Network defense method and device based on unknown attack detection, equipment and medium

Abstract

The invention relates to the technical field of network security, and discloses an unknown attack-based network defense method, which comprises the following steps of: dividing according to tuple information of a network data packet to obtain a network data stream; aggregating communication nodes of the network data packet to obtain a data communication channel; performing feature statistics and original byte extraction on the data stream to obtain a preprocessed network stream, and enhancing the preprocessed network stream to obtain an enhanced network stream; optimizing network parameters through a joint loss function to obtain an optimized feature vector; extracting feature vectors by freezing parameters of the triple network, and training a single classifier to obtain a trained single classifier; and based on the feature vector, judging a preset test sample to be benign or malicious, and when the test passes, obtaining a trained attack distinguishing model, and performing unknown attack detection. The invention further provides a network defense device and equipment based on the unknown attack and a storage medium. According to the method, the detection capability of unknown network attacks can be coped, and the security of network protection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network defense method, device, equipment and medium based on unknown attacks. Background Art

[0002] With the continuous development of network technology, network systems are gradually playing an increasingly important role in many application fields such as power system management, drone control and transportation. State estimation of networked systems can provide accurate and real-time system status. However, the openness of networked systems also makes them vulnerable to network intrusions, which leads to data congestion and accidental loss of some collected data, posing a huge threat to network security and information data security. As an important technology for detecting network attacks and ensuring organizational security, network intrusion detection is widely used to monitor traffic in and out of the network and discover possible security threats.

[0003] Most of the existing network intrusion detection methods use benign traffic to train detection models, while ignoring the useful data contained in known attack samples, resulting in poor recognition accuracy for unknown attack types. In addition, most of the existing detection models are supervised learning methods, and their ability to recognize attack types that do not appear in the training set is very limited.

[0004] The above defects deserve improvement. Summary of the invention

[0005] The present invention provides a network defense method, device, equipment and medium based on unknown attacks, the main purpose of which is to improve the security of network protection.

[0006] To achieve the above object, the present invention provides a network defense method based on unknown attacks, comprising:

[0007] Acquire network data packets and tuple information of the network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows;

[0008] Acquire the communication node of the network data packet, and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel;

[0009] Performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain a pre-processed network flow, and enhancing the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow;

[0010] Optimizing network parameters based on a preset joint loss function, extracting features from the enhanced network flow using a preset triplet network, and obtaining an optimized feature vector;

[0011] By freezing the parameters of the triplet network, a sub-network is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for a preset benign traffic sample, and a single classifier is trained to obtain a trained single classifier;

[0012] Based on the feature vector, the preset test sample is judged as benign or malicious according to the trained single classifier, and when the test passes, a trained attack differentiation model is obtained, and unknown attack detection is performed through the attack differentiation model.

[0013] Optionally, the acquiring of the network data packet and the tuple information of the network data packet, and dividing the network data packet into network flows according to the tuple information to obtain the network data flow, includes:

[0014] Capturing a network data packet passing through a preset network interface, and extracting five-tuple information in the network data packet, wherein the five-tuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol;

[0015] Classifying network data packets according to the five-tuple information, and merging network data packets with the same five-tuple characteristics into one network flow, thereby obtaining multiple network flows;

[0016] A network data flow set is constructed according to the multiple network flows, and each network flow is marked with a unique identifier for storage to obtain the network data flow, wherein each network flow represents a communication session between a pair of communication nodes.

[0017] Optionally, aggregating time-related network data flows between two communication nodes to obtain a data communication channel includes:

[0018] Capture all data packets passing through two communication nodes using a preset network packet capture tool to obtain multiple network data packets;

[0019] Extracting source IP addresses and destination IP addresses from the plurality of network data packets, and identifying two communicating nodes by the source IP addresses and the destination IP addresses, thereby obtaining an identified communication node;

[0020] Sort the network data packets with the same source IP and destination IP according to the timestamp of the identified communication node, and aggregate the relevant data packets arriving within a preset time window to obtain a complete network data flow;

[0021] The complete network data stream is aggregated to obtain the data communication channel.

