:

[0042] S421: Based on the abnormality level data of the feature points, extract the block information of the JPEG file, obtain the abnormality level value and the corresponding two-dimensional spatial coordinates of each block, create a two-dimensional matrix to represent the spatial distribution of the JPEG file, fill in the abnormality level value of each block, and visualize it to generate an abnormality level distribution map of the entire JPEG file;

[0043] S422: Based on the overall anomaly level distribution map of the JPEG file, blocks with anomaly levels higher than a preset anomaly threshold are screened one by one and two-dimensional coordinates are extracted, spatial aggregation analysis is performed, threat blocks are grouped and marked, and a feature-aggregated JPEG network attack detection map is generated.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are:

[0045] In the present invention, by parsing the compression domain structure of the JPEG file, extracting the discrete cosine transform coefficients and combining them with the quantization table for dequantization, the frequency characteristic values ​​and spatial distribution in the file can be restored more accurately. The sensitivity to changes in file characteristics is improved, especially the ability to capture subtle anomalies in frequency distribution. The local entropy value is calculated using the frequency change amplitude between adjacent blocks, and the entropy value change interval is marked and compared with the threshold, so that the abnormal local feature area can be accurately identified. The combination of this entropy value calculation and gradient analysis makes the positioning of potential attack behaviors hidden in the file more accurate. The extraction of periodic signals and enhanced regional analysis not only improves the detection ability of concealed attacks by deeply exploring the repetitive change characteristics of discrete cosine transform coefficients, but also can identify specific signal patterns and form targeted threat judgments. Based on the joint distribution of frequency feature points and entropy value changes, an abnormal level classification system is constructed, and the results are mapped to the spatial distribution of the file, which strengthens the intuitive presentation of the file threat area as a whole and improves the ability to capture potential threats in JPEG files. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the main steps of the present invention;

[0047] Figure 2 A flow chart for recording the total amplitude of the frequency distribution of each block for the present invention;

[0048] Figure 3 A flow chart for obtaining a frequency characteristic distribution table for the present invention;

[0049] Figure 4 A flow chart for obtaining a selected gradient entropy distribution area table for the present invention;

[0050] Figure 5 A flow chart for analyzing the repetitive changes between frequency components of the present invention;

[0051] Figure 6 A flow chart of obtaining a periodic signal enhancement area map according to the present invention;

[0052] Figure 7 A flow chart of calculating the abnormal level of feature points according to the present invention;

[0053] Figure 8 The present invention is a flowchart for obtaining a feature-aggregated JPEG network attack detection graph. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0055] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0056] See also Figure 1 The present invention provides a technical solution: a lightweight network attack detection method guided by deep feature aggregation, comprising the following steps:

[0057] S1: Collect the compressed data of JPEG files, including file header, quantization table, Huffman table and block division information, parse the compression domain structure of the file, extract discrete cosine transform coefficients for each compressed block in the compression domain structure, dequantize the coefficients in combination with the quantization table to restore the relative frequency characteristic value, record the total amplitude of the frequency distribution of each block, and combine the spatial distribution of the blocks to count the change amplitude of the frequency amplitude between adjacent blocks to generate a frequency characteristic distribution table;

[0058] S2: Based on the frequency feature distribution table, calculate the local entropy value between adjacent blocks according to the frequency change amplitude between adjacent blocks, divide the entropy values ​​of all blocks according to the gradient and mark the entropy value change interval, compare the entropy value change interval with the preset gradient change threshold, capture the entropy value change interval that exceeds the gradient change threshold, and generate the selected gradient entropy distribution area table;

[0059] S3: extract the periodic characteristics of the discrete cosine transform coefficients in the selected gradient entropy distribution area table, sort the coefficients according to the block index, analyze the repetitive changes between the frequency components, and determine the degree of mutual enhancement between the periodic signal and the local entropy fluctuation according to the local entropy value fluctuation in the periodic signal distribution area, record the position and feature points of the enhanced signal area, and generate a periodic signal enhancement area map;

