Attack message detection method and related equipment

Abstract

One or more embodiments of the invention provide an attack message detection method and related equipment. The method comprises the following steps: formatting a message to obtain a formatted message; constructing a feature vector based on the formatted message; and judging whether the message is abnormal or not based on the feature vector and an attack message detection model. According to the technical scheme, the detection difficulty of the edge equipment attack message in the power network is effectively reduced, and the detection efficiency and precision are improved.

Description

Technical Field

[0001] One or more embodiments of the present application relate to the field of network security technology, and in particular, to an attack message detection method and related equipment. Background Art

[0002] Edge devices are devices located at the edge of the network, which are closer to users and data sources than traditional core networks. The layout of the core network combined with edge devices helps reduce latency, increase data processing speed, and allow real-time, low-latency applications to run. Edge devices can be physical devices such as base stations, gateways, routers, switches, etc., or virtual devices such as virtual network functions or containerized network functions.

[0003] In 5G networks, edge devices play an important role because they bring computing resources closer to the user end, thus supporting emerging technologies such as the Internet of Things, autonomous driving, virtual reality and other demanding application scenarios. Edge devices also play an important role in 5G power networks.

[0004] In the related art, methods for detecting attack messages on edge devices in power networks mainly include traditional network monitoring, rule-based anomaly detection, and expert traffic analysis. However, these methods have low detection efficiency. In addition, since there are many communication protocols in power networks, how to efficiently detect attacks on messages of different communication protocols is also an urgent problem to be solved. Summary of the invention

[0005] In view of this, an object of one or more embodiments of the present application is to provide an attack message detection method and related devices to solve the problems existing in the background technology.

[0006] Based on the above objectives, one or more embodiments of the present application provide an attack message detection method, including:

[0007] Formatting the message to obtain a formatted message;

[0008] Constructing a feature vector based on the formatted message;

[0009] Based on the feature vector and the attack message detection model, it is determined whether the message is abnormal.

[0010] Optionally, the formatting of the message includes:

[0011] Detecting a message protocol corresponding to the message;

[0012] Based on the message protocol, the message header of the message is expanded into a universal format; the message header of the universal format has a fixed length.

[0013] Optionally, the message header in the universal format includes message header fields of all possible message protocols, and the length of the message header fields is fixed.

[0014] Optionally, the extending the message header of the message into a universal format based on the message protocol includes:

[0015] Determine a target message header field corresponding to the message protocol in the message header of the universal format;

[0016] Filling the message header of the message into the target message header field;

[0017] Other message header fields of the message header of the general format are filled with invalid bytes.

[0018] Optionally, the message protocol is a middle-layer protocol corresponding to the message; the middle-layer protocol indicates a network protocol of an intermediate layer between the application layer and the network layer.

[0019] Optionally, the invalid byte is marked by -1.

[0020] Optionally, bytes in the target message header field are marked by 0 or 1.

[0021] Optionally, constructing a feature vector based on the formatted message includes:

[0022] Encoding the formatted message to obtain multiple features;

[0023] Sorting the features based on their importance, and selecting a preset number of top-ranked features as target features;

[0024] The feature vector is constructed based on the target feature.

[0025] Optionally, the attack message detection model is obtained based on convolutional neural network training, and the hyperparameter vector of the convolutional neural network is λ=[δ, s, a, d, η], wherein λ represents the hyperparameter vector to be optimized of the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training.

[0026] Optionally, the training step of the attack message detection model includes:

[0027] Acquire a feature set of a training message, and determine an attack message result corresponding to the training message; the training message is formatted, and the attack message result indicates whether the corresponding training message is an attack message and the message anomaly category of the training message when the training message is an attack message;

[0028] Constructing a training data set based on the feature set of the training message and the corresponding attack message results;

[0029] Based on the training data set, the convolutional neural network is trained until a preset objective function and preset constraints are met;

[0030] Wherein, the preset objective function is:

[0031] The preset constraints are:

[0032] Indicates that the training message is the anomaly detection result of the jth category, y j Indicates that the training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the training message and the abnormal true result; the abnormal true result is determined based on the message abnormal category corresponding to the training message.

[0033] Optionally, the hyperparameters are optimized using a moth flame optimization algorithm.

