Network abnormal transmission identification blocking method and system based on data mining

Abstract

The invention relates to the technical field of wireless network communication, in particular to a network abnormal transmission identification blocking method and system based on data mining, and the method comprises the steps: carrying out the preprocessing of collected real-time network flow data, and generating real-time network flow feature data; performing real-time network abnormal traffic type analysis processing on the data and the established different network abnormal traffic type feature data to generate real-time network traffic analysis data, and if the real-time network traffic analysis data is normal, ending the network traffic identification operation; if the real-time network traffic analysis data is abnormal, generating real-time network abnormal traffic type feature data, and performing blocking node spatial position search processing on the real-time network abnormal traffic type feature data and the established network abnormal traffic type blocking node spatial position data to obtain real-time network abnormal traffic blocking node spatial position data; and finally, constructing real-time network abnormal traffic identification data, and executing real-time network abnormal traffic blocking operation to realize intelligent identification and accurate blocking of the network abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless network communications, and in particular to a method and system for identifying and blocking abnormal network transmission based on data mining. Background Art

[0002] During network transmission, abnormal network traffic refers to network traffic data that deviates from normal network behavior. With the continuous development of Internet technology, diverse network environments and services have brought convenience to people, but more complex network traffic has also brought greater and more severe challenges to network security.

[0003] The Chinese invention patent application with publication number CN106330964A introduces a network intrusion detection and active defense linkage control device. By combining the traditional network anomaly detection PHAD model method to perform in-depth detection and analysis of key fields of the data packet content, it can accurately determine whether the network traffic is aggressive, and dynamically intervene in the forwarding rule table of the data packet forwarding module to block abnormal data traffic and actively cut off abnormal data flows, thereby achieving the linkage effect of active detection of attacks and active defense. However, it is unable to further analyze and identify the type of abnormal network traffic, and also does not analyze the blocking nodes of abnormal data flows, making it difficult to ensure accurate blocking of abnormal data flows. Summary of the invention

[0004] In order to solve the deficiencies in the background technology, the present invention provides a method and system for identifying and blocking abnormal network transmission based on data mining, so as to realize intelligent identification and precise blocking of abnormal network traffic.

[0005] A method for identifying and blocking abnormal network transmission based on data mining, comprising the following steps: S1, collect real-time network traffic data; S2, performing data preprocessing on the real-time network traffic data to generate real-time network traffic feature data; S3. Establish characteristic data of different network abnormal traffic types; S4, performing real-time network abnormal traffic type analysis and processing according to the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data, generating real-time network traffic analysis data, if the real-time network traffic analysis data is normal, then ending the current network traffic identification operation; if the real-time network traffic analysis data is abnormal, then generating real-time network abnormal traffic type characteristic data; S5. Establishing spatial location data of network abnormal traffic type blocking nodes; S6. Performing a blocking node spatial position search process according to the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data to obtain the real-time network abnormal traffic blocking node spatial position data; S7. Construct real-time network abnormal traffic identification data based on the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data, and perform real-time network abnormal traffic blocking operations.

[0006] The present invention generates real-time network traffic characteristic data by performing data preprocessing on the collected real-time network traffic data, and performs real-time network abnormal traffic type analysis processing with established characteristic data of different network abnormal traffic types to generate real-time network traffic analysis data. If the real-time network traffic analysis data is normal, the current network traffic identification operation is terminated; if the real-time network traffic analysis data is abnormal, real-time network abnormal traffic type characteristic data is generated, and blocking node spatial position search processing is performed with established network abnormal traffic type blocking node spatial position data to obtain real-time network abnormal traffic blocking node spatial position data, and finally real-time network abnormal traffic identification data is constructed, and real-time network abnormal traffic blocking operations are executed to realize intelligent identification and precise blocking of network abnormal traffic.

[0007] Preferably, the specific steps of collecting real-time network traffic data are as follows: S11, the network traffic data collection unit collects the network traffic data of each node in real time and generates a real-time network traffic data set A={a 1 ,a 2 ,…,a i ,…,a k}, where a i It represents the network traffic data of the ith node collected in real time by the network traffic data collection unit, k represents the total number of nodes through which the network traffic data passes, the network traffic data includes but is not limited to source IP address, destination IP address, data packet information, protocol information, traffic transmission rate and traffic distribution, the nodes through which the abnormal network traffic passes include but are not limited to core routers, switches, firewalls and important servers.