[0060] S4: Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial positions in the enhanced signal coverage area are aggregated, the joint distribution of the frequency points and the entropy value gradient change is extracted, the feature point classification index is established according to the frequency weight and spatial position, the abnormal level of the feature point is calculated, and the abnormal level is mapped to the overall spatial distribution of the JPEG file to form a threat area mark of the file block, and a feature-aggregated JPEG network attack detection map is obtained;

[0061] The frequency feature distribution table includes the inverse quantization value of the discrete cosine transform coefficient of the compressed block, the frequency component amplitude distribution, the difference in frequency amplitude change between the block and the adjacent blocks, and the spatial position index of each block. The selected gradient entropy distribution area table includes the area index exceeding the gradient change threshold, the entropy value change interval mark of the area, and the local entropy value fluctuation range of the frequency component in the area. The periodic signal enhancement area map includes the area position index of the periodic signal distribution, the main frequency value and signal amplitude of the periodic enhanced signal, and the local entropy value fluctuation range covered by the enhanced signal. The feature-aggregated JPEG network attack detection map includes the spatial position mark of the abnormal area, the classified abnormal level of the feature points in each abnormal area, and the joint distribution mapping of the frequency feature points and the entropy value gradient change.

[0062] See also Figure 2 , the specific steps for obtaining the total amplitude of the frequency distribution of each block are:

[0063] S111: Based on the compressed data of the JPEG file, parse the file header to extract the image metadata, record the frequency component weight value in the quantization table, reconstruct the coding mapping relationship according to the Huffman table, obtain the block division information to locate the position and dimension of each image block, and extract the discrete cosine transform coefficient of each block to generate a frequency coefficient matrix;

[0064] Collect the compressed data of JPEG files, including file header, quantization table, Huffman table and block division information. First, open the JPEG file with Hex editing software (such as HxD or 010Editor) to extract the file header information. The file header includes metadata such as the start flag, image width, height, color mode, etc. These information are obtained by parsing the JPEG file format specification. Then locate the quantization table segment and use the segment identifier defined by the JPEG standard (such as 0xFFDB) to parse the quantization table data and record the weight value used to quantize the frequency component in each table. Determine the quantization table range by the segment starting position and length, then extract the Huffman table, use the JPEG Huffman coding segment identifier (0xFFC4) to parse the coding symbols and their corresponding bit lengths contained in this part, and construct the Huffman decoding mapping table. You can combine the Pillow library in Python to complete data extraction and decoding mapping relationship reconstruction. Finally, the block division information is parsed, and the spatial position and dimension of each block in the image are determined according to the sampling factor (extracted through the file header). Then the compressed domain data is read block by block, and the compressed data is restored to a symbol stream using the Huffman decoding algorithm. By matching the symbols with the discrete cosine transform (DCT) table in the JPEG standard, the corresponding DCT coefficients are extracted to generate each frequency coefficient matrix.

[0065] S112: Based on the frequency coefficient matrix, the weight values ​​in the quantization table are matched item by item for inverse quantization, the frequency characteristic value and the total amplitude of each image block are obtained, and all image blocks are processed cyclically to generate a frequency amplitude data table for each block;

[0066] The discrete cosine transform coefficients are dequantized in combination with the quantization table to restore the relative frequency characteristic values. First, the DCT coefficient matrix of each image block is processed item by item. By using Python's NumPy library to process matrix operations, the quantization table data obtained by the previous analysis is read to determine the quantization factor corresponding to each frequency component. The quantization factor is matched and multiplied with the value in the DCT coefficient matrix one by one to restore the actual characteristic value of the frequency component. For each image block, the total amplitude of the frequency component is calculated, and the total frequency amplitude of the block is obtained by accumulating the absolute value of the frequency characteristic value after dequantization item by item. This process is executed cyclically for all image blocks, and finally a frequency amplitude data table for each block is formed.