[0034] Based on the same inventive concept, one or more embodiments of the present application further provide an attack message detection device, including:

[0035] A first computing module is configured to format the message to obtain a formatted message;

[0036] A second calculation module is configured to construct a feature vector based on the formatted message;

[0037] The judgment module is configured to judge whether the message is abnormal based on the feature vector and the attack message detection model.

[0038] Optionally, the first computing module is specifically configured to:

[0039] Detecting a message protocol corresponding to the message;

[0040] Based on the message protocol, the message header of the message is expanded into a universal format; the message header of the universal format has a fixed length.

[0041] Optionally, the message header in the universal format includes message header fields of all possible message protocols, and the length of the message header fields is fixed.

[0042] Optionally, the extending the message header of the message into a universal format based on the message protocol includes:

[0043] Determine a target message header field corresponding to the message protocol in the message header of the universal format;

[0044] Filling the message header of the message into the target message header field;

[0045] Other message header fields of the message header of the general format are filled with invalid bytes.

[0046] Optionally, the message protocol is a middle-layer protocol corresponding to the message; the middle-layer protocol indicates a network protocol of an intermediate layer between the application layer and the network layer.

[0047] Optionally, the invalid byte is marked by -1.

[0048] Optionally, bytes in the target message header field are marked by 0 or 1.

[0049] Optionally, the second computing module is specifically configured to:

[0050] Encoding the formatted message to obtain multiple features;

[0051] Sorting the features based on their importance, and selecting a preset number of top-ranked features as target features;

[0052] The feature vector is constructed based on the target feature.

[0053] Optionally, the attack message detection model is obtained based on convolutional neural network training, and the hyperparameter vector of the convolutional neural network is λ=[δ, s, a, d, η], wherein λ represents the hyperparameter vector to be optimized of the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training.

[0054] Optionally, the training step of the attack message detection model includes:

[0055] Acquire a feature set of a training message, and determine an attack message result corresponding to the training message; the training message is formatted, and the attack message result indicates whether the corresponding training message is an attack message and the message anomaly category of the training message when the training message is an attack message;

[0056] Constructing a training data set based on the feature set of the training message and the corresponding attack message results;

[0057] Based on the training data set, the convolutional neural network is trained until a preset objective function and preset constraints are met;

[0058] Wherein, the preset objective function is:

[0059] The preset constraints are:

[0060] Indicates that the training message is the anomaly detection result of the jth category, y j Indicates that the training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the training message and the abnormal true result; the abnormal true result is determined based on the message abnormal category corresponding to the training message.

[0061] Based on the same inventive concept, one or more embodiments of the present application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an attack message detection method as described in any one of the above items is implemented.

[0062] Based on the same inventive concept, one or more embodiments of the present application further provide a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute any of the above-mentioned attack message detection methods.

[0063] From the above, it can be seen that the attack message detection method provided by one or more embodiments of the present application obtains a formatted message by formatting the message; constructs a feature vector based on the formatted message; and determines whether the message is abnormal based on the feature vector and the attack message detection model. The present application obtains an aligned formatted message that retains all the semantic features of the original message by formatting the message, thereby reducing the difficulty of feature extraction and attack message detection; combined with the attack message detection model, the efficiency and accuracy of attack message detection are improved. That is, the attack message detection method provided by the present application has the advantages of reducing the difficulty of attack message detection and improving the efficiency and accuracy of attack message detection.

[0064] The attack message detection device, electronic device and computer-readable storage medium provided in the present application can implement the steps of the above-mentioned attack message detection method, and therefore also have the beneficial effects of the above-mentioned attack message detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate one or more embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only one or more embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 A flowchart of an attack message detection method according to one or more embodiments of the present application;

[0067] Figure 2 A schematic diagram of the structure of an attack message detection device according to one or more embodiments of the present application;

[0068] Figure 3 A schematic diagram of a message header structure for formatting a message for one or more embodiments of the present application;

[0069] Figure 4 A schematic diagram of the hardware structure of an electronic device according to one or more embodiments of the present application. DETAILED DESCRIPTION

[0070] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0071] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in one or more embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0072] As mentioned in the background technology section, with the continuous development of computer, network and communication technology, the information transmission requirements for the dispatching and operation of the power system are constantly increasing, and the information transmission method has gradually moved towards digitalization and networking. For this reason, the International Electrotechnical Commission Power System Control and Communication Technical Committee (IECTC57) has formulated data communication standards for dispatching automation and substation automation systems according to the requirements of the development of the form, in order to adapt to and guide the development of dispatching automation of the power system, and standardize the technical performance of dispatching automation and telecontrol equipment. The power market forces the communication system to reduce costs, avoid the emergence of multiple incompatible standards and competing standards, and at the same time, formulate a unified and coordinated architecture in the entire power system, which is beneficial to both users and manufacturers.