[0008] Preferably, the specific steps of performing data preprocessing on the real-time network traffic data to generate real-time network traffic feature data are as follows: S21, performing network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm to generate a real-time network traffic feature data set ,in, represents the real-time network traffic characteristic data obtained after the ith real-time network traffic data in the real-time network traffic data set is subjected to network traffic data noise reduction processing; The performing network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using the bilateral filtering algorithm comprises the following steps: S211, selecting real-time network traffic data in the real-time network traffic data set as sample data; S212, using a bilateral filtering noise reduction formula to perform network traffic data noise reduction processing on the target sample data; the bilateral filtering noise reduction formula is as follows: , Wherein, f(x) represents the target sample data after the network traffic data is subjected to denoising, f(y) represents the target sample data before the network traffic data is subjected to denoising, Ω(x) represents the neighborhood search area centered on the sample point x in the target sample data, and W(x, y) represents the bilateral filter kernel coefficient; S213, repeating the operations from S211 to S212 until all the real-time network traffic data in the real-time network traffic data set are traversed to generate a real-time network traffic feature data set.

[0009] The real-time network traffic data is subjected to network traffic data noise reduction processing through a bilateral filtering algorithm, and the noise data in the real-time network traffic data is accurately identified and eliminated, thereby effectively reducing the impact of the noise data in the real-time network traffic data, ensuring the reliability of data acquisition, and better highlighting the detailed features in the real-time network traffic data.

[0010] Preferably, the specific steps of establishing characteristic data of different network abnormal traffic types are as follows: S31. Establish a feature dataset B of different network abnormal traffic types. 1 ,b 2 ,…,b i ,…,b l}, where b i It represents the network traffic characteristic data of each node passed when the i-th network abnormal traffic type appears, l represents the total number of characteristic data of different network abnormal traffic types, and the network abnormal traffic types include but are not limited to network traffic distribution abnormality, network traffic transmission rate abnormality, network traffic address abnormality, network attack abnormality and protocol information abnormality.

[0011] Preferably, the real-time network abnormal traffic type analysis is performed based on the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data to generate real-time network traffic analysis data. If the real-time network traffic analysis data is normal, the network traffic identification operation is terminated; if the real-time network traffic analysis data is abnormal, the specific steps of generating the real-time network abnormal traffic type characteristic data are as follows: S41, performing real-time network abnormal traffic type analysis on the real-time network abnormal traffic feature data set and each different network abnormal traffic type feature data in the different network abnormal traffic type feature data set by using the firefly optimization algorithm, and generating real-time network traffic analysis data Q according to the real-time network abnormal traffic type analysis result. fenxi , if the real-time network traffic analysis data Q fenxi If the real-time network traffic analysis data Q fenxi If it is abnormal, the real-time network abnormal traffic type feature data C is generated. leixing ; S411, construct a firefly population, set the firefly population size to N, the light intensity absorption coefficient to γ, the step size perturbation factor to α, the current number of iterations to t, and the maximum number of iterations to t max And the dimension of the search space of characteristic data of different network abnormal traffic types is P; In the search space for the characteristic data of different network abnormal traffic types, N characteristic data of different network abnormal traffic types are randomly generated, each characteristic data of different network abnormal traffic types corresponds to a firefly individual in the firefly population, and the initial position set of the firefly population is initialized as X={X 1 ,X 2 ,…,X i ,…,X N}, where X i represents the initial position of the i-th firefly individual in the firefly population; S412, calculating the luminous brightness of each firefly individual in the firefly population, arranging each firefly individual in the firefly population from large to small according to the luminous brightness, and selecting the firefly individual with the highest luminous brightness as the current optimal individual; the luminous brightness calculation formula is as follows: , Among them, I i represents the luminous brightness of the i-th firefly individual in the firefly population, x i represents the matching degree between the characteristic data of different network abnormal traffic types corresponding to the i-th firefly individual in the firefly population and the real-time network traffic characteristic data, Indicates the correction value; S413, calculating the spatial distance between individual fireflies in the firefly population; the spatial distance calculation formula is as follows: , Among them, d i,j represents the spatial distance between the i-th firefly individual and the j-th firefly individual in the firefly population, X i,z and X j,z They respectively represent the positions of the i-th firefly individual and the j-th firefly individual in the firefly population in the z-th dimension different network abnormal traffic type feature data search space; S414, calculating the relative attraction between the individual fireflies in the firefly population according to the spatial distance between the individual fireflies in the firefly population; the relative attraction calculation formula is as follows: , Among them, β i,j represents the relative attraction between the i-th firefly individual and the j-th firefly individual in the firefly population, β 0 It represents the attraction degree when the distance between any two firefly individuals in the firefly population is 0; S415. Each individual firefly in the firefly population will be attracted by the firefly with higher luminous brightness in the search space of characteristic data of different network abnormal traffic types to update its position. The position update formula is as follows: , in, represents the position of the i-th firefly individual in the firefly population after the position update, and They respectively represent the positions of the i-th firefly individual and the j-th firefly individual in the firefly population in the t-th iteration process, and rand represents a random number that obeys a uniform distribution between (0, 1); The current best individual in the firefly population updates its position by randomly walking in the search space of characteristic data of different network abnormal traffic types; S416, calculating the luminous brightness of each firefly individual in the firefly population after the position is updated in the search space of the characteristic data of different network abnormal traffic types, if the luminous brightness of the firefly individual after the position is updated is greater than the luminous brightness of the original position, then the new position is used to replace the original position; otherwise, the original position is retained; S417, if the luminous brightness of the firefly individual in the search space of the characteristic data of different network abnormal traffic types is greater than the luminous brightness of the current optimal individual, then the firefly individual is used as the new current optimal individual; otherwise, directly enter S418; S418: Determine whether the current number of iterations t is less than the maximum number of iterations t max , if the current number of iterations t is less than the maximum number of iterations t max , then the current iteration number t is increased by 1, and the process returns to S413; otherwise, the current optimal individual is taken as the global optimal solution; S419, set a fitness function threshold. If the fitness function value of the global optimal solution is less than or equal to the fitness function threshold, it means that the real-time network environment is in a safe state, and output the real-time network traffic analysis data Q fenxi If the fitness function value of the global optimal solution is greater than the fitness function threshold, it means that the real-time network environment is in a dangerous state, and the real-time network traffic analysis data Q is output. fenxi The abnormal network traffic type feature data corresponding to the global optimal solution is anomaly, and the data is marked to generate real-time network abnormal traffic type feature data C leixing .