[0067] See also Figure 3 , the specific steps for obtaining the frequency characteristic distribution table are:

[0068] S121: For the frequency amplitude data table of each block, use the formula:

[0069]

[0070] Calculates the average change in the total amplitude of the normalized frequency distribution , get the frequency distribution change data between adjacent blocks;

[0071] in, is the total number of adjacent block pairs, which is directly calculated by counting the number of blocks and the adjacent relationship. It is the index variable for summation, indicating the number of the block pair currently being counted, and its value range is 1 to , It is the current The absolute difference in the total amplitude of the frequency distribution between adjacent blocks represents the intensity of the difference in frequency characteristics between the two blocks. It is the current Centering block The total amplitude of the frequency distribution of is obtained by taking the absolute value of the inverse quantized value of each frequency component in the block and summing them up, for example: , is the discrete cosine transform coefficient matrix The frequency component of a position, indicating the frequency intensity of that position, is parsed from the compressed domain data in the JPEG file. is the corresponding quantization factor, which comes from the quantization table parsed from the JPEG file. is the row index in the DCT coefficient matrix (the frequency component in the vertical direction), is the column index in the DCT coefficient matrix (the frequency component in the horizontal direction), Is the current Centering and Blocks The total amplitude of the frequency distribution of adjacent blocks is calculated in the same way , obtained by summing the absolute values, Is the current The sum of the total amplitude of the frequency distribution of two adjacent blocks is used for normalization processing to eliminate the scale effect of the frequency distribution amplitude. and Respectively represent the horizontal and vertical indexes of the block. For example, the block is located at Line List.

[0072] If the total amplitude of the frequency distribution of the first pair of adjacent blocks is 120 and 100, the normalized difference is:

[0073]

[0074] Find the normalized average: Assuming there are 3 pairs of adjacent blocks, their normalized difference values ​​are 0.091, 0.05, and 0.12 respectively, then the average is:

[0075]

[0076] The results show that the average change in the total amplitude of the normalized frequency distribution is .

[0077] S122: Based on the frequency distribution change data between adjacent blocks, the image blocks are organized according to their spatial positions, the normalized frequency difference values ​​are mapped into a matrix, the change trend in the row and column directions of the matrix is ​​analyzed and counted, and a frequency feature distribution table is generated;

[0078] According to the calculation results, the frequency amplitude change range between adjacent blocks is counted to generate a frequency feature distribution table. First, the normalized frequency difference value of each pair of adjacent blocks is spatially mapped and organized into a matrix data table according to the coordinate position of the image block. Each unit of the matrix records the normalized difference value of the adjacent block pair. For example, Unit Record Block The block on its right The difference value of Unit Record Block The block below it The difference value is calculated, and then the local change trend of the data in the matrix is ​​counted in the row and column directions respectively. The change mean is calculated for the difference values ​​of adjacent blocks in each row, and the frequency distribution change characteristics in the horizontal direction are recorded in the form of row vectors. At the same time, the change mean is calculated for the difference values ​​of adjacent blocks in each column, and the frequency distribution change characteristics in the vertical direction are recorded in the form of column vectors. Finally, a two-dimensional matrix containing the change characteristics of the overall frequency distribution of the image is formed. The matrix is ​​stored as a frequency feature distribution table, and a heat map or bar chart is generated through a visualization tool to visually reflect the changes in the global and local frequency distribution of the image, providing a data basis for further frequency characteristic analysis and image feature extraction.

[0079] See also Figure 4 , the steps for obtaining the selected gradient entropy distribution area table are as follows:

[0080] S211: Based on the data in the frequency characteristic distribution table, the formula is:

[0081]

[0082] Calculate the The local entropy of the block , get the entropy value data of local adjacent blocks;

[0083] in, Used to measure the image The frequency of the block changes complexity or the uncertainty of the information, Indicates the frequency change amplitude category of the current statistics, ranging from 1 to , It is In the block, the frequency change value belongs to The probability value of a category indicates the proportion of the frequency change amplitude of the category in the total change amplitude. The frequency change amplitude of all adjacent blocks in the block is divided into data according to the set category range, and the frequency change amplitude of all adjacent blocks in the block is calculated. The frequency change amplitude of each class is obtained by the proportion of the number of classes. For example, it is divided into 10 classes, each class represents a fixed range of frequency change amplitude. It is the total number of frequency change amplitude categories, which is determined by analyzing the range and distribution of frequency change amplitudes between adjacent blocks. It can be adaptively classified using equal spacing or based on the histogram distribution of the data. It is a logarithmic operator, used to calculate the entropy component of the probability value of the category, usually using the natural logarithm ( ) or base 2 logarithm, depending on the specific application, Represents the row index and column index of the block in the image, which are used to locate the The specific location of the block in the image.