[0073] In general, the communication protocol system in the power industry is mainly divided into three series, namely: IEC 60870-5 series, telecontrol communication protocol system; IEC 60870-6 series, computer data communication protocol system; IEC 61850-7 series, substation data communication protocol system. These protocol systems are suitable for different application scenarios, and a series of supporting standards are defined according to the application field. Telecontrol communication protocol, computer data communication protocol, and substation data communication protocol each have their own scope of application, and can also be used cross-wise. For example, the IEC 60870-6 series is generally used between control centers; the IEC 60870-5 series is generally used between power plants and control centers, and the IEC 60870-6 series can also be used; the IEC 61850-7 series is generally used between substations and control centers, and the IEC 60870-5 series or IEC 60870-6 series can also be used.

[0074] The communications corresponding to these communication protocol systems are mainly divided into two categories: 1. Ordinary messages, which are implemented using connection protocols such as TCP / IP. Their characteristics are: stable communication, large data volume, and mostly end-to-end communication. Messages use a question-and-answer method to read devices and control them; 2. Fast and urgent messages, which are generally implemented using connectionless protocols. They can be multicast or unicast. Such messages do not necessarily have responses, and their characteristics are high real-time performance. Other methods (such as increasing bandwidth and communicating directly with the link layer) are used to achieve message reliability. Under normal circumstances, such messages are sent once every period of time, and the server is always listening. If a message from a client is not received after a period of time, it is considered that the client is offline. When there is a special event on the client, the client will increase the frequency of message sending.

[0075] For the detection of message attacks on edge devices in power networks, the main methods include: traditional network monitoring and security protection, rule-based anomaly detection methods, manual traffic analysis, and deep packet inspection. Among them, traditional network monitoring and security protection refers to the fact that the power industry may rely on traditional network monitoring and security protection measures, which may include network security devices such as intrusion detection systems and firewalls. Rule-based anomaly detection methods may use pre-defined rules to identify abnormal traffic. These rules are based on known attack patterns or characteristics of abnormal behavior. Manual traffic analysis may require network security experts to manually analyze network traffic, which is usually time-consuming and inefficient. Deep packet inspection is a deep analysis of data packets, including checking protocol headers and payloads to discover potential threats hidden in communication traffic. However, this type of method has low detection efficiency.

[0076] In addition, some related technologies have proposed methods for anomaly detection of power industrial control traffic based on machine learning methods to enhance the network security protection capabilities of power industrial control systems. However, there are problems such as insufficient detection depth, few attack classifications, and weak unknown anomaly identification capabilities. For example, the use of information-physical fusion and time-frequency feature extraction methods to identify abnormal traffic; the threshold-based fractal autoregressive integrated moving average (FARIMA) model to detect anomalies in the IEC 61850 protocol traffic; and the layered analysis method and fractal autoregressive integrated moving average model to detect abnormal traffic behavior. The above methods only rely on the statistical characteristics of the network layer and are difficult to identify power business attacks launched at the application layer.

[0077] Since there are many types of communication protocols commonly used in power networks, it may be possible to format the packets before attack packet detection. The formatted packets can be directly used in the machine learning pipeline, thus standardizing the cumbersome feature development process for a large number of traffic analysis problems. The feature vectors generated by formatting can be directly used to train machine learning models for traffic analysis and classification. Because the feature vectors are already normalized and aligned, standard machine learning algorithms can be more easily applied.