[0012] The real-time network abnormal traffic characteristic data and the characteristic data of different network abnormal traffic types are analyzed and processed by the firefly optimization algorithm to achieve scientific analysis of the real-time network abnormal traffic type and accurately identify the type of the real-time network abnormal traffic. At the same time, the firefly optimization algorithm has good robustness and can ensure the stability and reliability of the analysis process.

[0013] Preferably, the specific steps of establishing the spatial location data of the network abnormal traffic type blocking node are as follows: S51, using a network traffic blocking node data storage unit to preset corresponding blocking node spatial position data for different network abnormal traffic type feature data in the different network abnormal traffic type feature data sets, generating a network abnormal traffic type blocking node spatial position data set D={d 1 ,d 2 ,…,d i ,…,d l}, where d i Represents the spatial location data of the blocking node corresponding to the i-th network abnormal traffic type.

[0014] Preferably, the specific steps of performing a blocking node spatial position search process according to the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data to obtain the real-time network abnormal traffic blocking node spatial position data are as follows: S61, using a breadth-first search algorithm to search the real-time network abnormal traffic type feature data C leixingThe network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are searched for the blocking node spatial position, all the network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are traversed, and the real-time network abnormal traffic type feature data C is searched for. leixing The corresponding network abnormal traffic type matches the network abnormal traffic type and blocks the node spatial location data and performs data identification to generate real-time network abnormal traffic blocking node spatial location data E shishi .

[0015] The real-time network abnormal traffic type feature data and the network abnormal traffic type blocking node spatial position data are searched and processed by a breadth-first search algorithm, and data matching the current situation is searched out from the preset blocking node spatial position data, providing a data basis for abnormal traffic blocking and interception, thereby ensuring the accuracy of the implementation of real-time network abnormal traffic blocking operations.

[0016] Preferably, the specific steps of constructing real-time network abnormal traffic identification data based on the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data, and performing the real-time network abnormal traffic blocking operation are as follows: S71, the real-time network traffic analysis data Q fenxi , the real-time network abnormal traffic type characteristic data C leixing and the real-time network abnormal traffic blocking node spatial location data E shishi Combine data to build real-time network abnormal traffic identification data F=(Q fenxi ,C leixing ,E shishi ); S72, transmitting the real-time network abnormal traffic identification data F=(Q fenxi ,C leixing ,E shishi ) is pushed to the network abnormal traffic identification and blocking platform, and performs real-time network abnormal traffic blocking operations.