[0084] Statistical histogram, if the The frequency variation amplitude of the block has the following distribution (normalized): , and divide these data into 3 categories (such as: , , ), count the frequency change amplitude of each category:

[0085] Category 1 : 4 values ​​with probability ;

[0086] Category 2 : 3 values ​​with probability ;

[0087] Category 3 : 3 values ​​with probability ;

[0088] Substitute the formula to calculate the entropy value:

[0089]

[0090] Compute the log and entropy components separately for each class:

[0091]

[0092] Use natural logarithms:

[0093]

[0094] The results show that the entropy value About 1.1.

[0095] S212: Based on the local adjacent block entropy value data, the entropy value is divided into intervals according to the gradient range, and the number of blocks contained in each interval and their changes are counted, compared with the preset gradient change threshold, and the significant gradient change interval is marked to generate a selected gradient entropy distribution area table;

[0096] The calculated entropy value of approximately 1.1 is used as the basis for analysis, and the entropy values ​​of all image blocks are divided according to the gradient range. First, the entropy values ​​of all blocks are sorted. For example, the intervals are divided according to the gradient interval of 0.1 to form multiple gradient intervals such as [1.0, 1.1), [1.1, 1.2), etc. The number of blocks contained in each gradient interval is counted and the interval number is marked. Then, the change gradient of the number of blocks in adjacent intervals is calculated. For example, the interval [1.0, 1.1) contains 8 blocks, and the interval [1.1, 1.2) contains 15 blocks, then the gradient change value is 15-8=7. Compare these gradient change values ​​with the preset gradient change threshold. Assuming the gradient change threshold is 5, mark all interval numbers with change values ​​greater than 5, for example, [1.1, 1.2) is marked as a significant gradient change interval. At the same time, record the specific coordinates of the image blocks contained in the corresponding interval, such as blocks (2, 3), (3, 4), etc. Finally, generate a selected gradient entropy distribution area table, which includes significant interval numbers, entropy value ranges, gradient change values ​​and corresponding block coordinates. These data are used to identify areas with significant frequency changes, providing support for subsequent image feature analysis.

[0097] See also Figure 5 , the steps for obtaining the repeatability changes between the frequency components are as follows:

[0098] S311: based on the region information in the selected gradient entropy distribution region table, locate the index range of each image block, parse the discrete cosine transform coefficients of the block from the JPEG file, extract the coefficients according to the index order of the image block, and establish a discrete cosine transform coefficient matrix for the selected region;

[0099] According to the regional information provided in the selected gradient entropy distribution area table, the discrete cosine transform coefficients are extracted and their periodic characteristics are analyzed. First, the index range of each image block is located according to the significant areas marked in the table, and the discrete cosine transform coefficients of these blocks are parsed from the JPEG file. The coefficients are extracted according to the index order of the image blocks, ensuring that the coefficients are stored in the order of the image blocks in space. The extracted discrete cosine transform coefficients are arranged into a matrix, each row of the matrix corresponds to a block, and each column corresponds to the value of a certain frequency component. The discrete cosine transform coefficient data is recorded row by row according to the block index for subsequent frequency component repeatability and periodicity analysis.

[0100] S312: Based on the discrete cosine transform coefficient matrix of the selected region, the formula is:

[0101]

[0102] Calculate the repetition rate of a frequency component , and obtain the repeatability variation analysis results;

[0103] in, It is used to quantify the degree of repeatability of frequency components between adjacent blocks or a group of blocks within a specific period. The unit is a dimensionless value with a range of , the higher the value, the more significant the repeatability of the frequency component. Represents the block number within the cycle, ranging from 1 to , Indicates The number of consistent frequency components between a block and its reference block is obtained by comparing the DCT frequency components of the current block and its adjacent block (such as the previous block) item by item. Indicates the total number of blocks involved in the comparison within the period. For example, for an area with a period of 8×8, , directly obtained according to the periodic law of image block division.

