Network security active defense method and system for detecting abnormal network behaviors

Abstract

The invention discloses a network security active defense method and system for detecting abnormal network behaviors. The method comprises the following steps: S1, constructing a virtualized isolation network environment through a software defined network technology; s2, deploying intelligent dynamic camouflage nodes in the virtualized isolation environment; s3, acquiring a disguised node attack behavior, and identifying a network abnormal behavior through a deep learning technology; s4, extracting network abnormal behavior features, and identifying potential threats through a deep learning technology; s5, a defense mechanism is automatically triggered, a honeynet is started, and abnormal behaviors and potential threats are isolated; and S6, tracing an attack path, and carrying out source positioning. The network security active defense system comprises a network construction module, a deployment module, an identification module, a honeynet, an isolation module and a tracing module. The disguised nodes are deployed through the deployment module to detect abnormal network behaviors, active defense of network security is realized through the honeynet, the isolation module and the tracing module, and the network security is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security active defense method and system for detecting abnormal network behavior. Background Art

[0002] With the rapid development of Internet technology, network security faces unprecedented challenges. Network attack methods are becoming increasingly complex and varied, and traditional signature-based detection methods are difficult to effectively respond to new attacks. In addition, attackers are constantly looking for new vulnerabilities and weaknesses, which makes the security threats in the network environment continue to increase. In order to improve the security and stability of the network, a method that can actively discover and defend against abnormal network behavior is needed.

[0003] Traditional network security solutions are mostly based on the concept of perimeter defense, which prevents external threats from entering the internal network by setting up firewalls and using antivirus software. Although this method can protect the network from external attacks to a certain extent, it is helpless against threats that have already penetrated the internal network. In addition, traditional solutions usually require advance knowledge of attack patterns to effectively defend, and often cannot respond to new or zero-day attacks in a timely manner. With the continuous advancement of attack technology, these static rule-based security measures have gradually exposed their limitations and vulnerabilities.

[0004] In recent years, the industry has begun to explore more advanced active defense strategies, such as the application of honeypot technology and behavioral analysis technology. Honeypot technology attracts attackers by setting up virtual targets to facilitate the study of attack methods and early warning; while behavioral analysis technology can detect potential threats by monitoring abnormal behavior patterns in the network. Although these technologies have achieved certain results in improving network security, they still have some shortcomings, such as honeypots are easy to identify and behavioral analysis has a high false alarm rate. Existing active defense systems often focus on a single technical means and lack effective integration of multiple technologies, resulting in limited defense capabilities.

[0005] Therefore, in order to solve the above technical problems, the present invention proposes a network security active defense method and system for detecting abnormal network behavior. Summary of the invention

[0006] The present invention provides a network security active defense method for detecting abnormal network behavior, specifically comprising:

[0007] S1: Build a virtualized isolated network environment through software-defined network technology;

[0008] S2: Deploy intelligent dynamic camouflage nodes in a virtualized isolation environment;

[0009] S3: Obtain the attack behavior of disguised nodes and identify abnormal network behavior through deep learning technology;

[0010] S4: Extract network abnormal behavior features and identify potential threats through deep learning technology;

[0011] S5: Automatically trigger the defense mechanism, start the honeynet, and isolate abnormal behaviors and potential threats;

[0012] S6: Trace the attack path and locate the source.

[0013] Preferably, the virtualized isolated network environment is constructed by software defined network technology in S1, specifically including:

[0014] S1.1: Use software-defined network controllers to manage network resources, communicate with switches in the network through the OpenFlow protocol, and separate the data plane from the control plane;

[0015] S1.2: Deploy multiple virtual networks in the software-defined network architecture, each of which consists of a set of logically isolated virtual switches and virtual routers;

[0016] S1.3: Use the software-defined network controller to send flow table rules to each virtual switch to guide the forwarding of data packets and build multiple independent virtual network environments on the physical network;

[0017] S1.4: Create virtual machines as nodes in the network. Each node runs a specific service or application and is connected to the corresponding virtual network through a virtual switch.

[0018] S1.5: Dynamically adjust the topology and resource allocation of the virtual network through network configuration algorithms to ensure efficient and secure network services when the network load changes.

[0019] Preferably, the deployment of intelligent dynamic camouflage nodes in a virtualized isolation environment in S2 specifically includes:

[0020] The software-defined network controller uses virtualization technology to deploy multiple camouflage nodes in each virtual network environment; the camouflage nodes simulate real service ports and protocols, and confuse attackers by dynamically adjusting the status, service type and response mode of the camouflage nodes; the camouflage nodes set specific trigger conditions, and when an access request that meets the preset mode is detected, the camouflage nodes are automatically activated to guide potential attackers into the preset trap area to collect attack information;

[0021] The method captures all network connection requests flowing to the camouflage node by deploying a camouflage node in a virtual network environment, uses the flow table matching function of the software-defined network controller to filter and record all external requests that attempt to establish a connection with the camouflage node, parses the collected data packets, extracts the source IP address, destination port number, and communication protocol type information, and identifies network attack behaviors.