[0017] The present invention also discloses a network abnormal transmission identification and blocking system based on data mining, including a real-time network traffic data acquisition module, a real-time network traffic data preprocessing module, a module for establishing characteristic data of different network abnormal traffic types, a real-time network abnormal traffic type analysis module, a network abnormal traffic type blocking node spatial position data preset module, a real-time network abnormal traffic blocking node spatial position search module and a real-time network abnormal traffic identification data construction module; The real-time network traffic data collection module collects the network traffic data of each node passing through the network traffic data collection unit in real time and generates real-time network traffic data; The real-time network traffic data preprocessing module performs network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm to generate real-time network traffic feature data; The module for establishing characteristic data of different network abnormal traffic types establishes characteristic data of different network abnormal traffic types; The real-time network abnormal traffic type analysis module performs real-time network abnormal traffic type analysis processing on the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data through the firefly optimization algorithm to generate real-time network traffic analysis data. If the real-time network traffic analysis data is normal, the network traffic identification operation is terminated; if the real-time network traffic analysis data is abnormal, real-time network abnormal traffic type characteristic data is generated; The blocking node spatial position data presetting module presets corresponding blocking node spatial position data for the characteristic data of different network abnormal traffic types through the network traffic blocking node data storage unit, and generates network abnormal traffic type blocking node spatial position data; The real-time blocking node spatial position search module performs blocking node spatial position search processing on the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data through a breadth-first search algorithm to obtain the real-time network abnormal traffic blocking node spatial position data; The real-time network abnormal traffic identification data construction module combines the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data to construct real-time network abnormal traffic identification data, and pushes it to the network abnormal traffic identification and blocking platform through the wireless communication network, while performing real-time network abnormal traffic blocking operations.

[0018] Beneficial Effects 1. The present invention performs data preprocessing on the collected real-time network traffic data to generate real-time network traffic feature data, and performs real-time network abnormal traffic type analysis processing with established different network abnormal traffic type feature data to generate real-time network traffic analysis data. If the real-time network traffic analysis data is normal, the current network traffic identification operation is terminated; if the real-time network traffic analysis data is abnormal, real-time network abnormal traffic type feature data is generated, and blocking node spatial position search processing is performed with established network abnormal traffic type blocking node spatial position data to obtain real-time network abnormal traffic blocking node spatial position data, and finally real-time network abnormal traffic identification data is constructed, and real-time network abnormal traffic blocking operations are performed to achieve intelligent identification and precise blocking of network abnormal traffic; 2. Perform network traffic data noise reduction processing on the real-time network traffic data through the bilateral filtering algorithm, accurately identify and remove the noise data in the real-time network traffic data, effectively reduce the impact of the noise data in the real-time network traffic data, ensure the reliability of the acquired data, and better highlight the detailed features in the real-time network traffic data; 3. The real-time network abnormal traffic characteristic data and the characteristic data of different network abnormal traffic types are analyzed and processed by the firefly optimization algorithm to achieve scientific analysis of the real-time network abnormal traffic type and accurately identify the type of the real-time network abnormal traffic. At the same time, the firefly optimization algorithm has good robustness and can ensure the stability and reliability of the analysis process. 4. Perform blocking node spatial position search processing on the real-time network abnormal traffic type feature data and the network abnormal traffic type blocking node spatial position data through a breadth-first search algorithm, and search for data matching the current situation from the preset blocking node spatial position data, so as to provide a data basis for abnormal traffic blocking and interception, and ensure the accuracy of the implementation of real-time network abnormal traffic blocking operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the invention, the drawings required for describing the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the invention. For ordinary technicians in this field, they can also obtain drawings based on these drawings without paying creative work.

[0020] Figure 1 A flowchart of a method for identifying and blocking abnormal network transmission based on data mining provided by the present invention; Figure 2 A schematic diagram of a module of a network abnormal transmission identification and blocking system based on data mining provided by the present invention. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] In the description of the present invention, it is necessary to understand that the terms "opening", "upper", "lower", "top", "middle", "inside" and the like indicating orientation or positional relationship are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the components or elements referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as limiting the invention.

[0023] Embodiment 1 is as follows: See also Figure 1 A method for identifying and blocking abnormal network transmission based on data mining includes the following steps: S1, collect real-time network traffic data; S11, the network traffic data collection unit collects the network traffic data of each node in real time and generates a real-time network traffic data set A={a 1 ,a 2 ,…,a i ,…,a k}, where a i It represents the network traffic data of the ith node collected in real time by the network traffic data collection unit, k represents the total number of nodes through which the network traffic data passes, the network traffic data includes but is not limited to source IP address, destination IP address, data packet information, protocol information, traffic transmission rate and traffic distribution, the nodes through which the abnormal network traffic passes include but are not limited to core routers, switches, firewalls and important servers.