[0022] Optionally, performing feature statistics on the data flow in the data communication channel and extracting original bytes of the data packet to obtain the preprocessed network flow includes:

[0023] Obtaining network flow features based on statistical features extracted from the network flow in the data communication channel;

[0024] Obtaining original bytes of data by extracting original bytes from data packets in the data communication channel;

[0025] The network flow features and the original bytes of the data are combined to obtain the preprocessed network flow.

[0026] Optionally, the enhancing the preprocessed network flow by interpolation and popular strategy analysis to obtain an enhanced network flow includes:

[0027] By performing an interpolation operation on the samples in the preprocessed network flow, an interpolation supplemented network flow is obtained;

[0028] Analyze the internal structure of the pre-processed network flow through the popular strategy, obtain the original distribution characteristics of the data in the pre-processed network flow, and obtain the popular processed network flow;

[0029] The enhanced network flow is obtained by adding perturbations at the feature level and the instance level of the preprocessing network flow, and by supplementing the interpolation network flow and the popular processing network flow.

[0030] Optionally, the optimizing network parameters based on a preset joint loss function, extracting features from the enhanced network flow using a preset triplet network, and obtaining an optimized feature vector comprises:

[0031] The positive and negative samples are distinguished by the triple loss in the joint loss function, and the network parameters of the triple network are combined with the single classification aggregation loss function in the joint loss function to obtain an optimized triple network;

[0032] The optimized triplet network is used to perform feature extraction on the enhanced network flow to obtain a feature vector.

[0033] Optionally, before optimizing the network parameters based on a preset joint loss function and extracting features from the enhanced network flow using a preset triplet network to obtain an optimized feature vector, the method further includes:

[0034] An initial triplet network is constructed by designing a deep neural network containing three identical branches, wherein each of the three identical branches is used to process one sample and share network parameters;

[0035] Select anchor points, positive samples and negative samples from a preset data set to construct triplets, and train the initial triplet network through a triplet loss function so that the distance between the anchor point and the positive sample is smaller than the distance between the anchor point and the negative sample, thereby obtaining a training triplet network;

[0036] The network parameters of the training triplet network are optimized by the gradient descent method, and the hyperparameters and the network structure are adjusted to obtain the triplet network.

[0037] In order to solve the above problems, the present invention also provides a network defense device based on unknown attacks, the device comprising:

[0038] A data acquisition module, used to acquire network data packets and tuple information of network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows;

[0039] A data enhancement module is used to obtain the communication node of the network data packet and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel; perform feature statistics on the data stream in the data communication channel and extract the original bytes of the data packet to obtain a pre-processed network stream, and enhance the pre-processed network stream through interpolation and popular strategy analysis to obtain an enhanced network stream;

[0040] A network training module is used to optimize network parameters based on a preset joint loss function, and use a preset triple network to extract features from the enhanced network flow to obtain an optimized feature vector; by freezing the parameters of the triple network, a subnetwork is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for preset benign traffic samples, and a single classifier is trained to obtain a trained single classifier;

[0041] The attack detection module is used to judge the preset test sample as benign or malicious type based on the feature vector and the trained single classifier, and obtain the trained attack differentiation model when the test passes, and perform unknown attack detection through the attack differentiation model.

[0042] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0043] at least one processor; and,

[0044] a memory communicatively connected to the at least one processor; wherein,

[0045] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the network defense method based on unknown attacks as described above.

[0046] In order to solve the above problems, the present invention also provides a computer-readable storage medium, including a data storage area and a program storage area, the data storage area stores created data, and the program storage area stores a computer program; wherein, when the computer program is executed by a processor, the network defense method based on unknown attacks as described above is implemented.