[0078] There are two main existing formatting methods: 1) Semantic representation. The classic view of network traffic views packets as a collection of higher-level headers, such as IP, TCP, and UDP. Each header has semantic fields, such as IP TTL, TCP port number, and UDP length field. The standard semantic representation of network traffic collects all these semantic fields in a single representation. 2) Raw binary representation. Using the raw bitmap representation, order is maintained and reliance on manual feature engineering is reduced. This choice produces a consistent, pre-normalized representation similar to the "image" of each packet. In terms of network packet formatting, existing methods all have problems that they cannot overcome: 1) The formatted message of the semantic representation has the advantages of being complete and unchanged in size, but parsing the semantic structure of each protocol requires domain expertise. Even with this knowledge, determining the correct representation of each feature is usually a major task. For example, domain knowledge may indicate that the TCP source port is an important field, but further (usually manual) evaluation may be required to determine whether to represent it as a continuous value, use a single encoding, and whether the features need to be normalized before training. These decisions must be made for every field extracted in a semantic manner, from the IP address to each unique TCP option to the ICMP address mask; 2) The binary representation converts each packet into a bitmap, ignoring many intricate details including different sizes and protocols. These problems can cause the feature vectors of two packets to have different meanings for the same feature. For example, a TCP packet and a UDP packet with the same IP header will have completely different information when representing the same feature. Therefore, a packet formatting method that is fully aligned, retains the semantic features of the original packet, and is modularly scalable is needed to organize the extracted network packets into a format that is easily recognizable by machine learning models. The present invention proposes a method for formatting middle-layer protocol content, which can organize the extracted middle-layer protocol content into binary packets with consistent length and retain the semantic characteristics of the original message.

[0079] Based on the above content, the present application proposes an attack message detection method to solve the above problem.

[0080] refer to Figure 1 The attack message detection method of one or more embodiments of the present application includes the following steps:

[0081] Step S101: Formatting the message to obtain a formatted message.

[0082] Formatting the message, on the one hand, helps to improve the training effect of the attack message detection model; on the other hand, it also helps to improve the accuracy and efficiency of attack message detection. Although there are many open source data sets and recognition model research based on open source data sets in the field of network traffic detection, considering the application scenarios of the attack message detection model of this application in the power industry, it is recommended to re-collect the data used for model training and perform necessary data processing.

[0083] Before formatting the message, the traffic of the edge device of the power network can be captured and extracted.

[0084] In some embodiments, the above-mentioned capturing and extracting steps may include: capturing and copying the target network traffic; and extracting the messages of the intermediate layer between the transport layer and the network layer in the target network traffic.

[0085] Among them, to capture the target network traffic, you can first confirm the network architecture and data flow between the edge device of the power network and the core network to understand the relevant network layout, confirm the location of the edge device in the power network and how it is connected to the core network, and then use the relevant communication protocol analysis software (such as Wireshark software) to capture the data packets. Capturing and copying the target network traffic needs to be done while ensuring compliance with the authority requirements. During the implementation process, the network interface of the monitoring device can be connected to a Layer 2 link layer device (Network Test Access Point, TAP) and then the Wireshark software can be started to capture data packets on the interface. The above-mentioned TAP device can copy the network traffic and send it to the analysis device for monitoring.

[0086] The above-mentioned analysis device is used to extract and analyze the captured data packets. Specifically, the network traffic of the network layer can be filtered. The network traffic of the target communication protocol can also be filtered. The above-mentioned intermediate layer represents the communication protocol between the network layer and the application layer, such as the transport layer. The above-mentioned extraction and analysis can be achieved through communication protocol analysis software such as Wireshark. For example, all TCP packets can be extracted through Wireshark software using the tcp filter, and the .pcap file captured using the analysis function of Wireshark or TShark can be used to view the detailed information of each TCP segment, including header information, payload data, etc., so as to analyze the input data packets.

[0087] In the process of implementing the present application, the applicant found that the application layer communication protocols of the edge devices in the power network are numerous and complex, but they are all implemented based on a few identical middle-layer protocols. Therefore, the present invention takes the middle-layer protocol part of the network traffic as the main analysis object. Middle-layer protocols refer to communication protocols located between the network layer and the application layer, such as the transport layer. These protocols play an intermediary role in the network protocol stack and provide more abstract services, mainly including TCP / IP protocol, UDP protocol, etc. A method for formatting the content of the middle-layer protocol is proposed here, which can organize the extracted middle-layer protocol content into binary data packets with consistent length and retain the semantic characteristics of the original message.

[0088] The principle of formatting in the present application is to expand the data packet in a standardized way so that the header length of all data packets is fixed, simplifying the data processing flow. Preferably, the data portion of the data packet can also be fixed in length. In this way, it can also be ensured that each data packet is represented by the same number of features, and each feature corresponds to the same meaning.