[0024] S2, performing data preprocessing on the real-time network traffic data to generate real-time network traffic feature data; S21, performing network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm to generate a real-time network traffic feature data set ,in, represents the real-time network traffic characteristic data obtained after the ith real-time network traffic data in the real-time network traffic data set is subjected to network traffic data noise reduction processing; The performing network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using the bilateral filtering algorithm comprises the following steps: S211, selecting real-time network traffic data in the real-time network traffic data set as sample data; S212, using a bilateral filtering noise reduction formula to perform network traffic data noise reduction processing on the target sample data; the bilateral filtering noise reduction formula is as follows: , Wherein, f(x) represents the target sample data after the network traffic data is subjected to denoising, f(y) represents the target sample data before the network traffic data is subjected to denoising, Ω(x) represents the neighborhood search area centered on the sample point x in the target sample data, and W(x, y) represents the bilateral filter kernel coefficient; S213, repeating the operations from S211 to S212 until all the real-time network traffic data in the real-time network traffic data set are traversed to generate a real-time network traffic feature data set.

[0025] S3. Establish characteristic data of different network abnormal traffic types; S31. Establish a feature dataset B of different network abnormal traffic types. 1 ,b 2 ,…,b i ,…,b l}, where b i It represents the network traffic characteristic data of each node passed when the i-th network abnormal traffic type appears, l represents the total number of characteristic data of different network abnormal traffic types, and the network abnormal traffic types include but are not limited to network traffic distribution abnormality, network traffic transmission rate abnormality, network traffic address abnormality, network attack abnormality and protocol information abnormality.

[0026] S4, performing real-time network abnormal traffic type analysis and processing according to the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data, generating real-time network traffic analysis data, if the real-time network traffic analysis data is normal, then ending the current network traffic identification operation; if the real-time network traffic analysis data is abnormal, then generating real-time network abnormal traffic type characteristic data; S41, performing real-time network abnormal traffic type analysis on the real-time network abnormal traffic feature data set and each different network abnormal traffic type feature data in the different network abnormal traffic type feature data set by using the firefly optimization algorithm, and generating real-time network traffic analysis data Q according to the real-time network abnormal traffic type analysis result. fenxi , if the real-time network traffic analysis data Q fenxi If the real-time network traffic analysis data Q fenxi If it is abnormal, the real-time network abnormal traffic type feature data C is generated. leixing ; S411, construct a firefly population, set the firefly population size to N, the light intensity absorption coefficient to γ, the step size perturbation factor to α, the current number of iterations to t, and the maximum number of iterations to t max And the dimension of the search space of characteristic data of different network abnormal traffic types is P; In the search space for the characteristic data of different network abnormal traffic types, N characteristic data of different network abnormal traffic types are randomly generated, each characteristic data of different network abnormal traffic types corresponds to a firefly individual in the firefly population, and the initial position set of the firefly population is initialized as X={X 1 ,X 2 ,…,X i ,…,X N}, where X i represents the initial position of the i-th firefly individual in the firefly population; S412, calculating the luminous brightness of each firefly individual in the firefly population, arranging each firefly individual in the firefly population from large to small according to the luminous brightness, and selecting the firefly individual with the highest luminous brightness as the current optimal individual; the luminous brightness calculation formula is as follows: , Among them, I i represents the luminous brightness of the i-th firefly individual in the firefly population, x i represents the matching degree between the characteristic data of different network abnormal traffic types corresponding to the i-th firefly individual in the firefly population and the real-time network traffic characteristic data, Indicates the correction value; S413, calculating the spatial distance between individual fireflies in the firefly population; the spatial distance calculation formula is as follows: , Among them, d i,j represents the spatial distance between the i-th firefly individual and the j-th firefly individual in the firefly population, X i,z and X j,z They respectively represent the positions of the i-th firefly individual and the j-th firefly individual in the firefly population in the z-th dimension different network abnormal traffic type feature data search space; S414, calculating the relative attraction between the individual fireflies in the firefly population according to the spatial distance between the individual fireflies in the firefly population; the relative attraction calculation formula is as follows: , Among them, β i,jrepresents the relative attraction between the i-th firefly individual and the j-th firefly individual in the firefly population, β 0 It represents the attraction degree when the distance between any two firefly individuals in the firefly population is 0; S415. Each individual firefly in the firefly population will be attracted by the firefly with higher luminous brightness in the search space of characteristic data of different network abnormal traffic types to update its position. The position update formula is as follows: , in, represents the position of the i-th firefly individual in the firefly population after the position update, and They respectively represent the positions of the i-th firefly individual and the j-th firefly individual in the firefly population in the t-th iteration process, and rand represents a random number that obeys a uniform distribution between (0, 1); The current best individual in the firefly population updates its position by randomly walking in the search space of characteristic data of different network abnormal traffic types; S416, calculating the luminous brightness of each firefly individual in the firefly population after the position is updated in the search space of the characteristic data of different network abnormal traffic types, if the luminous brightness of the firefly individual after the position is updated is greater than the luminous brightness of the original position, then the new position is used to replace the original position; otherwise, the original position is retained; S417, if the luminous brightness of the firefly individual in the search space of the characteristic data of different network abnormal traffic types is greater than the luminous brightness of the current optimal individual, then the firefly individual is used as the new current optimal individual; otherwise, directly enter S418; S418: Determine whether the current number of iterations t is less than the maximum number of iterations t max , if the current number of iterations t is less than the maximum number of iterations t max , then the current iteration number t is increased by 1, and the process returns to S413; otherwise, the current optimal individual is taken as the global optimal solution; S419, set a fitness function threshold. If the fitness function value of the global optimal solution is less than or equal to the fitness function threshold, it means that the real-time network environment is in a safe state, and output the real-time network traffic analysis data Q fenxi If the fitness function value of the global optimal solution is greater than the fitness function threshold, it means that the real-time network environment is in a dangerous state, and the real-time network traffic analysis data Q is output. fenxi The abnormal network traffic type feature data corresponding to the global optimal solution is anomaly, and the data is marked to generate real-time network abnormal traffic type feature data C leixing .