[0104] Assume that there are 5 blocks in a cycle, and the block numbers are 1, 2, 3, 4, and 5, respectively. Their DCT frequency components are: Block 1: , block 2: , block 3: , block 4: , block 5: , compare the DCT frequency components of each block with its reference block item by item, and count the number of consistent frequency components: Block 2 and Block 1: consistent components , , Block 3 and Block 2: consistent components , , Block 4 and Block 3: consistent components , , Block 5 and Block 4: consistent components , , , (Assuming that the DCT frequency components are 8).

[0105] Substituting the number of consistent components into the formula:

[0106]

[0107]

[0108] It means that within the period, the average repetition rate of the frequency components between blocks is 57.5%, indicating that there is a moderate degree of frequency component consistency between these blocks. If it is close to 1, it means that the frequency component has high repetitiveness and there is a strong periodicity feature between blocks. Close to 0, it means that the frequency component has low repeatability and unclear periodicity.

[0109] See also Figure 6 , the specific steps for obtaining the periodic signal enhancement area map are:

[0110] S321: Based on the repeatability change analysis result, analyze the joint distribution of entropy value fluctuation and repetition rate block by block, determine the mutual enhancement degree between the periodic signal and the entropy fluctuation, and generate enhanced area range data;

[0111] For the local entropy fluctuations in the periodic signal distribution area, the mutual enhancement degree between the periodic signal and the local entropy fluctuations is determined based on the average repetition rate of the frequency components calculated previously. , extract the local entropy value within the periodic signal distribution area, for example, a certain area contains 4 entropy values, which are , , , , calculate the volatility index based on the distribution of these entropy values, such as using the standard deviation or the maximum difference as the quantitative basis of the fluctuation amplitude, assuming that the calculated entropy value fluctuation standard deviation is 0.15, combined with the frequency component repetition rate The level of mutual enhancement between periodic signals and entropy fluctuations is evaluated to determine the degree of mutual enhancement between periodic signals and entropy fluctuations. The specific judgment process includes: first, the entropy fluctuations and repetition rates are divided into high, medium and low level ranges, for example, the entropy fluctuation standard deviation is higher than 0.1 for high level, and the frequency component repetition rate is higher than 0.5 for high level. When the entropy fluctuation standard deviation in the region is at a high level and the frequency component repetition rate also reaches a high level, the region is recorded as a region where periodic signals and entropy fluctuations are mutually enhanced. If any of the two does not reach a high level, the mutual enhancement effect is judged to be weak, and the regional characteristics are marked as non-enhanced regions. By analyzing the joint distribution of the above entropy fluctuations and repetition rates block by block, the regional range of the enhanced signal is finally obtained, providing a basis for subsequent characteristic recording.

[0112] S322: Based on the enhanced area range data, extract the position and features of the enhanced signal block, organize it into a data table containing multiple attributes such as position index, enhanced signal strength, and fluctuation amplitude, annotate the feature points in a data visualization manner, and obtain a periodic signal enhancement area map;

[0113] First, the specific image coordinates of each enhanced signal block are extracted from the mutual enhancement region of the periodic signal and the local entropy fluctuation. For example, the region index is , Etc., archive these coordinates one by one, and record the average repetition rate of the frequency components and the entropy fluctuation characteristics in the region. For example, the average repetition rate of the frequency components is 0.575, and the standard deviation of the entropy fluctuation is 0.15, and they are uniformly organized into a data table containing attributes such as position index, enhanced signal strength, and fluctuation amplitude. Subsequently, the regional information in the data table is visualized. Common data visualization and image processing software, such as Matplotlib and Seaborn libraries in Python, can be used to map the enhanced signal intensity to different colors through grayscale or heat map to generate an image reflecting the regional distribution characteristics. In addition, the image annotation of the enhanced region can also be processed in combination with OpenCV, and the feature points can be marked on the heat map or grayscale map. The periodic signal enhancement region map is generated through Matplotlib, and the significant feature points of the enhanced region are marked, such as the region with the largest entropy fluctuation or the region with the highest frequency component repetition rate. Finally, an image containing the enhanced regional distribution and feature point annotations is output, which provides an intuitive reference for further analysis of the spatial characteristics of periodic signals.