[0047] The embodiment of the present invention obtains a network data stream according to the tuple information of the network data packet; obtains the communication node of the network data packet, aggregates to obtain a data communication channel; performs feature statistics on the data stream and extracts the original bytes to obtain a preprocessed network stream, and enhances the preprocessed network stream to obtain an enhanced network stream, thereby expanding the data sample and improving the robustness of the model; optimizes the network parameters based on a preset joint loss function, extracts features, and obtains an optimized feature vector; extracts feature vectors by freezing the parameters of the triple network, trains a single classifier, and obtains a trained single classifier; based on the feature vector, the preset test sample is judged as benign or malicious, and when the test passes, a trained attack differentiation model is obtained to detect unknown attacks. Therefore, the network defense method, device, electronic device, and computer-readable storage medium based on unknown attacks proposed by the present invention realize effective detection of unknown attacks by combining the feature extraction capability of the triple network and the anomaly detection capability of the single classification algorithm, and expands the data sample through data enhancement, so that the network training is more sufficient and the detection capability of responding to unknown network attacks is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of a flow chart of a network defense method based on unknown attacks provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of a module of a network defense device based on unknown attacks provided by an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of the internal structure of an electronic device for implementing a network defense method based on unknown attacks provided by an embodiment of the present invention.

[0051] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0052] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0053] The embodiment of the present application provides a network defense method based on unknown attacks. The execution subject of the network defense method based on unknown attacks includes but is not limited to at least one of the electronic devices such as the server, the terminal, etc. that can be configured to execute the method provided by the embodiment of the present application. Among them, the server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. In other words, the network defense method based on unknown attacks can be executed by software or hardware installed on a remote device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc.

[0054] Reference Figure 1 FIG. 1 is a flow chart of a network defense method based on unknown attacks provided by an embodiment of the present invention. In this embodiment, the network defense method based on unknown attacks includes the following steps S1-S5:

[0055] S1. Acquire a network data packet and tuple information of the network data packet, and divide the network data packet into network flows according to the tuple information to obtain a network data flow.

[0056] It is understandable that the purpose of acquiring network data packets and dividing them into network flows is to achieve refined monitoring and management of network traffic, ensure network security and performance optimization. This process not only involves the extraction and classification of tuple information of data packets, but also includes the extraction of statistical features and raw byte analysis of network flows, thereby providing basic data for network traffic analysis (NTA).

[0057] Furthermore, in this way, communication sessions can be more effectively identified, abnormal behaviors can be detected, network performance can be evaluated, and decision support can be provided for network security. In addition, the segmentation of network flows also helps to apply advanced network analysis techniques, such as deep parsing and application behavior analysis, to further optimize network performance and improve network security.

[0058] In the embodiment of the present invention, the network data packet refers to a data unit transmitted in the network, which usually includes information such as source IP, destination IP, source port, destination port, and transmission protocol. Based on this information (i.e., quintuple), related data packets can be organized into network flows, each of which represents a specific communication session between two communication nodes.

[0059] Further, the tuple information refers to a data structure composed of multiple fields in computer science and network communication, which together uniquely identify a specific entity or event. In network communication, tuple information is often used to describe the key attributes of network data packets. The tuple information in the present invention is a five-tuple information, including source IP address, destination IP address, source port number, destination port number, and transport layer protocol. The five-tuple information uniquely determines a network session or flow. In network management and security analysis, five-tuple information is very important because they allow network devices and security systems to distinguish and identify different network connections, implement access control policies, and detect and respond to potential security threats. By checking the five-tuple information, network administrators can track network traffic, optimize network performance, and implement security measures such as firewall rules and intrusion detection system configurations.

[0060] In the embodiment of the present invention, the obtaining of the network data packet and the tuple information of the network data packet, and dividing the network data packet into network flows according to the tuple information to obtain the network data flow, includes:

[0061] Capturing a network data packet passing through a preset network interface, and extracting five-tuple information in the network data packet, wherein the five-tuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol;

[0062] Classifying network data packets according to the five-tuple information, and merging network data packets with the same five-tuple characteristics into one network flow, thereby obtaining multiple network flows;

[0063] A network data flow set is constructed according to the multiple network flows, and each network flow is marked with a unique identifier for storage to obtain the network data flow, wherein each network flow represents a communication session between a pair of communication nodes.