[0089] In some embodiments, the step of implementing message formatting includes: detecting a message protocol corresponding to the message; based on the message protocol, expanding the message header of the message into a universal format, wherein the length of the message header of the universal format is fixed.

[0090] Optionally, a method for achieving a fixed length of a message header may be to use internal padding to reserve a fixed space for all possible types of message headers of communication protocols, and then fill the message header according to the message communication protocol. That is, regardless of whether there is header data of a certain communication protocol in the data packet, a space is reserved for it so that each message header of the communication protocol has a fixed space. For example, possible message communication protocols include UDP protocol and TCP protocol, then a fixed space is reserved for both the UDP protocol message header and the TCP protocol message header, and then the message header is filled according to the communication protocol type of the data packet.

[0091] Specifically, in some embodiments, the steps of implementing message formatting include: determining the target message header field corresponding to the message protocol in the message header of the universal format; filling the message header of the message into the target message header field; and filling other message header fields of the message header of the universal format with invalid bytes.

[0092] In some embodiments, the invalid byte may be marked by -1. The bytes in the target header field may be marked by 0 or 1. 0 indicates that the header field exists and the value of the specific byte is 0; 1 indicates that the header field exists and the value of the characteristic byte is 1.

[0093] like Figure 3When the communication protocol corresponding to the message is TCP / IP, the bytes of the TCP header field and the IP header field are filled with 0 or 1, and the bytes of the UDP header field and the ICMP header field are filled with -1. When the communication protocol corresponding to the message is UDP / IP, the bytes of the UDP header field and the IP header field are filled with 0 or 1, and the bytes of the TCP header field and the ICMP header field are filled with -1.

[0094] The nature of the data in a common format makes it possible to interpret the formatted messages at the bit level. In this way, researchers can map packets back to their semantic domain, thereby better understanding the specific features that drive the performance of certain models.

[0095] According to the above content, the formatted message has the following characteristics: 1) The formatted data packet is complete and aligned. Such alignment effectively reduces the misalignment problem that may be caused by unaligned binary representation; 2) The length of each data packet is constant, ensuring the standardization of the processing process. This constant length further simplifies the storage, transmission and parsing of data packets; 3) The formatted message is standardized and is a mixture of semantic data packets and binary data packet representations. These data retain the specific semantic structure of the data packet, because they identify and interpret the inherent meaning of the message; 4) Since the length of the formatted message is fixed and the structure is unified, technicians do not have to parse each message field by field. They only need to know the maximum length of the protocol to encode, which greatly reduces the complexity of parsing and processing costs; 5) Invalid bytes are marked by -1, and the data in the processing process is more semantically clear, which helps to avoid misunderstandings and misinterpretations.

[0096] Step S102: construct a feature vector based on the above formatted message.

[0097] Features may be extracted by any existing method, and this application does not limit the feature extraction method.

[0098] In some embodiments, the features are combined in sequence to construct a feature vector.

[0099] In some embodiments, the above features may be screened according to their importance and then a feature vector may be constructed, which may reduce the dimension of the feature vector and improve the efficiency of subsequent attack message detection.

[0100] Random Forest (RF) is a powerful and flexible machine learning algorithm that improves prediction accuracy and stability by constructing and combining multiple decision trees. The core idea of ​​the RF algorithm is to use the strategy of ensemble learning to construct multiple decision trees by random sampling and random selection of feature subsets, and summarize the prediction results of these decision trees. This method can effectively reduce the overfitting phenomenon and improve the generalization ability of the model to unknown data. The RF algorithm is widely used in classification, regression, feature selection and other fields, and is favored for its advantages such as easy understanding and implementation, high computational efficiency and strong robustness. In some embodiments, the random forest algorithm can be used to rank the importance of features.

[0101] The random forest algorithm not only provides powerful prediction capabilities, but also has a built-in feature importance evaluation mechanism that can be used for feature sorting and screening. In the RF model, each feature is considered in the process of building a decision tree, and its importance is evaluated based on its contribution to reducing the impurity of the tree. By calculating the importance score of each feature in all decision trees and taking the average, we can get a global importance ranking for each feature. Based on this ranking, we can sort the features to understand which features contribute the most to the model prediction. In addition, we can also set a threshold or select a subset of features that have a significant impact on the model performance based on a specific number of features to achieve feature screening. This approach helps to reduce the dimensionality of the data set and improve the training efficiency and prediction performance of the model.