[0022] Preferably, in S3, the network attack behavior of the disguised node is identified, and a neural network recognition model is constructed by deep learning technology. The neural network recognition model includes an input layer, a hidden layer and an output layer. The hidden layer adopts LSTM units to capture the long-term dependencies in the time series data. The neural network recognition model is trained using a network attack behavior training set. Where N represents the number of network attack behaviors, y i represents the i-th network attack behavior, represents the i-th network attack prediction behavior, W is the i-th network attack behavior representation model weight, and γ is the regularization parameter; the neural network recognition model is used to identify abnormal behaviors from network data in a virtualized isolated network environment.

[0023] Preferably, the feature extraction of network abnormal behavior in S4 is performed by principal component analysis technology, and the principal component analysis technology performs dimensionality reduction processing on high-dimensional data features of abnormal behavior features; the feature extraction of abnormal behavior is performed by calculating the covariance matrix of abnormal behavior features. where x i represents the i-th abnormal behavior feature data, u represents the mean of the abnormal behavior feature data, N t Represents the total number of abnormal behaviors. By solving the abnormal behavior eigenvalue λ and the corresponding eigenvector V of the covariance matrix, the eigenvectors corresponding to the first k abnormal behavior eigenvalues ​​are selected to form the transformation matrix V k , use the transformation matrix to project the abnormal behavior feature value into the new k-dimensional space, the formula is: X′=XV k , where X represents the abnormal behavior eigenvalue matrix, and X′ represents the abnormal behavior eigenvalue matrix after dimensionality reduction.

[0024] Preferably, after extracting the network abnormal behavior features, a deep neural network threat model is constructed through deep learning technology, and the extracted abnormal behavior feature value x i As input, a nonlinear transformation is performed through a multilayer perceptron, and the formula is: (l+1) =σ(W (l) z (l) +b (l) ), where z (l) is the abnormal behavior feature vector of the lth layer, W (l) is the weight matrix, b (l)is the bias vector, σ is the ReLU activation function, and the threat probability is output through the softmax layer. The output layer calculates the threat probability p=softmax(z (L) ), where L is the isolated network environment, and the potential threat of the isolated network environment is obtained through the threat probability p.

[0025] Preferably, the defense mechanism is automatically triggered after detecting the attack behavior of the disguised node, and the software-defined network controller immediately triggers a defense response according to the preset security policy; the response mechanism includes but is not limited to instantly updating the flow table rules, redirecting network requests from known threat sources to the honeynet environment, blocking related IP addresses or ports, and preventing malicious network requests from continuing to spread; the software-defined network controller is able to dynamically adjust the network topology, isolate the affected virtual network parts, and prevent the threat from spreading to the entire network system.

[0026] Preferably, the honeynet is a multi-level honeynet structure constructed in a software-defined network controller, and multiple virtual environments are constructed through the multi-level honeynet structure to attract, detect and analyze potential attack behaviors; when abnormal network activities are detected in the virtual environment constructed by the multi-level honeynet structure, the software-defined network controller automatically redirects the suspicious behavior to the multi-level honeynet structure environment; the multi-level honeynet structure internally deploys virtual nodes and services that simulate real systems, and makes attackers mistakenly believe that they have found the real target and perform internal operations and activities. The multi-level honeynet structure monitors the attacker's operations, collects detailed attack techniques and tool information, and uses the attack techniques and tool information to optimize the defense mechanism and generate security policies.

[0027] Preferably, the attack path tracing constructs a timeline of attack events by collecting and integrating attack related information in honeynets, camouflage nodes and network logs, and analyzes the attacker's behavior pattern to identify key nodes of the attack path. The timeline formula of the attack event is: p (p) = α × t(p) + β × n(p), where p represents the attack path, t(p) represents the average access time of all nodes on the path, n(p) represents the number of nodes on the path, α is the weight coefficient of the average access time of the preset nodes, β is the weight coefficient of the number of preset path nodes, C p (p) is the attack path cost;

[0028] The source location calculates the risk score of each potential source node by combining the attack path cost with the node risk assessment model. The formula is R s (s) = γ × C p(p)(s→q)+δ×v(s), where s is the potential attack source node, q is the attacked target node, v(s) is the security assessment value of the source node, γ is the attack weight parameter, and δ is the security assessment value weight parameter. The attack initiation point is determined by comparing the risk scores of different potential source nodes.

[0029] A network security active defense system for detecting abnormal network behavior, the network security active defense system comprising a network construction module, a deployment module, an identification module, a honeynet, an isolation module and a tracing module;

[0030] The network construction module constructs a virtualized isolated network environment through software-defined network technology, deploys multiple virtual networks in the virtualized isolated network environment, and each virtual network consists of a group of virtual switches and virtual routers that are logically isolated from each other;

[0031] The deployment module deploys multiple camouflage nodes in a virtual network environment using virtualization technology, and dynamically adjusts the status, service type and response mode to confuse attackers;

[0032] The identification module obtains the attack behavior of the disguised node and uses the three-dimensional deep learning technology to identify abnormal network behavior and potential threats;

[0033] The honeynet redirects abnormal behaviors and potential threats to the honeynet environment through a software-defined network controller, uses virtual nodes and services deployed inside the honeynet to simulate real systems, monitors attackers' operations, and collects detailed information on attack techniques and tools;

[0034] The isolation module blocks IP addresses or ports for abnormal behaviors and potential threats, prevents malicious network requests from continuing to spread, dynamically adjusts network topology through software-defined network controllers, and isolates affected virtual network parts;

[0035] The tracing module constructs a timeline of attack events, uses path cost calculation to identify attack paths, and locates the source of attacks in combination with a node risk assessment model.