[0114] See also Figure 7 , the specific steps for calculating the abnormal level of feature points are:

[0115] S411: Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial position data in the enhanced signal coverage area are extracted and archived, and are aggregated according to the frequency component value, entropy value gradient change and spatial position coordinates, and classified and processed to establish the joint distribution data of frequency points and entropy value gradient change;

[0116] First, extract the frequency feature point data in each enhanced signal coverage area, including its frequency component value, entropy gradient change and corresponding spatial position coordinates. These data can be obtained by analyzing the periodic signal enhancement area map. Then, the frequency feature point data is normalized according to the entropy gradient and frequency weight to ensure that different indicators have the same numerical range for subsequent analysis and classification. After normalization, classify the feature point data according to the frequency weight and spatial position, and divide the frequency feature points according to the entropy gradient change and the significance of the frequency repetition rate. For example, by setting the entropy gradient to account for 60% and the frequency weight to account for 40%, the comprehensive characteristic value of the feature point is measured, thereby generating classification indicators for each feature point and forming a preliminary classification standard.

[0117] S412: Based on the joint distribution data of frequency points and entropy gradient changes, the formula is:

[0118]

[0119] Calculating the anomaly level , get the abnormal level data of the feature points;

[0120] in, Used to quantify the potential threat of JPEG file blocks. The higher the value, the greater the possibility of abnormal activity in the JPEG block. It is the weight of the frequency characteristic, reflecting the contribution of the frequency characteristic to the abnormal level. and In the process, we first collect data of a series of known abnormal and non-abnormal JPEG file blocks, and perform statistical analysis on these data to determine the frequency characteristics. and spatial position index The relative importance in distinguishing anomalous from non-anomalous JPEG blocks. For example, suppose 100 JPEG blocks are analyzed, 50 of which are marked as anomalous. By obtaining the and , find the abnormal block The average value is significantly higher than that of non-anomalous blocks, while The difference is not so significant, and the linear regression model is further used to evaluate and The regression analysis results show that the explanatory power of abnormal markers is The coefficient is significantly higher than ,hint It is more important when predicting anomalies. Based on these analysis results, you can set and This weight distribution reflects the dominant role of frequency features in anomaly detection. Although spatial position is also important, it has a smaller impact. This weight setting helps ensure that the model can focus on frequency features with more diagnostic value when judging whether a JPEG block is abnormal. It is the frequency component of the feature point, describing the frequency characteristics of the JPEG block, such as the degree of change of the discrete cosine transform coefficient. is the weight of the spatial position, reflecting the contribution of the position information to the anomaly level. It is the spatial position index of the feature point, which is obtained based on the position of the block in the JPEG file.

[0121] For example, a set of JPEG blocks are known to be marked as anomalous, where the frequency components The average value is 0.75, and the spatial position index The average value is 0.5. Through regression analysis, it is determined and Best for distinguishing anomalous from non-anomalous JPEG blocks.

[0122] Assume that a JPEG block (higher than the historical average, meaning larger changes) and (lower than the historical average and more centrally located).

[0123] Application formula:

[0124]

[0125] The results show that the obtained anomaly level is 0.6.

[0126] See also Figure 8 ,The steps to obtain the feature aggregated JPEG network attack detection graph are as follows:

[0127] S421: Based on the abnormality level data of the feature points, extract the block information of the JPEG file, obtain the abnormality level value and the corresponding two-dimensional spatial coordinates of each block, create a two-dimensional matrix to represent the spatial distribution of the JPEG file, fill in the abnormality level value of each block, and visualize it to generate an abnormality level distribution map of the entire JPEG file;