[0064] In an embodiment of the present invention, the unique identifier is used to distinguish and identify each independent communication session in network flow management, which facilitates rapid retrieval, analysis and processing of network data, thereby improving the efficiency and accuracy of network monitoring, security protection and traffic management.

[0065] S2. Acquire the communication node of the network data packet, and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel.

[0066] In the embodiment of the present invention, the communication nodes refer to devices or endpoints that perform data communication in a network. They are senders and receivers of network data flows and are crucial for understanding and analyzing network traffic.

[0067] Furthermore, the data communication channel represents a special network flow, that is, a series of data packets from a source to a destination in the network, which have the same five-tuple characteristics (source IP address, destination IP address, source port number, destination port number and transport layer protocol) and logically belong to the same communication session.

[0068] In the embodiment of the present invention, the aggregating time-related network data flows between two communication nodes to obtain a data communication channel includes:

[0069] Capture all data packets passing through two communication nodes using a preset network packet capture tool to obtain multiple network data packets;

[0070] Extracting source IP addresses and destination IP addresses from the plurality of network data packets, and identifying two communicating nodes by the source IP addresses and the destination IP addresses, thereby obtaining an identified communication node;

[0071] Sort the network data packets with the same source IP and destination IP according to the timestamp of the identified communication node, and aggregate the relevant data packets arriving within a preset time window to obtain a complete network data flow;

[0072] The complete network data stream is aggregated to obtain the data communication channel.

[0073] Furthermore, the network packet capture tool is a type of software tool used to capture and analyze network traffic. It can monitor and record data packets passing through the network interface and provide in-depth analysis of network communications. For example, Wireshark is a widely used network protocol analyzer that allows users to capture and analyze data packets on the network; tcpdump is a command line network packet capture tool commonly used on Unix and Linux systems.

[0074] S3. Perform feature statistics on the data flow in the data communication channel and extract the original bytes of the data packet to obtain a pre-processed network flow, and enhance the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow.

[0075] It is understandable that the extraction of statistical features and the extraction of raw bytes of data packets can provide a quantitative and qualitative data basis for network flow analysis, wherein statistical features help us understand the macroscopic behavior patterns of network traffic, such as traffic size, transmission rate, and time interval, while the extraction of raw bytes retains the specific content information of the data packet, providing detailed data for in-depth analysis and identification of patterns or anomalies in network traffic. By combining these two types of information, network traffic can be understood and processed more comprehensively, providing more accurate and rich data support for subsequent network behavior analysis and security detection.

[0076] In the embodiment of the present invention, the step of performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain the preprocessed network flow includes:

[0077] Obtaining network flow features based on statistical features extracted from the network flow in the data communication channel;

[0078] Obtaining original bytes of data by extracting original bytes from data packets in the data communication channel;

[0079] The network flow features and the original bytes of the data are combined to obtain the preprocessed network flow.

[0080] In the embodiment of the present invention, the statistical features include the number of data packets, flow duration, minimum value, maximum value and mean value of data packet size, etc. These features provide a macroscopic perspective of network traffic and help understand traffic patterns.

[0081] Further, the pre-processed network flow is enhanced by interpolation and popular strategy analysis to obtain an enhanced network flow, including:

[0082] By performing an interpolation operation on the samples in the preprocessed network flow, an interpolation supplemented network flow is obtained;

[0083] Analyze the internal structure of the pre-processed network flow through the popular strategy, obtain the original distribution characteristics of the data in the pre-processed network flow, and obtain the popular processed network flow;

[0084] The enhanced network flow is obtained by adding perturbations at the feature level and the instance level of the preprocessing network flow, and by supplementing the interpolation network flow and the popular processing network flow.