[0102] Step S103: Based on the feature vector and the attack message detection model, determine whether the message is abnormal.

[0103] The feature vector corresponding to the message is input into the above attack message detection model to determine whether it is an attack message.

[0104] In some embodiments, the attack message detection model is obtained by training a convolutional neural network. Specifically, it can be a one-dimensional neural network (Conv1D Convolutional Neural Networks, 1D-CNN) model of a given structure. In some embodiments, the 1D-CNN model is composed of 8 one-dimensional convolutional layers, 4 one-dimensional pooling layers, 1 dropout layer, 1 tiling layer and 1 fully connected layer.

[0105] Correspondingly, the hyperparameter vector of the above 1D-CNN model can be set to λ=[δ,s,a,d,η], where λ represents the hyperparameter vector to be optimized for the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training. Wherein, a=0 represents the activation function is the linear rectification function (Linear rectification function, ReLU), a=1 represents the activation function sigmoid(), and a=2 represents the activation function tanh().

[0106] For a 1D-CNN model of a given structure, setting appropriate hyperparameters can not only improve the accuracy of message anomaly detection, but also speed up model training.

[0107] The moth-flame optimization (MFO) algorithm is derived from the lateral positioning mechanism of moths. The position of the moth is used as the optimization problem to be solved. After each iteration, the fitness values ​​of the moths are sorted and assigned to the flames. The distance between the moth and the flame is calculated according to the spiral function to update the position of the moth. At the same time, the flame adaptive reduction mechanism is adopted in the optimization process, and the optimization is continuously optimized until the maximum number of iterations is reached. The MFO algorithm has good local development capabilities and global search capabilities, and shows good robustness and convergence when solving optimization problems, and can be used in actual engineering projects. Therefore, in some embodiments of the present application, the moth-flame optimization algorithm can be used for hyperparameter optimization calculations.

[0108] In some embodiments, the training steps of the above-mentioned attack message detection model include: obtaining a feature set of training messages, and determining the attack message results corresponding to the above-mentioned training messages; the above-mentioned training messages are formatted, and the attack message results indicate whether the corresponding training messages are attack messages and the message anomaly category of the training messages when the training messages are attack messages; based on the feature set of the above-mentioned training messages and the corresponding attack message results, constructing a training data set; based on the above-mentioned training data set, training the above-mentioned convolutional neural network until the preset objective function and preset constraints are met.

[0109] The ReLU function is a commonly used activation function used in hidden layers and output layers in artificial neural networks. The ReLU activation function has the following characteristics: 1) Nonlinearity. The ReLU function is a nonlinear function because it has a breakpoint near x=0 and the function value changes discontinuously; 2) Sparse activation. The derivative of the ReLU function is 1. When the input is positive, the gradient remains constant 1, which helps to reduce the problem of gradient disappearance. In addition, the ReLU function maps negative input values ​​to zero, so that neurons can respond more sparsely in the form of "activation" and "non-activation". 3) Efficient calculation. The calculation of the ReLU function is very simple. It only needs to compare the size relationship between the input value and zero and return a larger value. This makes the calculation of the ReLU function very efficient and has advantages in large-scale neural networks.

[0110] Thus, in some embodiments, the preset objective function is: The above preset constraints are: Indicates that the above training message is the anomaly detection result of the jth category, y j Indicates that the above training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the above training message and the abnormal true result; the abnormal true result is determined based on the message abnormal category corresponding to the training message.

[0111] It can be understood that the method can be executed by any device, equipment, platform, or device cluster having computing and processing capabilities.

[0112] It should be noted that the method of one or more embodiments of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of the present application, and the multiple devices will interact with each other to complete the described method.

[0113] It should be noted that the above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0114] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides an attack message detection device.

[0115] like Figure 2 As shown, the above-mentioned attack message detection device includes:

[0116] The first calculation module 11 is configured to format the message to obtain a formatted message;

[0117] A second calculation module 12 is configured to construct a feature vector based on the formatted message;

[0118] The judgment module 13 is configured to judge whether the message is abnormal based on the feature vector and the attack message detection model.