[0128] Based on the data with an anomaly level of 0.6, by reading the block information and anomaly level of the JPEG file, the anomaly level value of each block is matched with the two-dimensional spatial coordinates of the image. The OpenCV library in Python is used to perform image block parsing, and the image size and block configuration parameters, such as the width, height, and total number of rows and columns of each block, are extracted from the JPEG file header, and this information is associated with the anomaly level of each block. Next, a two-dimensional matrix is ​​created to represent the spatial distribution of the entire JPEG file, where each cell of the matrix represents an image block, and the values ​​in the matrix are filled with the anomaly level of the corresponding block. The distribution matrix is ​​processed using NumPy to ensure that the position and anomaly level of each block correspond correctly. The matrix data is visualized through Matplotlib to generate an anomaly level distribution map of the entire image. The color or brightness of each block in the image reflects its anomaly level value, forming an overall spatial distribution map of the JPEG file for subsequent threat area marking and analysis.

[0129] S422: Based on the anomaly level distribution map of the entire JPEG file, blocks with anomaly levels higher than a preset anomaly threshold are screened one by one and their two-dimensional coordinates are extracted, spatial aggregation analysis is performed, threat blocks are grouped and marked, and a feature-aggregated JPEG network attack detection map is generated;

[0130] By reading the anomaly level value of each block in the distribution matrix block by block, the blocks with anomaly levels higher than the preset anomaly threshold (such as 0.5) are marked as threat areas, and the two-dimensional coordinates of these blocks are extracted using the conditional screening method. Through visualization tools such as Matplotlib, the extracted threat blocks are marked with significant colors in the image to ensure that the threat areas are clearly visible on the overall distribution map of the JPEG file. Subsequently, the marked threat areas are aggregated and analyzed, and the threat blocks are grouped according to spatial proximity to form a coherent threat area. Color gradients or symbols are used to distinguish areas with different threat levels, and a complete detection map containing all threat area markers is generated. The final output JPEG network attack detection map highlights feature aggregation and threat areas through color, shape or border, which facilitates the identification of potential risk blocks and key locations in JPEG files.

[0131] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A lightweight network attack detection method guided by deep feature aggregation, characterized in that: The following steps are involved: Collect the compressed data of JPEG files and parse the compressed domain structure, extract the discrete cosine transform coefficients for each compressed block in the compressed domain structure, dequantize the coefficients in combination with the quantization table, record the total amplitude of the frequency distribution of each block, count the change amplitude of the frequency amplitude between adjacent blocks, and generate a frequency feature distribution table; Based on the frequency feature distribution table, the entropy values ​​of all blocks are divided according to the gradient and the entropy value change intervals are marked, the entropy value change intervals exceeding the gradient change threshold are captured, and a selected gradient entropy distribution area table is generated; Extracting the periodic characteristics of discrete cosine transform coefficients in the selected gradient entropy distribution area table, analyzing the repetitive changes between frequency components, judging the mutual enhancement degree between the periodic signal and the local entropy fluctuation for the local entropy value fluctuation in the periodic signal distribution area, and generating a periodic signal enhancement area map; The steps for obtaining the repeatability change between the analysis frequency components are specifically as follows: Based on the region information in the selected gradient entropy distribution region table, locate the index range of each image block, parse the discrete cosine transform coefficients of the block from the JPEG file, extract the coefficients according to the index order of the image block, and establish a discrete cosine transform coefficient matrix for the selected region; Based on the discrete cosine transform coefficient matrix of the selected area, the formula is adopted: Calculate the repetition rate of a frequency component , and obtain the repeatability variation analysis results; in, represents the block number within the cycle, Indicates The number of consistent frequency components between the block and the reference block, Indicates the total number of blocks involved in the comparison within the cycle; The steps for obtaining the periodic signal enhancement area map are specifically as follows: Based on the repeatability change analysis results, the joint distribution of entropy value fluctuation and repetition rate is analyzed block by block, the mutual enhancement degree between the periodic signal and the entropy fluctuation is determined, and the enhancement area range data is generated; Based on the enhanced area range data, the position and features of the enhanced signal block are extracted, and the enhanced signal block is sorted into a data table including multiple attributes such as position index, enhanced signal strength, and fluctuation amplitude, and the feature points are annotated in a data visualization manner to obtain a periodic signal enhancement area map; Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial positions in the enhanced signal coverage area are aggregated, the abnormality level of the feature points is calculated, and the abnormality level is corresponded to the overall spatial distribution of the JPEG file to obtain a feature-aggregated JPEG network attack detection map; The steps for obtaining the abnormal level of the calculated feature point are specifically as follows: Based on the data in the periodic signal enhancement area map, the frequency feature points and spatial position data in the enhanced signal coverage area are extracted and archived, aggregated according to the frequency component value, entropy value gradient change and spatial position coordinates, and classified and processed to establish the joint distribution data of frequency points and entropy value gradient change; Based on the joint distribution data of the frequency points and the entropy value gradient change, the formula is adopted: Calculating the anomaly level , get the abnormal level data of the feature points; in, is the weight of the frequency feature, is the frequency component of the feature point, is the weight of the spatial position, is the spatial position index of the feature point.