[0036] Compared with the prior art, the technical solution of this application has the following technical effects:

[0037] The present invention constructs a virtualized isolated network environment through software-defined network technology, solves the problem of insufficient resource management and security isolation in the traditional network environment, obtains an efficient, flexible and secure network environment, manages network resources using a software-defined network controller, and communicates with switches in the network through the OpenFlow protocol, thereby realizing the separation of the data plane and the control plane. This not only improves the management efficiency of network resources, but also enhances the security of the network by deploying multiple logically isolated virtual networks, ensuring rapid response and isolation of threats in the face of complex network attacks.

[0038] The present invention solves the passivity and singularity problems of traditional honeypot technology by deploying intelligent dynamic camouflage nodes in a virtual network environment, and obtains more flexible and efficient attack detection and information collection capabilities. The camouflage nodes simulate real service ports and protocols, and confuse attackers by dynamically adjusting the state, service type and response mode. When an access request that meets the preset mode is detected, the camouflage node is automatically activated to guide potential attackers into a preset trap area to collect attack information. This method not only improves the accuracy of attack detection, but also can more comprehensively understand the attacker's intentions and means.

[0039] The present invention uses deep learning technology to construct a neural network recognition model to identify abnormal network behavior, solve the problem that the traditional rule-based detection method is insufficient in detecting unknown threats, and obtain higher detection accuracy and real-time performance; the neural network recognition model includes an input layer, a hidden layer, and an output layer. The hidden layer uses LSTM units, which can capture long-term dependencies in time series data. By training the model with a network attack behavior training set, abnormal behavior can be effectively identified, and the detection capability of unknown threats is improved. This enables the system to detect and take measures in time at the early stage of an attack, reducing potential losses.

[0040] The present invention extracts network abnormal behavior features through principal component analysis technology, solves the problems of information redundancy and high computational complexity in the process of extracting high-dimensional data features, and obtains a more concise and effective feature representation. The principal component analysis technology performs dimensionality reduction processing on the high-dimensional data of abnormal behavior features, selects the first few principal components to form a transformation matrix, and projects the abnormal behavior feature values ​​into a new low-dimensional space. This not only reduces the dimension of the data and reduces the computational complexity, but also retains the main features of the data, improving the accuracy and efficiency of subsequent threat models. In this way, the system can identify potential threats more quickly and accurately, and improve the overall defense level.

[0041] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application so that it can be implemented in accordance with the contents of the specification, and to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the following is a detailed description of the preferred embodiments of the present application in conjunction with the accompanying drawings as follows.

[0042] Based on the detailed description of the specific embodiments of the present application in combination with the accompanying drawings below, those skilled in the art will become more aware of the above and other objects, advantages and features of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings without creative work. In all drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, each element or part is not necessarily drawn according to the actual scale.

[0044] Figure 1 A schematic diagram of a network security active defense method for detecting abnormal network behavior according to the present invention;

[0045] Figure 2 A flowchart of a network security active defense method for detecting abnormal network behavior according to the present invention;

[0046] Figure 3 A virtualized network isolation environment flow chart of a network security active defense method for detecting abnormal network behavior according to the present invention;

[0047] Figure 4 A diagram of a network security active defense system for detecting abnormal network behavior according to the present invention;

[0048] Figure 5 A schematic diagram of a honeynet of a network security active defense system for detecting abnormal network behavior according to the present invention. DETAILED DESCRIPTION

[0049] To make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiment of the present application. Obviously, the described embodiment is a part of the embodiment of the present application, rather than all of the embodiments. In the following description, specific details such as specific configuration and components are provided only to help fully understand the embodiments of the present application. Therefore, it should be clear to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present application. In addition, for clarity and brevity, the description of known functions and structures is omitted in the embodiment.

[0050] It should be understood that the references to "one embodiment" or "this embodiment" throughout the specification mean that the specific features, structures, or characteristics associated with the embodiment are included in at least one embodiment of the present application. Therefore, the references to "one embodiment" or "this embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. In addition, these specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0051] In addition, the present application may repeat reference numerals and / or letters in different examples. This repetition is for the purpose of simplicity and clarity, and does not in itself indicate the relationship between the various embodiments and / or settings discussed.

[0052] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist at the same time. The term " / and" in this article describes another type of association object relationship, indicating that there can be two relationships. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " in this article generally indicates that the previous and next associated objects are in an "or" relationship.

[0053] The term "at least one" in this article is merely a description of the association relationship of associated objects, indicating that there may be three relationships. For example, at least one of A and B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0054] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusions.

[0055] Example 1

[0056] This embodiment mainly describes a network security active defense method for detecting abnormal network behavior, such as Figure 1 As shown in the figure, by building a virtualized isolated network environment and deploying intelligent dynamic camouflage nodes, attackers are confused by simulating real service ports and protocols, and then attack information is captured. Deep learning technology is used to identify abnormal network behavior and potential threats. Through the automatically triggered defense mechanism, abnormal behavior and potential threats are isolated in time, and the attacker's behavior pattern is further analyzed through honeynet technology.