[0085] In the embodiment of the present invention, the role of popular strategy analysis is to improve the accuracy and efficiency of network traffic analysis through refined traffic management and control. By implementing popular strategy analysis, network flows can be classified and processed more carefully, thereby enhancing the feature representation of network flows and improving the effect of subsequent analysis and model training. This method helps to build a more robust and accurate network traffic analysis model to identify and defend against potential network attacks.

[0086] S4. Optimize network parameters based on a preset joint loss function, use a preset triplet network to extract features of the enhanced network flow, and obtain an optimized feature vector.

[0087] In an embodiment of the present invention, the triplet network is a deep learning model mainly used to learn the similarities and differences between samples. Its basic structure consists of three identical neural networks that share parameters and receive three input samples: an anchor sample, a positive sample, and a negative sample. The goal of the triplet network is to achieve effective sample differentiation in the feature space by minimizing the distance between the anchor and the positive sample and maximizing the distance between the anchor and the negative sample.

[0088] In the embodiment of the present invention, the joint loss function in the triplet network refers to a loss function that combines triplet loss (Triplet Loss) and one-class aggregated loss (One-Class Aggregated Loss). The design of this joint loss function aims to optimize the network parameters at the same time to extract feature vectors that can effectively distinguish different categories.

[0089] Furthermore, the method of optimizing network parameters based on a preset joint loss function and extracting features of the enhanced network flow using a preset triplet network to obtain an optimized feature vector includes:

[0090] The positive and negative samples are distinguished by the triple loss in the joint loss function, and the network parameters of the triple network are combined with the single classification aggregation loss function in the joint loss function to obtain an optimized triple network;

[0091] The optimized triplet network is used to perform feature extraction on the enhanced network flow to obtain a feature vector.

[0092] Furthermore, before optimizing the network parameters based on the preset joint loss function and extracting features from the enhanced network flow using the preset triplet network to obtain the optimized feature vector, the method further includes:

[0093] An initial triplet network is constructed by designing a deep neural network containing three identical branches, wherein each of the three identical branches is used to process one sample and share network parameters;

[0094] Select anchor points, positive samples and negative samples from a preset data set to construct triplets, and train the initial triplet network through a triplet loss function so that the distance between the anchor point and the positive sample is smaller than the distance between the anchor point and the negative sample, thereby obtaining a training triplet network;

[0095] The network parameters of the training triplet network are optimized by the gradient descent method, and the hyperparameters and the network structure are adjusted to obtain the triplet network.

[0096] S5. By freezing the parameters of the triplet network, a subnetwork is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for preset benign traffic samples, and a single classifier is trained to obtain a trained single classifier.

[0097] In an embodiment of the present invention, the triplet network refers to a deep learning model previously used to learn to distinguish between benign and malicious traffic samples. This model is trained through a triplet loss function to extract feature vectors that can effectively represent network features.

[0098] Among them, "selecting a sub-network as a fixed feature extraction module" usually means selecting a part of the network structure from the complete triplet network as a feature extractor. This sub-network usually contains the first few layers of the network, which are sufficient to capture the basic features of the input data.

[0099] In the embodiment of the present invention, a sub-network is selected as a fixed feature extraction module to reduce the complexity of calculation, and the self-network can focus more on the general features of the learning data rather than complex high-order features that may lead to overfitting, and has stronger generalization ability.

[0100] S6. Based on the feature vector, the preset test sample is judged as benign or malicious according to the trained single classifier, and when the test passes, a trained attack differentiation model is obtained, and unknown attack detection is performed through the attack differentiation model.

[0101] In the embodiment of the present invention, the testing phase is a key step to ensure that the model can achieve the expected effect in practical applications. It not only evaluates the performance of the model, but also provides an important basis for further optimization and deployment of the model.