[0027] S5. Establishing spatial location data of network abnormal traffic type blocking nodes; S51, using a network traffic blocking node data storage unit to preset corresponding blocking node spatial position data for different network abnormal traffic type feature data in the different network abnormal traffic type feature data sets, generating a network abnormal traffic type blocking node spatial position data set D={d 1 ,d 2 ,…,d i ,…,d l}, where d i Represents the spatial location data of the blocking node corresponding to the i-th network abnormal traffic type.

[0028] S6. Performing a blocking node spatial position search process according to the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data to obtain the real-time network abnormal traffic blocking node spatial position data; S61, using a breadth-first search algorithm to search the real-time network abnormal traffic type feature data C leixing The network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are searched for the blocking node spatial position, all the network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are traversed, and the real-time network abnormal traffic type feature data C is searched for. leixing The corresponding network abnormal traffic type matches the network abnormal traffic type and blocks the node spatial location data and performs data identification to generate real-time network abnormal traffic blocking node spatial location data E shishi .

[0029] S7, constructing real-time network abnormal traffic identification data based on the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data, and performing a real-time network abnormal traffic blocking operation; S71, the real-time network traffic analysis data Q fenxi , the real-time network abnormal traffic type characteristic data C leixing and the real-time network abnormal traffic blocking node spatial location data E shishi Combine data to build real-time network abnormal traffic identification data F=(Q fenxi ,C leixing ,E shishi ); S72, transmitting the real-time network abnormal traffic identification data F=(Q fenxi ,Cleixing ,E shishi ) is pushed to the network abnormal traffic identification and blocking platform, and performs real-time network abnormal traffic blocking operations.

[0030] Embodiment 2 is as follows: See also Figure 2 , a network abnormal transmission identification and blocking system based on data mining, including a real-time network traffic data acquisition module, a real-time network traffic data preprocessing module, a module for establishing characteristic data of different network abnormal traffic types, a real-time network abnormal traffic type analysis module, a network abnormal traffic type blocking node spatial position data preset module, a real-time network abnormal traffic blocking node spatial position search module and a real-time network abnormal traffic identification data construction module; The real-time network traffic data collection module collects the network traffic data of each node passing through the network traffic data collection unit in real time and generates real-time network traffic data; The real-time network traffic data preprocessing module performs network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm to generate real-time network traffic feature data; The module for establishing characteristic data of different network abnormal traffic types establishes characteristic data of different network abnormal traffic types; The real-time network abnormal traffic type analysis module performs real-time network abnormal traffic type analysis processing on the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data through the firefly optimization algorithm to generate real-time network traffic analysis data. If the real-time network traffic analysis data is normal, the network traffic identification operation is terminated; if the real-time network traffic analysis data is abnormal, real-time network abnormal traffic type characteristic data is generated; The blocking node spatial position data presetting module presets corresponding blocking node spatial position data for the characteristic data of different network abnormal traffic types through the network traffic blocking node data storage unit, and generates network abnormal traffic type blocking node spatial position data; The real-time blocking node spatial position search module performs blocking node spatial position search processing on the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data through a breadth-first search algorithm to obtain the real-time network abnormal traffic blocking node spatial position data; The real-time network abnormal traffic identification data construction module combines the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data to construct real-time network abnormal traffic identification data, and pushes it to the network abnormal traffic identification and blocking platform through the wireless communication network, while performing real-time network abnormal traffic blocking operations.