[0057] Specific content, such as Figure 2 As shown, the following steps are included:

[0058] S1: Build a virtualized isolated network environment through software-defined network technology;

[0059] Further, if Figure 3 As shown in the figure, how to build a virtualized isolated network environment is detailed, including:

[0060] S1.1: Use software-defined network controllers to manage network resources, communicate with switches in the network through the OpenFlow protocol, and separate the data plane from the control plane;

[0061] S1.2: Deploy multiple virtual networks on the software-defined network architecture, each of which consists of a set of logically isolated virtual switches and virtual routers;

[0062] S1.3: Use the software-defined network controller to send flow table rules to each virtual switch to guide the forwarding of data packets and build multiple independent virtual network environments on the physical network;

[0063] S1.4: Create virtual machines as nodes in the network. Each node runs a specific service or application and is connected to the corresponding virtual network through a virtual switch.

[0064] S1.5: Dynamically adjust the topology and resource allocation of the virtual network through the network configuration algorithm to ensure efficient and secure network services when the network load changes;

[0065] Furthermore, the network configuration algorithm evaluates the network load by monitoring the operation of each node, determines the communication requirements between nodes based on the communication frequency and data exchange volume between nodes, evaluates the possibility of each node being attacked, and determines the security priority of each node.

[0066] S2: Deploy intelligent dynamic camouflage nodes in a virtualized isolation environment;

[0067] Furthermore, through the software-defined network controller, virtualization technology is used to deploy multiple camouflage nodes in each virtual network environment; the camouflage node simulates the real service port and protocol, and confuses the attacker by dynamically adjusting the state, service type and response mode of the camouflage node; the camouflage node automatically activates the camouflage node by setting specific trigger conditions when an access request that meets the preset mode is detected, guiding the potential attacker into the preset trap area to collect attack information;

[0068] Furthermore, the disguised node sets specific trigger conditions, including: when the number of visits to the disguised node by the IP address of the network behavior exceeds a preset threshold within a predetermined time, the disguised node is triggered to activate; when an access request that does not conform to a preset mode is detected, the disguised node is triggered to activate; when a behavior that does not conform to the normal communication protocol is detected, the disguised node is triggered to activate; when the IP address of the network behavior attempts to log in to the disguised node multiple times in a short period of time but fails to authenticate, the disguised node is triggered to activate;

[0069] Furthermore, specific trigger conditions also include: the disguised node analyzes network connection requests in real time through machine learning algorithms, identifies access requests that are significantly different from normal user behavior patterns, and triggers the activation of the disguised node when it detects that the characteristics of the access request match the preset abnormal behavior pattern; the disguised node sets multi-stage interactive trigger conditions to confuse attackers by simulating the multi-step interaction process of real services. When the attacker attempts to perform a multi-step attack operation, the disguised node sets specific trigger conditions in each step.

[0070] Furthermore, by deploying a masquerade node in a virtual network environment, all network connection requests flowing to the masquerade node are captured, and the flow table matching function of the software-defined network controller is used to filter and record all external requests that attempt to establish a connection with the masquerade node. The collected data packets are parsed, the source IP address, destination port number, and communication protocol type information are extracted, and network attack behaviors are identified.

[0071] S3: Obtain the attack behavior of disguised nodes and identify abnormal network behavior through deep learning technology;

[0072] Furthermore, the neural network recognition model of deep learning technology is used to identify abnormal network behavior. The neural network recognition model includes an input layer, a hidden layer, and an output layer. The hidden layer uses LSTM units to capture long-term dependencies in time series data. The neural network recognition model is trained using the network attack behavior training set. The training loss function Where N represents the number of network attack behaviors, y i represents the i-th network attack behavior, represents the i-th network attack prediction behavior, W is the i-th network attack behavior representation model weight, and γ is the regularization parameter; the neural network recognition model is used to identify abnormal behaviors from network data in a virtualized isolated network environment.

[0073] S4: Extract network abnormal behavior features and identify potential threats through deep learning technology;

[0074] Furthermore, the feature extraction of network abnormal behavior is performed through principal component analysis technology, which performs dimensionality reduction processing on the high-dimensional data features of abnormal behavior features; the feature extraction of abnormal behavior is performed by calculating the covariance matrix of abnormal behavior features. where x i represents the i-th abnormal behavior feature data, u represents the mean of the abnormal behavior feature data, N t Represents the total number of abnormal behaviors. By solving the abnormal behavior eigenvalue λ and the corresponding eigenvector V of the covariance matrix, the eigenvectors corresponding to the first k abnormal behavior eigenvalues ​​are selected to form the transformation matrix V k , use the transformation matrix to project the abnormal behavior feature value into the new k-dimensional space, the formula is: X′=XV k , where X represents the abnormal behavior eigenvalue matrix, and X′ represents the abnormal behavior eigenvalue matrix after dimensionality reduction.