[0102] In the embodiment of the present invention, the fixed feature extraction module is used to extract feature vectors for the test samples, and then the test samples are judged as benign or malicious according to the trained single classifier, and a trained distinction model is obtained when the test passes, including:

[0103] Use the pre-selected sub-network as a fixed feature extraction module to process the test sample and extract the feature vector that can represent the sample characteristics;

[0104] The extracted feature vector is input into the trained single classifier, and the single classifier judges each test sample based on the learned model parameters to determine whether it is benign or malicious;

[0105] Analyze the judgment results of a single classifier and evaluate the model's performance indicators such as accuracy and recall to ensure the robustness and effectiveness of the model;

[0106] After the test is passed, the generalization ability of the model is confirmed, and the final trained differentiation model is obtained, ready to be deployed in actual applications for real-time monitoring and security protection of network traffic.

[0107] The embodiment of the present invention obtains a network data stream according to the tuple information of the network data packet; obtains the communication node of the network data packet, aggregates to obtain a data communication channel; performs feature statistics on the data stream and extracts the original bytes to obtain a preprocessed network stream, and enhances the preprocessed network stream to obtain an enhanced network stream, thereby expanding the data sample and improving the robustness of the model; optimizes the network parameters based on a preset joint loss function, extracts features, and obtains an optimized feature vector; extracts feature vectors by freezing the parameters of the triple network, trains a single classifier, and obtains a trained single classifier; based on the feature vector, the preset test sample is judged as benign or malicious, and when the test passes, a trained attack differentiation model is obtained to detect unknown attacks. Therefore, the network defense method, device, electronic device, and computer-readable storage medium based on unknown attacks proposed by the present invention realize effective detection of unknown attacks by combining the feature extraction capability of the triple network and the anomaly detection capability of the single classification algorithm, and expands the data sample through data enhancement, so that the network training is more sufficient and the detection capability of responding to unknown network attacks is improved.

[0108] like Figure 2 The figure shows a module diagram of a network defense device based on unknown attacks according to the present invention.

[0109] The network defense device 100 based on unknown attacks of the present invention can be installed in an electronic device. According to the functions implemented, the network defense device based on unknown attacks can include a data acquisition module 101, a data enhancement module 102, a network training module 103 and an attack detection module 104. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0110] In this embodiment, the functions of each module / unit are as follows:

[0111] The data acquisition module 101 is used to acquire network data packets and tuple information of the network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows;

[0112] The data enhancement module 102 is used to obtain the communication node of the network data packet and aggregate the time-related network data flow between two communication nodes to obtain a data communication channel; perform feature statistics on the data flow in the data communication channel and extract the original bytes of the data packet to obtain a pre-processed network flow, and enhance the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow;

[0113] The network training module 103 is used to optimize the network parameters based on a preset joint loss function, and use a preset triple network to extract features of the enhanced network flow to obtain an optimized feature vector; by freezing the parameters of the triple network, a subnetwork is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for preset benign traffic samples, and a single classifier is trained to obtain a trained single classifier;

[0114] The attack detection module 104 is used to judge the preset test sample as benign or malicious type based on the feature vector and the trained single classifier, and obtain the trained attack differentiation model when the test passes, and perform unknown attack detection through the attack differentiation model.

[0115] In detail, each module described in the network defense device 100 based on unknown attacks in the embodiment of the present invention is used in the same manner as described above. Figure 1 The above-mentioned network defense method based on unknown attacks has the same technical means and can produce the same technical effects, so they will not be repeated here.

[0116] like Figure 3 , which is a schematic diagram of the structure of an electronic device for implementing a network defense method based on unknown attacks according to the present invention.

[0117] The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as a network defense program based on unknown attacks.

[0118] The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The processor 10 is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules stored in the memory 11 (for example, executing a network defense program based on unknown attacks, etc.), and calls data stored in the memory 11 to execute various functions of the electronic device and process data.

[0119] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 11 may also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 may also include both an internal storage unit of the electronic device and an external storage device. The memory 11 can not only be used to store application software and various types of data installed in the electronic device, such as the code of a network defense program based on unknown attacks, but also be used to temporarily store data that has been output or is to be output.