[0119] Optionally, the first calculation module is specifically configured as follows:

[0120] Detect the message protocol corresponding to the above message;

[0121] Based on the above message protocol, the message header of the above message is expanded into a universal format; the message header length of the universal format is fixed.

[0122] Optionally, the message header in the general format includes message header fields of all possible message protocols, and the length of the message header fields is fixed.

[0123] Optionally, based on the message protocol, the message header of the message is expanded into a common format, including:

[0124] Determine the target message header field corresponding to the message protocol in the message header of the general format;

[0125] Fill the message header of the above message into the above target message header field;

[0126] The other message header fields of the message header in the above general format are filled with invalid bytes.

[0127] Optionally, the message protocol is a middle-layer protocol corresponding to the message; the middle-layer protocol indicates a network protocol of an intermediate layer between the application layer and the network layer.

[0128] Optionally, the above invalid bytes are marked by -1.

[0129] Optionally, bytes in the above target message header field are marked by 0 or 1.

[0130] Optionally, the second calculation module is specifically configured as follows:

[0131] Encoding the formatted message to obtain multiple features;

[0132] Sort the above features based on their importance, and select a preset number of top-ranked features as target features;

[0133] The feature vector is constructed based on the target feature.

[0134] Optionally, the attack message detection model is obtained based on convolutional neural network training, and the hyperparameter vector of the convolutional neural network is λ=[δ, s, s, d, η], wherein λ represents the hyperparameter vector to be optimized for the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training.

[0135] Optionally, the training steps of the attack message detection model include:

[0136] Obtaining a feature set of a training message, and determining an attack message result corresponding to the training message; the training message is formatted, and the attack message result indicates whether the corresponding training message is an attack message and the message anomaly category of the training message when the training message is an attack message;

[0137] Based on the feature set of the training messages and the corresponding attack message results, a training data set is constructed;

[0138] Based on the training data set, the convolutional neural network is trained until a preset objective function and preset constraints are met;

[0139] Among them, the above preset objective function is:

[0140] The above preset constraints are:

[0141] Indicates that the above training message is the anomaly detection result of the jth category, y j Indicates that the above training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the above training message and the abnormal true result; the above abnormal true result is determined based on the message abnormal category corresponding to the above training message.

[0142] Optionally, the above hyperparameters are optimized using a moth flame optimization algorithm.

[0143] For the convenience of description, the above devices are described in terms of functions and modules. Of course, when implementing one or more embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0144] The apparatus of the above-mentioned embodiment is used to implement the corresponding method in the above-mentioned embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0145] Figure 4 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0146] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0147] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solution provided in the embodiment of the present application is implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0148] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0149] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0150] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0151] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiment of the present application, and does not necessarily include all the components shown in the figure.

[0152] The electronic device of the above embodiment is used to implement the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0153] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0154] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0155] In addition, to simplify the description and discussion, and in order not to make one or more embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present application will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present disclosure, it is obvious to those skilled in the art that one or more embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0156] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0157] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the scope of protection of this disclosure.

Claims

1. A method for detecting attack messages, characterized in that: include: Formatting the message to obtain a formatted message; Constructing a feature vector based on the formatted message; Based on the feature vector and the attack message detection model, it is determined whether the message is abnormal.

2. The method according to claim 1, characterized in that The formatting of the message includes: Detecting a message protocol corresponding to the message; Based on the message protocol, the message header of the message is expanded into a universal format; the message header of the universal format has a fixed length.

3. The method according to claim 2, characterized in that The message header in the universal format includes message header fields of all possible message protocols, and the length of the message header fields is fixed.

4. The method according to claim 3, characterized in that The step of expanding the message header of the message into a universal format based on the message protocol includes: Determine a target message header field corresponding to the message protocol in the message header of the universal format; Filling the message header of the message into the target message header field; Other message header fields of the message header of the general format are filled with invalid bytes.

5. The method according to claim 2, characterized in that: The message protocol is a middle-layer protocol corresponding to the message; the middle-layer protocol indicates a network protocol of an intermediate layer between the application layer and the network layer.

6. The method according to claim 4, characterized in that The invalid bytes are marked by -1.

7. The method according to claim 4, characterized in that The bytes in the target message header field are marked by 0 or 1.