[0075] S5: Automatically trigger the defense mechanism, start the honeynet, and isolate abnormal behaviors and potential threats;

[0076] Furthermore, after extracting the network abnormal behavior features, a deep neural network threat model is constructed through deep learning technology. i As input, a nonlinear transformation is performed through a multilayer perceptron, and the formula is: (l+1) =σ(W (l) z (l) +b (l) ), where z (l) is the abnormal behavior feature vector of the lth layer, W (l) is the weight matrix, b (l) is the bias vector, σ is the ReLU activation function, and the threat probability is output through the softmax layer. The output layer calculates the threat probability p=softmax(z (L) ), where L is the isolated network environment, and the potential threat of the isolated network environment is obtained through the threat probability p.

[0077] Furthermore, the defense mechanism is automatically triggered after detecting the attack behavior of the disguised node, and the software-defined network controller immediately triggers the defense response according to the preset security policy; the response mechanism includes but is not limited to instantly updating the flow table rules, redirecting network requests from known threat sources to the honeynet environment, blocking related IP addresses or ports, and preventing malicious network requests from continuing to spread; the software-defined network controller can dynamically adjust the network topology, isolate the affected virtual network parts, and prevent the threat from spreading to the entire network system.

[0078] Furthermore, the honeynet builds one or more virtual environments under the command of the software-defined network controller to attract, detect and analyze potential attack behaviors. When abnormal network activities are detected in the virtual environment built by the honeynet, the software-defined network controller automatically redirects the suspicious behavior to the honeynet environment. The honeynet deploys virtual nodes and services that simulate the real system to make attackers mistakenly believe that they have found the real target and conduct internal operations and activities. The honeynet monitors the attacker's operations, collects detailed attack techniques and tool information, and uses the attack techniques and tool information to optimize the defense mechanism and generate security policies.

[0079] S6: trace the attack path and locate the source;

[0080] Furthermore, the attack path is traced by collecting and integrating attack-related information from honeynets, camouflage nodes, and network logs, constructing a timeline of attack events, and analyzing the attacker's behavior patterns to identify key nodes in the attack path. The timeline formula for attack events is: C p (p) = α × t(p) + β × n(p), where p represents the attack path, t(p) represents the average access time of all nodes on the path, n(p) represents the number of nodes on the path, α is the weight coefficient of the average access time of the preset nodes, β is the weight coefficient of the number of preset path nodes, C p (p) is the attack path cost;

[0081] Furthermore, the source location calculates the risk score of each potential source node by combining the attack path cost with the node risk assessment model. The formula is R s (s) = γ × C p (p)(s→q)+δ×v(s), where s is the potential attack source node, q is the attacked target node, v(s) is the security assessment value of the source node, γ is the attack weight parameter, and δ is the security assessment value weight parameter. The attack initiation point is determined by comparing the risk scores of different potential source nodes.

[0082] This embodiment achieves flexible management and efficient use of network resources by constructing a virtualized isolated network environment, while improving network security. It uses intelligent dynamic camouflage nodes to simulate real service ports and protocols to confuse attackers and then capture attack information. It uses deep learning technology to identify network abnormal behaviors and potential threats, improves detection accuracy and efficiency, automatically triggers defense mechanisms, isolates abnormal behaviors and potential threats, and further analyzes attackers' behavior patterns through honeynet technology, thereby achieving accurate abnormal network detection behavior and active network security defense behavior.

[0083] Example 2

[0084] This embodiment is based on Embodiment 1 and describes in detail the optimization technology of deep learning technology to identify abnormal network behavior and potential threats;

[0085] By obtaining the attack behavior of disguised nodes, deep learning technology is used to identify abnormal network behavior;

[0086] Furthermore, the neural network recognition model includes an input layer, a hidden layer, and an output layer. The hidden layer uses LSTM units to capture the long-term dependencies in time series data. The neural network recognition model is trained using the network attack behavior training set. The training loss function is Where N represents the number of network attack behaviors, yi represents the i-th network attack behavior, represents the i-th network attack prediction behavior, W is the i-th network attack behavior representation model weight, and γ is the regularization parameter; the neural network recognition model is used to identify abnormal behaviors from network data in a virtualized isolated network environment;

[0087] Furthermore, the attention mechanism is used in the hidden layer to dynamically identify abnormal behaviors, and the hidden state h of abnormal behaviors is generated using the hidden layer. t , use the fully connected layer to calculate the feature E of each time step in the time series data T , E T =W a ·h t +b, where W a The time step weight matrix, b is the time step bias term, normalized by the softmax function, and the feature E T Normalized to the abnormal behavior attention weight θ t , using the abnormal behavior attention weight θ t For each time step, the hidden state h t Perform weighted summation to generate weighted hidden state h * , the formula is: Where L T is the length of the time series data; the weighted hidden state h *Input to the output layer to dynamically identify abnormal behaviors;

[0088] Furthermore, the network abnormal behavior features are extracted. The features of network abnormal behavior are extracted through principal component analysis technology. The principal component analysis technology reduces the dimensionality of the high-dimensional data features of the abnormal behavior features. The features of abnormal behavior are extracted by calculating the covariance matrix of the abnormal behavior features. where x i represents the i-th abnormal behavior feature data, u represents the mean of the abnormal behavior feature data, N t Represents the total number of abnormal behaviors. By solving the abnormal behavior eigenvalue λ and the corresponding eigenvector V of the covariance matrix, the eigenvectors corresponding to the first k abnormal behavior eigenvalues ​​are selected to form the transformation matrix V k , use the transformation matrix to project the abnormal behavior feature value into the new k-dimensional space, the formula is: X′=XV k , where X represents the abnormal behavior eigenvalue matrix, and X′ represents the abnormal behavior eigenvalue matrix after dimensionality reduction;