[0120] The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0121] The communication interface 13 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0122] Figure 3 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0123] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to various components. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include any components such as one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, etc. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0124] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0125] The network defense program based on unknown attacks stored in the memory 11 in the electronic device is a combination of multiple computer programs. When running in the processor 10, it can achieve:

[0126] Acquire network data packets and tuple information of the network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows;

[0127] Acquire the communication node of the network data packet, and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel;

[0128] Performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain a pre-processed network flow, and enhancing the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow;

[0129] Optimizing network parameters based on a preset joint loss function, extracting features from the enhanced network flow using a preset triplet network, and obtaining an optimized feature vector;

[0130] By freezing the parameters of the triplet network, a sub-network is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for a preset benign traffic sample, and a single classifier is trained to obtain a trained single classifier;

[0131] Based on the feature vector, the preset test sample is judged as benign or malicious according to the trained single classifier, and when the test passes, a trained attack differentiation model is obtained, and unknown attack detection is performed through the attack differentiation model.

[0132] Specifically, the specific implementation method of the processor 10 for the above computer program can refer to Figure 1 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0133] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0134] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0135] Acquire network data packets and tuple information of the network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows;

[0136] Acquire the communication node of the network data packet, and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel;

[0137] Performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain a pre-processed network flow, and enhancing the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow;

[0138] Optimizing network parameters based on a preset joint loss function, extracting features from the enhanced network flow using a preset triplet network, and obtaining an optimized feature vector;

[0139] By freezing the parameters of the triplet network, a sub-network is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for a preset benign traffic sample, and a single classifier is trained to obtain a trained single classifier;

[0140] Based on the feature vector, the preset test sample is judged as benign or malicious according to the trained single classifier, and when the test passes, a trained attack differentiation model is obtained, and unknown attack detection is performed through the attack differentiation model.

[0141] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0142] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0143] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0144] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0145] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is limited by the appended claims rather than the above description, so it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any attached figure mark in the claims should not be regarded as limiting the claims involved.

[0146] The blockchain referred to in this invention is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0147] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0148] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system claim can also be implemented by one unit or device through software or hardware. The second and other words are used to indicate names, but not to indicate any particular order.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A network defense method based on unknown attacks, characterized in that: The method comprises: Acquire network data packets and tuple information of the network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows; Acquire the communication node of the network data packet, and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel; Performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain a pre-processed network flow, and enhancing the pre-processed network flow through interpolation and popular strategy analysis to obtain an enhanced network flow; Optimizing network parameters based on a preset joint loss function, extracting features from the enhanced network flow using a preset triplet network, and obtaining an optimized feature vector; By freezing the parameters of the triplet network, a sub-network is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for a preset benign traffic sample, and a single classifier is trained to obtain a trained single classifier; Based on the feature vector, the preset test sample is judged as benign or malicious according to the trained single classifier, and when the test passes, a trained attack differentiation model is obtained, and unknown attack detection is performed through the attack differentiation model.

2. The network defense method based on unknown attacks as claimed in claim 1, characterized in that: The obtaining of network data packets and tuple information of the network data packets, and dividing the network data packets into network flows according to the tuple information to obtain network data flows, includes: Capturing a network data packet passing through a preset network interface, and extracting five-tuple information in the network data packet, wherein the five-tuple information includes a source IP address, a destination IP address, a source port number, a destination port number, and a transport layer protocol; Classifying network data packets according to the five-tuple information, and merging network data packets with the same five-tuple characteristics into one network flow, thereby obtaining multiple network flows; A network data flow set is constructed according to the multiple network flows, and each network flow is marked with a unique identifier for storage to obtain the network data flow, wherein each network flow represents a communication session between a pair of communication nodes.

3. The network defense method based on unknown attacks as claimed in claim 1, characterized in that: The aggregating time-related network data flows between two communication nodes to obtain a data communication channel includes: Capture all data packets passing through two communication nodes using a preset network packet capture tool to obtain multiple network data packets; Extracting source IP addresses and destination IP addresses from the plurality of network data packets, and identifying two communicating nodes by the source IP addresses and the destination IP addresses, thereby obtaining an identified communication node; Sort the network data packets with the same source IP and destination IP according to the timestamp of the identified communication node, and aggregate the relevant data packets arriving within a preset time window to obtain a complete network data flow; The complete network data stream is aggregated to obtain the data communication channel.