[0031] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0032] The preferred embodiments of the invention disclosed above are only used to help explain the invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the invention, so that those skilled in the art can understand and use the invention well.

Claims

1. A method for identifying and blocking abnormal network transmission based on data mining, characterized in that: The steps include: S1, collect real-time network traffic data; S2, performing data preprocessing on the real-time network traffic data to generate real-time network traffic feature data; S3. Establish characteristic data of different network abnormal traffic types; S4, performing real-time network abnormal traffic type analysis and processing according to the real-time network traffic characteristic data and the different network abnormal traffic type characteristic data, generating real-time network traffic analysis data, and if the real-time network traffic analysis data is normal, ending this network traffic identification operation; If the real-time network traffic analysis data is abnormal, then real-time network abnormal traffic type feature data is generated; S5. Establishing spatial location data of network abnormal traffic type blocking nodes; S6. Performing a blocking node spatial position search process according to the network abnormal traffic type blocking node spatial position data and the real-time network abnormal traffic type characteristic data to obtain the real-time network abnormal traffic blocking node spatial position data; S7. Construct real-time network abnormal traffic identification data based on the real-time network traffic analysis data, the real-time network abnormal traffic type feature data and the real-time network abnormal traffic blocking node spatial position data, and perform real-time network abnormal traffic blocking operations.

2. According to claim 1, a method for identifying and blocking abnormal network transmission based on data mining is characterized in that: The S1 comprises the following steps: S11, using the network traffic data collection unit to collect network traffic data of each node in real time, generating a real-time network traffic data set A={a1, a2, ..., a i ,…,a k }, where a i It represents the network traffic data of the ith node collected in real time by the network traffic data collection unit, k represents the total number of nodes through which the network traffic data passes, the network traffic data includes but is not limited to source IP address, destination IP address, data packet information, protocol information, traffic transmission rate and traffic distribution, the nodes through which the abnormal network traffic passes include but are not limited to core routers, switches, firewalls and important servers.

3. According to claim 2, a method for identifying and blocking abnormal network transmission based on data mining is characterized in that: The S2 comprises the following steps: S21, performing network traffic data noise reduction processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm to generate a real-time network traffic feature data set ,in, represents the real-time network traffic characteristic data obtained after the ith real-time network traffic data in the real-time network traffic data set is subjected to network traffic data noise reduction processing; The performing network traffic data denoising processing on the real-time network traffic data in the real-time network traffic data set by using a bilateral filtering algorithm comprises the following steps: S211, selecting real-time network traffic data in the real-time network traffic data set as sample data; S212, performing network traffic data noise reduction processing on the target sample data using a bilateral filtering noise reduction formula; S213, repeating the operations from S211 to S212 until all the real-time network traffic data in the real-time network traffic data set are traversed to generate a real-time network traffic feature data set.

4. According to claim 3, a method for identifying and blocking abnormal network transmission based on data mining is characterized in that: The S3 comprises the following steps: S31. Establish a feature dataset of different network abnormal traffic types B={b1,b2,…,b i ,…,b l }, where b i It represents the network traffic characteristic data of each node passed when the i-th network abnormal traffic type appears, l represents the total number of characteristic data of different network abnormal traffic types, and the network abnormal traffic types include but are not limited to network traffic distribution abnormality, network traffic transmission rate abnormality, network traffic address abnormality, network attack abnormality and protocol information abnormality.

5. According to claim 4, a method for identifying and blocking abnormal network transmission based on data mining is characterized in that: The S4 comprises the following steps: S41, performing real-time network abnormal traffic type analysis on the real-time network abnormal traffic feature data set and each different network abnormal traffic type feature data in the different network abnormal traffic type feature data set by using the firefly optimization algorithm, and generating real-time network traffic analysis data Q according to the real-time network abnormal traffic type analysis result. fenxi , if the real-time network traffic analysis data Q fenxi If the real-time network traffic analysis data Q fenxi If it is abnormal, the real-time network abnormal traffic type feature data C is generated. leixing .