[0089] Furthermore, deep learning technology is used to identify potential threats. After extracting the network abnormal behavior features, a deep neural network threat model is constructed through deep learning technology. The extracted abnormal behavior feature value x i As input, a nonlinear transformation is performed through a multilayer perceptron, and the formula is: (l+1) =σ(W (l) z (l) +b (l) ), where z (l) is the abnormal behavior feature vector of the lth layer, W (l) is the weight matrix, b (l) is the bias vector, σ is the ReLU activation function, and the threat probability is output through the softmax layer. The output layer calculates the threat probability p=softmax(z (L) ), where L is the isolated network environment, and the potential threat of the isolated network environment is obtained through the threat probability p.

[0090] The optimized technical solution of this embodiment can significantly improve the accuracy and efficiency of extracting features of network abnormal behavior. It builds a neural network recognition model through deep learning technology to identify network abnormal behavior, and uses the attention mechanism to perform dynamic detection methods to detect unknown threats, thereby achieving higher detection accuracy and real-time performance to effectively identify abnormal behavior and improve the ability to detect unknown threats.

[0091] Example 3

[0092] This embodiment describes in detail a network security active defense system for detecting abnormal network behavior, such as Figure 4As shown, the network security active defense system includes a network construction module, a deployment module, an identification module, a honeynet, an isolation module and a tracing module;

[0093] The network construction module builds a virtualized isolated network environment through software-defined network technology, deploys multiple virtual networks in the virtualized isolated network environment, and each virtual network consists of a group of logically isolated virtual switches and virtual routers;

[0094] The deployment module deploys multiple camouflage nodes in a virtual network environment using virtualization technology, dynamically adjusting the status, service type, and response mode to confuse attackers;

[0095] The recognition module obtains the attack behavior of disguised nodes and uses three-dimensional deep learning technology to identify abnormal network behavior and potential threats;

[0096] The honeynet redirects abnormal behaviors and potential threats to the honeynet environment through a software-defined network controller, and uses virtual nodes and services deployed inside the honeynet to simulate real systems, monitor attackers' operations, and collect detailed information on attack methods and tools;

[0097] The isolation module blocks IP addresses or ports for abnormal behaviors and potential threats, preventing malicious network requests from spreading further. It dynamically adjusts the network topology through the software-defined network controller and isolates the affected virtual network parts.

[0098] The tracing module constructs a timeline of attack events, uses path cost calculation to identify attack paths, and combines node risk assessment models to locate the source of attacks.

[0099] This embodiment can achieve all-round protection of the network environment through the collaborative work of the above modules, from building a highly isolated virtual network environment, to dynamically deploying camouflage nodes to attract attackers, to using deep learning technology to intelligently identify threats, and finally collecting attack information through honeynets, instant response by isolation modules, and precise positioning of attack sources by tracing modules, forming a complete protection system. This system can not only effectively resist known threats, but also quickly adapt to new attack methods, providing users with a safe and reliable network environment.

[0100] Example 4

[0101] This embodiment describes the honeynet in detail. Figure 5 As shown, the honeynet is one or more virtual environments constructed under the command of the software-defined network controller to attract, detect and analyze potential attack behaviors;

[0102] When abnormal network activity is detected in the virtual environment built by the honeynet, the software-defined network controller automatically redirects suspicious behavior to the honeynet environment. The honeynet deploys virtual nodes and services that simulate the real system to make attackers mistakenly believe that they have found the real target and conduct internal operations and activities. The honeynet monitors the attacker's operations, collects detailed information on attack techniques and tools, and uses the attack techniques and tool information to optimize the defense mechanism and generate security policies.

[0103] The present invention constructs a multi-level honeynet structure, including a low-interaction honeynet and a high-interaction honeynet; the low-interaction honeynet attracts preliminary attack attempts through simple service simulation, while the high-interaction honeynet provides a more complex virtual environment, simulating real systems and services, so that attackers believe that they have found their real targets; the multi-level honeynet structure design not only increases the attractiveness of the honeynet, but also prolongs the attacker's stay time in the honeynet and collects more attack behaviors.

[0104] Honeynet also uses dynamic camouflage technology to adjust its behavior in real time according to the attacker's attack mode. It dynamically changes the open ports, modifies the system version information, and simulates specific network vulnerabilities through the virtual nodes in the virtual environment built by the honeynet. The dynamic adjustment increases the confusion of the honeynet, making it difficult for attackers to distinguish between the honeynet and the real system, thereby improving the effectiveness of the honeynet.

[0105] Low-interaction honeynets attract initial attack attempts through simple service simulations. The number of simple services that low-interaction honeynets can provide is S, and the attractiveness coefficient of each service to attackers is A. g , where g = 1, 2, ..., S, the number of services displayed by the low-interaction honeynet is N, then the total attractiveness of the low-interaction honeynet to attackers is L d It can be expressed as: Low-interaction honeynets attract attackers by providing a certain number of simple services. The attractiveness coefficient of each service determines how attractive the service is to attackers, and the total attractiveness of a low-interaction honeynet is the sum of the attractiveness of all displayed services.