8. The method according to claim 1, characterized in that The constructing a feature vector based on the formatted message includes: Encoding the formatted message to obtain multiple features; Sorting the features based on their importance, and selecting a preset number of top-ranked features as target features; The feature vector is constructed based on the target feature.

9. The method according to claim 1, characterized in that: The attack message detection model is obtained based on convolutional neural network training, and the hyperparameter vector of the convolutional neural network is λ=[δ, s, a, d, η], wherein λ represents the hyperparameter vector to be optimized for the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training.

10. The method according to claim 9, characterized in that The training steps of the attack message detection model include: Acquire a feature set of a training message, and determine an attack message result corresponding to the training message; the training message is formatted, and the attack message result indicates whether the corresponding training message is an attack message and the message anomaly category of the training message when the training message is an attack message; Constructing a training data set based on the feature set of the training message and the corresponding attack message results; Based on the training data set, the convolutional neural network is trained until a preset objective function and preset constraints are met; Wherein, the preset objective function is: The preset constraints are: Indicates that the training message is the anomaly detection result of the jth category, y j Indicates that the training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the training message and the abnormal true result; the abnormal true result is determined based on the message abnormal category corresponding to the training message.

11. The method according to claim 9 or 10, characterized in that: The hyperparameters are optimized using the moth flame optimization algorithm.

12. An attack message detection device, characterized in that: include: A first computing module is configured to format the message to obtain a formatted message; A second calculation module is configured to construct a feature vector based on the formatted message; The judgment module is configured to judge whether the message is abnormal based on the feature vector and the attack message detection model.

13. The device according to claim 12, characterized in that The first computing module is specifically configured as follows: Detecting a message protocol corresponding to the message; Based on the message protocol, the message header of the message is expanded into a universal format; the message header of the universal format has a fixed length.

14. The device according to claim 13, characterized in that The message header in the universal format includes message header fields of all possible message protocols, and the length of the message header fields is fixed.

15. The device according to claim 14, characterized in that The step of expanding the message header of the message into a universal format based on the message protocol includes: Determine a target message header field corresponding to the message protocol in the message header of the universal format; Filling the message header of the message into the target message header field; Other message header fields of the message header of the general format are filled with invalid bytes.

16. The device according to claim 13, characterized in that The message protocol is a middle-layer protocol corresponding to the message; the middle-layer protocol indicates a network protocol of an intermediate layer between the application layer and the network layer.

17. The device according to claim 15, characterized in that The invalid bytes are marked by -1.

18. The device according to claim 15, characterized in that The bytes in the target message header field are marked by 0 or 1.

19. The device according to claim 12, characterized in that The second computing module is specifically configured as follows: Encoding the formatted message to obtain multiple features; Sorting the features based on their importance, and selecting a preset number of top-ranked features as target features; The feature vector is constructed based on the target feature.

20. The device according to claim 12, characterized in that The attack message detection model is obtained based on convolutional neural network training, and the hyperparameter vector of the convolutional neural network is λ=[δ, s, a, d, η], wherein λ represents the hyperparameter vector to be optimized for the convolutional neural network, δ represents the initial number of convolution kernels of the convolutional neural network, s represents the size of the convolution kernel of the convolutional neural network, a represents the activation function, d represents the probability value of discarding neurons in the exit layer of the convolutional neural network; η represents the learning rate of the convolutional neural network training.

21. The device according to claim 20, characterized in that The training steps of the attack message detection model include: Acquire a feature set of a training message, and determine an attack message result corresponding to the training message; the training message is formatted, and the attack message result indicates whether the corresponding training message is an attack message and the message anomaly category of the training message when the training message is an attack message; Constructing a training data set based on the feature set of the training message and the corresponding attack message results; Based on the training data set, the convolutional neural network is trained until a preset objective function and preset constraints are met; Wherein, the preset objective function is: The preset constraints are: Indicates that the training message is the anomaly detection result of the jth category, y j Indicates that the training message is the abnormal true result of the jth category, n1 represents the total number of message abnormal categories and message normal categories, and L represents the error between the abnormal detection result of the training message and the abnormal true result; the abnormal true result is determined based on the message abnormal category corresponding to the training message.

22. The device according to claim 20 or 21, characterized in that The hyperparameters are optimized using the moth flame optimization algorithm.

23. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 11 is implemented.

24. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute any one of claims 1 to 11.

Images