6. According to claim 5, a method for identifying and blocking abnormal network transmission based on data mining is characterized in that: The S41 comprises the following steps: S411, construct a firefly population, set the firefly population size to N, the light intensity absorption coefficient to γ, the step size perturbation factor to α, the current number of iterations to t, and the maximum number of iterations to t max And the dimension of the search space for characteristic data of different network abnormal traffic types is P; Randomly generate N different network abnormal traffic type feature data in the different network abnormal traffic type feature data search space, each different network abnormal traffic type feature data corresponds to a firefly individual in the firefly population, and initialize the initial position set of the firefly population; S412, calculating the luminescence brightness of each firefly individual in the firefly population, arranging each firefly individual in the firefly population from large to small according to the luminescence brightness, and selecting the firefly individual with the highest luminescence brightness as the current optimal individual; S413, calculating the spatial distance between individual fireflies in the firefly population; S414, calculating the relative attraction between individual fireflies in the firefly population according to the spatial distance between individual fireflies in the firefly population; S415, each firefly individual in the firefly population is attracted by the firefly individual with higher luminous brightness to update its position in the search space of characteristic data of different network abnormal traffic types; The current best individual in the firefly population updates its position by randomly walking in the search space of characteristic data of different network abnormal traffic types; S416, calculating the luminous brightness of each firefly individual in the firefly population after the position is updated in the search space of the characteristic data of different network abnormal traffic types, if the luminous brightness of the firefly individual after the position is updated is greater than the luminous brightness of the original position, then the new position is used to replace the original position; otherwise, the original position is retained; S417, if the luminous brightness of the firefly individual in the search space of the characteristic data of different network abnormal traffic types is greater than the luminous brightness of the current optimal individual, then the firefly individual is used as the new current optimal individual; otherwise, directly enter S418; S418: Determine whether the current number of iterations t is less than the maximum number of iterations t max , if the current number of iterations t is less than the maximum number of iterations t max , then the current iteration number t is increased by 1, and the process returns to S413; otherwise, the current optimal individual is taken as the global optimal solution; S419, set a fitness function threshold. If the fitness function value of the global optimal solution is less than or equal to the fitness function threshold, it means that the real-time network environment is in a safe state, and output the real-time network traffic analysis data Q fenxi If the fitness function value of the global optimal solution is greater than the fitness function threshold, it means that the real-time network environment is in a dangerous state, and the real-time network traffic analysis data Q is output. fenxi The abnormal network traffic type feature data corresponding to the global optimal solution is anomaly, and the data is marked to generate real-time network abnormal traffic type feature data C leixing .

7. The method for identifying and isolating abnormal network transmission based on data mining according to claim 6 is characterized in that: The S5 comprises the following steps: S51, using a network traffic blocking node data storage unit to preset corresponding blocking node spatial position data for different network abnormal traffic type feature data in the different network abnormal traffic type feature data sets, generating a network abnormal traffic type blocking node spatial position data set D = {d1, d2, ..., d i ,…,d l }, where d i Represents the spatial location data of the blocking node corresponding to the i-th network abnormal traffic type.

8. The method for identifying and isolating abnormal network transmission based on data mining according to claim 7 is characterized in that: The S6 comprises the following steps: S61, using a breadth-first search algorithm to search the real-time network abnormal traffic type feature data C leixing The network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are searched for the blocking node spatial position, all the network abnormal traffic type blocking node spatial position data in the network abnormal traffic type blocking node spatial position data set are traversed, and the real-time network abnormal traffic type feature data C is searched for. leixing The corresponding network abnormal traffic type matches the network abnormal traffic type and blocks the node spatial location data and performs data identification to generate real-time network abnormal traffic blocking node spatial location data E shishi .

9. The method for identifying and blocking abnormal network transmission based on data mining according to claim 8 is characterized in that: The S7 comprises the following steps: S71, the real-time network traffic analysis data Q fenxi , the real-time network abnormal traffic type characteristic data C leixing and the real-time network abnormal traffic blocking node spatial location data E shishi Combine data to build real-time network abnormal traffic identification data F=(Q fenxi ,C leixing ,E shishi ); S72, transmitting the real-time network abnormal traffic identification data F=(Q fenxi ,C leixing ,E shishi ) is pushed to the network abnormal traffic identification and blocking platform, and performs real-time network abnormal traffic blocking operations.

10. A system for implementing the method for identifying and blocking abnormal network transmission based on data mining as described in any one of claims 1 to 9.

Images