[0106] High-interaction honeynets simulate real systems and services by providing a more complex virtual environment, making attackers believe that they have found their real target. The number of real system types that can be simulated by high-interaction honeynets is T, and the complexity coefficient of the system is C. j , where j = 1, 2, ..., T, the number of systems displayed by the high-interaction honeynet is M, and the deception coefficient of the high-interaction honeynet is D. Then the degree of deception of the high-interaction honeynet to the attacker is H j It can be expressed as: High-interaction honeynets confuse attackers by providing a certain number of complex virtual systems. The complexity coefficient of each system determines the degree of confusion of the system to the attacker. The confusion coefficient D takes into account the application of the honeynet in dynamic camouflage technology, that is, the ability of the honeynet to adjust its behavior in real time according to the attacker's attack mode.

[0107] The honeynet also uses an automated response mechanism to detect specific attack behaviors and automatically trigger defense measures. By isolating infected virtual nodes and blocking malicious IP addresses, it uses an integrated intelligent data analysis platform to conduct in-depth analysis of the collected attack data, identify the next related attack pattern and threat trend, and generate more effective security strategies, thereby comprehensively improving the system's active defense capabilities.

[0108] This embodiment describes in detail that the optimized honeynet significantly improves the attractiveness and confusion to attack behaviors through multi-level design and dynamic camouflage technology, prolongs the attacker's stay time in the honeynet, and is equipped with an automated response mechanism and an intelligent data analysis platform, which can quickly trigger defense measures and deeply analyze attack data to generate more effective security strategies, thereby greatly enhancing the system's active defense capabilities.

[0109] The above are only preferred embodiments of the present invention, which do not limit the scope of protection of the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any changes, modifications, replacements, integrations and parameter changes to these embodiments within the spirit and principles of the present invention through conventional substitutions or without departing from the principles and spirit of the present invention fall within the scope of protection of the present invention.

Claims

1. A network security active defense method for detecting abnormal network behavior, characterized in that: include: S1: Build a virtualized isolated network environment through software-defined network technology; S2: Deploy intelligent dynamic camouflage nodes in a virtualized isolation environment; S3: Obtain the attack behavior of disguised nodes and identify abnormal network behavior through deep learning technology; S4: Extract network abnormal behavior features and identify potential threats through deep learning technology; S5: Automatically trigger the defense mechanism, start the honeynet, and isolate abnormal behaviors and potential threats; S6: Trace the attack path and locate the source.

2. The method for active network security defense for detecting abnormal network behavior according to claim 1, characterized in that: In S1, a virtualized isolated network environment is constructed by using software defined network technology, specifically including: S1.1: Use software-defined network controllers to manage network resources, communicate with switches in the network through the OpenFlow protocol, and separate the data plane from the control plane; S1.2: Deploy multiple virtual networks in the software-defined network architecture, each of which consists of a set of logically isolated virtual switches and virtual routers; S1.3: Use the software-defined network controller to send flow table rules to each virtual switch to guide the forwarding of data packets and build multiple independent virtual network environments on the physical network; S1.4: Create virtual machines as nodes in the network. Each node runs a specific service or application and is connected to the corresponding virtual network through a virtual switch. S1.5: Dynamically adjust the topology and resource allocation of the virtual network through network configuration algorithms to ensure efficient and secure network services when the network load changes.

3. A network security active defense method for detecting abnormal network behavior according to claims 1 and 2, characterized in that: In S2, an intelligent dynamic camouflage node is deployed in a virtualized isolation environment, specifically including: The software-defined network controller uses virtualization technology to deploy multiple camouflage nodes in each virtual network environment; the camouflage nodes simulate real service ports and protocols, and confuse attackers by dynamically adjusting the status, service type and response mode of the camouflage nodes; the camouflage nodes set specific trigger conditions, and when an access request that meets the preset mode is detected, the camouflage nodes are automatically activated to guide potential attackers into the preset trap area to collect attack information; The method captures all network connection requests flowing to the camouflage node by deploying a camouflage node in a virtual network environment, uses the flow table matching function of the software-defined network controller to filter and record all external requests that attempt to establish a connection with the camouflage node, parses the collected data packets, extracts the source IP address, destination port number, and communication protocol type information, and identifies network attack behaviors.

4. The method for active network security defense for detecting abnormal network behavior according to claim 3 is characterized in that: The network attack behavior of the disguised node is identified in S3, and a neural network recognition model is constructed through deep learning technology. The neural network recognition model includes an input layer, a hidden layer and an output layer. The hidden layer uses LSTM units to capture the long-term dependencies in the time series data. The neural network recognition model is trained using the network attack behavior training set. The loss function of the training Where N represents the number of network attack behaviors, y i represents the i-th network attack behavior, represents the i-th network attack prediction behavior, W is the i-th network attack behavior representation model weight, and γ is the regularization parameter; the neural network recognition model is used to identify abnormal behaviors from network data in a virtualized isolated network environment.