4. The network defense method based on unknown attacks as claimed in claim 1, characterized in that: The method of performing feature statistics on the data flow in the data communication channel and extracting the original bytes of the data packet to obtain the pre-processed network flow includes: Obtaining network flow features based on statistical features extracted from the network flow in the data communication channel; Obtaining original bytes of data by extracting original bytes from data packets in the data communication channel; The network flow features and the original bytes of the data are combined to obtain the preprocessed network flow.

5. The network defense method based on unknown attacks as claimed in claim 1, characterized in that: The step of enhancing the preprocessed network flow by interpolation and popular strategy analysis to obtain an enhanced network flow includes: By performing an interpolation operation on the samples in the preprocessed network flow, an interpolation supplemented network flow is obtained; Analyze the internal structure of the pre-processed network flow through the popular strategy, obtain the original distribution characteristics of the data in the pre-processed network flow, and obtain the popular processed network flow; The enhanced network flow is obtained by adding perturbations at the feature level and the instance level of the preprocessing network flow, and by using the interpolation supplement network flow and the popular processing network flow.

6. The network defense method based on unknown attacks as claimed in claim 1, characterized in that: The method of optimizing network parameters based on a preset joint loss function and extracting features from the enhanced network flow using a preset triplet network to obtain an optimized feature vector includes: The positive and negative samples are distinguished by the triple loss in the joint loss function, and the network parameters of the triple network are combined with the single classification aggregation loss function in the joint loss function to obtain an optimized triple network; The optimized triplet network is used to perform feature extraction on the enhanced network flow to obtain a feature vector.

7. The network defense method based on unknown attacks according to any one of claims 1 to 6, characterized in that: Before optimizing the network parameters based on the preset joint loss function and extracting features from the enhanced network flow using the preset triplet network to obtain the optimized feature vector, the method further includes: An initial triplet network is constructed by designing a deep neural network containing three identical branches, wherein each of the three identical branches is used to process one sample and share network parameters; Select anchor points, positive samples and negative samples from a preset data set to construct triplets, and train the initial triplet network through a triplet loss function so that the distance between the anchor point and the positive sample is smaller than the distance between the anchor point and the negative sample, thereby obtaining a training triplet network; The network parameters of the training triplet network are optimized by the gradient descent method, and the hyperparameters and the network structure are adjusted to obtain the triplet network.

8. A network defense device based on unknown attacks, characterized in that: The device comprises: A data acquisition module, used to acquire network data packets and tuple information of network data packets, and divide the network data packets into network flows according to the tuple information to obtain network data flows; A data enhancement module is used to obtain the communication node of the network data packet and aggregate the time-related network data streams between two communication nodes to obtain a data communication channel; perform feature statistics on the data stream in the data communication channel and extract the original bytes of the data packet to obtain a pre-processed network stream, and enhance the pre-processed network stream through interpolation and popular strategy analysis to obtain an enhanced network stream; A network training module is used to optimize network parameters based on a preset joint loss function, and use a preset triple network to extract features from the enhanced network flow to obtain an optimized feature vector; by freezing the parameters of the triple network, a subnetwork is selected as a fixed feature extraction module, and the feature extraction module is used to extract feature vectors for preset benign traffic samples, and a single classifier is trained to obtain a trained single classifier; The attack detection module is used to judge the preset test sample as benign or malicious type based on the feature vector and the trained single classifier, and obtain the trained attack differentiation model when the test passes, and perform unknown attack detection through the attack differentiation model.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the network defense method based on unknown attacks according to any one of claims 1 to 7.

10. A computer-readable storage medium, comprising a data storage area and a program storage area, wherein the data storage area stores created data and the program storage area stores a computer program; wherein: When the computer program is executed by a processor, the network defense method based on unknown attacks according to any one of claims 1 to 7 is implemented.

Images