2. According to claim 1, the lightweight network attack detection method guided by deep feature aggregation is characterized in that: The specific steps of obtaining the total amplitude of the frequency distribution of each block are as follows: Based on the compressed data of JPEG files, the file header is parsed to extract image metadata, the quantization table records the frequency component weight values, the coding mapping relationship is reconstructed according to the Huffman table, the block division information is obtained to locate the position and dimension of each image block, and the discrete cosine transform coefficients of each block are extracted to generate a frequency coefficient matrix; Based on the frequency coefficient matrix, the weight values ​​in the quantization table are matched item by item for inverse quantization, the frequency characteristic value and the total amplitude of each image block are obtained, and all image blocks are processed cyclically to generate a frequency amplitude data table for each block.

3. The light-weight network attack detection method guided by deep feature aggregation according to claim 2 is characterized in that: The steps of obtaining the frequency characteristic distribution table are specifically as follows: For the frequency amplitude data table of each block, the formula is used: Calculates the average change in the total amplitude of the normalized frequency distribution , get the frequency distribution change data between adjacent blocks; in, is the total number of adjacent block pairs, Indicates the block pair number of the current statistics. It is the current Centering block The total amplitude of the frequency distribution, It is the current Centering and Blocks The total amplitude of the frequency distribution of adjacent blocks, and Respectively represent the index of the block in the horizontal and vertical directions; Based on the frequency distribution change data between the adjacent blocks, the image blocks are organized according to their spatial positions, the normalized frequency difference values ​​are mapped into a matrix, the change trends in the row and column directions of the matrix are analyzed and statistically analyzed, and a frequency feature distribution table is generated.

4. The light-weight network attack detection method guided by deep feature aggregation according to claim 3 is characterized in that: The steps of obtaining the selected gradient entropy distribution area table are specifically as follows: Based on the data in the frequency characteristic distribution table, the formula is adopted: Calculate the The local entropy of the block , get the entropy value data of local adjacent blocks; in, Indicates the frequency change amplitude category of the current statistics. It is In the block, the frequency change value belongs to The probability value of the category, is the total number of categories of frequency variation amplitude, Respectively represent the row index and column index of the block in the image; Based on the local adjacent block entropy data, the entropy value is divided into intervals according to the gradient range, and the number of blocks in each interval and their changes are counted, compared with the preset gradient change threshold, the significant gradient change interval is marked, and the selected gradient entropy distribution area table is generated.

5. The light-weight network attack detection method guided by deep feature aggregation according to claim 1 is characterized in that: The steps for obtaining the feature-aggregated JPEG network attack detection graph are specifically as follows: Based on the abnormality level data of the feature points, the block information of the JPEG file is extracted, the abnormality level value and the corresponding two-dimensional spatial coordinates of each block are obtained, a two-dimensional matrix is ​​created to represent the spatial distribution of the JPEG file, the abnormality level value of each block is filled, and visualization is performed to generate an abnormality level distribution map of the entire JPEG file; Based on the overall anomaly level distribution map of the JPEG file, blocks with anomaly levels higher than a preset anomaly threshold are screened one by one and two-dimensional coordinates are extracted. Spatial aggregation analysis is performed, threat blocks are grouped and marked, and a feature-aggregated JPEG network attack detection map is generated.

Images