5. A network security active defense method for detecting abnormal network behavior according to claim 1 or 4, characterized in that: The feature extraction of network abnormal behavior in S4 is performed by principal component analysis technology, and the principal component analysis technology performs dimensionality reduction processing on the high-dimensional data features of abnormal behavior features; the feature extraction of abnormal behavior is performed by calculating the covariance matrix of abnormal behavior features. where x i represents the i-th abnormal behavior feature data, u represents the mean of the abnormal behavior feature data, N t Represents the total number of abnormal behaviors. By solving the abnormal behavior eigenvalue λ and the corresponding eigenvector V of the covariance matrix, the eigenvectors corresponding to the first k abnormal behavior eigenvalues ​​are selected to form the transformation matrix V k , use the transformation matrix to project the abnormal behavior feature value into the new k-dimensional space, the formula is: X′=XV k , where X represents the abnormal behavior eigenvalue matrix, and X′ represents the abnormal behavior eigenvalue matrix after dimensionality reduction.

6. A network security active defense method for detecting abnormal network behavior according to claim 5, characterized in that: After extracting the network abnormal behavior features, a deep neural network threat model is constructed through deep learning technology, and the extracted abnormal behavior feature value x i As input, a nonlinear transformation is performed through a multi-layer perceptron, and the formula is: (l+1) =σ(W (l) z (l) +b (l) ), where z (l) is the abnormal behavior feature vector of the lth layer, W (l) is the weight matrix, b (l) is the bias vector, σ is the ReLU activation function, and the threat probability is output through the softmax layer. The output layer calculates the threat probability p=softmax(z (L) ), where L is the isolated network environment, and the potential threat of the isolated network environment is obtained through the threat probability p.

7. A network security active defense method for detecting abnormal network behavior according to claim 1 or 6, characterized in that: The defense mechanism is automatically triggered after detecting the attack behavior of the disguised node, and the software-defined network controller immediately triggers a defense response according to the preset security policy; the response mechanism includes but is not limited to instantly updating the flow table rules, redirecting network requests from known threat sources to the honeynet environment, blocking related IP addresses or ports, and preventing malicious network requests from continuing to spread; the software-defined network controller can dynamically adjust the network topology, isolate the affected virtual network parts, and prevent the threat from spreading to the entire network system.

8. The method for active network security defense for detecting abnormal network behavior according to claim 1, characterized in that: The honeynet is a multi-level honeynet structure constructed by a software-defined network controller, and multiple virtual environments are constructed through the multi-level honeynet structure to attract, detect and analyze potential attack behaviors; when abnormal network activities are detected in the virtual environment constructed by the multi-level honeynet structure, the software-defined network controller automatically redirects the suspicious behavior to the multi-level honeynet structure environment; the multi-level honeynet structure internally deploys virtual nodes and services that simulate real systems, and makes attackers mistakenly believe that they have found the real target and perform internal operations and activities. The multi-level honeynet structure monitors the attacker's operations, collects detailed attack techniques and tool information, and uses the attack techniques and tool information to optimize the defense mechanism and generate security policies.

9. The method for active network security defense for detecting abnormal network behavior according to claim 1, characterized in that: The attack path tracing method collects and integrates attack related information in honeynet, camouflage nodes and network logs to construct a timeline of attack events, analyzes the attacker's behavior pattern to identify key nodes of the attack path. The timeline formula of the attack event is: p (p) = α × t(p) + β × n(p), where p represents the attack path, t(p) represents the average access time of all nodes on the path, n(p) represents the number of nodes on the path, α is the weight coefficient of the average access time of the preset nodes, β is the weight coefficient of the number of preset path nodes, C p (p) is the attack path cost; The source location calculates the risk score of each potential source node by combining the attack path cost with the node risk assessment model. The formula is R s (s) = γ × C p (p)(s→q)+δ×v(s), where s is the potential attack source node, q is the attacked target node, v(s) is the security assessment value of the source node, γ is the attack weight parameter, and δ is the security assessment value weight parameter. The attack initiation point is determined by comparing the risk scores of different potential source nodes.

10. A network security active defense system for detecting abnormal network behavior, characterized in that: The network security active defense system includes network construction module, deployment module, identification module, honeynet, isolation module and tracing module; The network construction module constructs a virtualized isolated network environment through software-defined network technology, deploys multiple virtual networks in the virtualized isolated network environment, and each virtual network consists of a group of virtual switches and virtual routers that are logically isolated from each other; The deployment module deploys multiple camouflage nodes in a virtual network environment using virtualization technology, and dynamically adjusts the status, service type and response mode to confuse attackers; The identification module obtains the attack behavior of the disguised node and uses the three-dimensional deep learning technology to identify abnormal network behavior and potential threats; The honeynet redirects abnormal behaviors and potential threats to the honeynet environment through a software-defined network controller, uses virtual nodes and services deployed inside the honeynet to simulate real systems, monitors attackers' operations, and collects detailed information on attack techniques and tools; The isolation module blocks IP addresses or ports for abnormal behaviors and potential threats, prevents malicious network behaviors from spreading further, dynamically adjusts network topology through software-defined network controllers, and isolates affected virtual network parts; The tracing module constructs a timeline of attack events, uses path cost calculation to identify attack paths, and locates the source of attacks in combination with a node risk assessment model.

Images