Network intrusion detection method and system and electronic equipment

Abstract

The invention provides a network intrusion detection method and system and electronic equipment, and relates to the field of network security processing, and the method comprises the steps: firstly obtaining traffic data containing network protocol data, and then determining access data corresponding to the traffic data; then determining semantic data corresponding to the access data by utilizing attribute parameters corresponding to the network protocol data; then determining a conversion strategy of the semantic data based on position information and access time contained in the semantic data, and determining a semantic vector corresponding to the semantic data by using the conversion strategy; and finally, obtaining a classifier corresponding to the semantic vector, calculating an intrusion risk value corresponding to the semantic vector by using the classifier, and determining an intrusion detection result corresponding to the traffic data by using the intrusion risk value. According to the method, sufficient semantic analysis can be carried out on the IPv6 flow data, and the network intrusion behavior can be accurately detected through the generated semantic vector, so that the problem of high omission ratio when intrusion detection is carried out on the IPv6 flow data is relieved.

Description

Technical Field

[0001] The present invention relates to the field of network security processing, and in particular to a network intrusion detection method, system and electronic equipment. Background Art

[0002] Network security issues have become an important consideration in the current network ecology. With the widespread application of the IPv6 protocol, related network security issues have become increasingly complex. IPv6 has significant advantages over IPv4 in terms of address space and network efficiency, but it also brings new security challenges. The address space of IPv6 is extremely large, so that almost every device can have a globally unique IP address. This solves the problem of IPv4 address exhaustion while also making devices more vulnerable to attack targets. Compared to IPv4 address sharing (such as through NAT), which limits the number of devices directly exposed to the public network, IPv6's address allocation mechanism allows devices to communicate directly with external networks. This improves network efficiency while also allowing attackers to launch attacks by directly accessing the network.

[0003] Traditional IP and port-based filtering strategies face greater challenges in IPv6. The extended addresses and diverse traffic patterns of IPv6 make traditional protection measures less effective. Even the IPsec encryption and authentication mechanisms provided by the IPv6 protocol itself have not been widely adopted. Many network application devices do not force the use of these security features, resulting in a portion of traffic still being transmitted in plain text, exposed to attackers.

[0004] It can be seen that the existing technology still has the problems of high missed detection rate and poor detection effect in the process of intrusion detection on IPv6 traffic data. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a network intrusion detection method, system and electronic device, which can perform sufficient semantic analysis on the traffic data corresponding to IPv6, and can accurately detect network intrusion behavior through the generated semantic vectors, thereby alleviating the problem of high missed detection rate when performing intrusion detection on IPv6 traffic data.

[0006] In a first aspect, an embodiment of the present invention provides a network intrusion detection method, the method comprising: Acquire flow data including network protocol data, and determine access data corresponding to the flow data based on the network protocol data; Determine semantic data corresponding to access data by using attribute parameters corresponding to network protocol data; Determine a conversion strategy for the semantic data based on location information and access time contained in the semantic data, and determine a semantic vector corresponding to the semantic data using the conversion strategy; A classifier corresponding to the semantic vector is obtained, an intrusion risk value corresponding to the semantic vector is calculated using the classifier, and an intrusion detection result corresponding to the traffic data is determined using the intrusion risk value.

[0007] Optionally, obtaining flow data including network protocol data, and determining access data corresponding to the flow data based on the network protocol data, includes: Obtaining traffic data and determining network protocol data corresponding to the traffic data; Determine the IP address data, access source data, access behavior data and access time data contained in the traffic data according to the attribute parameters of the network protocol data; Based on the IP address data, the access source data, access behavior data and access time data are used to determine the access data corresponding to the traffic data.

[0008] Optionally, using attribute parameters corresponding to the network protocol data to determine semantic data corresponding to the access data, includes: Obtain IP address data, access source data, access behavior data and access time data corresponding to network protocol data according to attribute parameters; Using preset separators, the character strings corresponding to the access time data, IP address data, access source data and access behavior data are connected in sequence to generate semantic data corresponding to the access data.

[0009] Optionally, determining a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and determining a semantic vector corresponding to the semantic data using the conversion strategy includes: Based on the IP address data, obtain the corresponding access source data, access behavior data and access time data in the semantic data under the same IP address; Determine location information in the semantic data using the access source data and the access behavior data; determine a first conversion strategy corresponding to the access behavior data based on the location information, and determine a second conversion strategy corresponding to the access source data based on the location information; Determine the access time in the semantic data using the access time data, and determine a third conversion strategy corresponding to the access time data based on the access time; After format conversion is performed on the semantic data according to the first conversion strategy, the second conversion strategy, and the third conversion strategy, a semantic vector corresponding to the semantic data is obtained.

[0010] Optionally, determining a first conversion strategy corresponding to the access behavior data based on the location information includes: Obtain access behavior data corresponding to the IP address data in the location information; Determine resource acquisition behavior data included in the access behavior data, and determine a first access value corresponding to the resource acquisition behavior data; Determine the instruction control behavior data included in the access behavior data, and determine a second access value corresponding to the resource acquisition behavior data; Determine the byte stream data interaction behavior data included in the access behavior data, and determine a third access value corresponding to the resource acquisition behavior data; Determine the polling event behavior data included in the access behavior data, and determine a fourth access value corresponding to the resource acquisition behavior data; Determine the interruption event behavior data included in the access behavior data, and determine a fifth access value corresponding to the resource acquisition behavior data; A first conversion strategy corresponding to the access behavior data is determined based on the first access value, the second access value, the third access value, the fourth access value, and the fifth access value.

[0011] Optionally, determining a second conversion strategy corresponding to the access source data based on the location information includes: Obtain access source data corresponding to the IP address data in the location information; Determine the location data contained in the access source data, and determine the location code corresponding to the location data; A second conversion strategy corresponding to the access source data is determined based on the location data and the location code.

[0012] Optionally, determining a third conversion strategy corresponding to the access time data based on the access time includes: Get the access time data corresponding to the IP address data in the access time; Determine a reference time corresponding to the access time data, and obtain the time interval between the data access moment in the access time data and the reference time; A third conversion strategy corresponding to the access time data is determined based on the time interval.

[0013] Optionally, obtaining a classifier corresponding to the semantic vector, using the classifier to calculate an intrusion risk value corresponding to the semantic vector, and using the intrusion risk value to determine an intrusion detection result corresponding to the traffic data, includes: Determine a first vector and a second vector corresponding to the semantic vector based on a numerical relationship between the time interval and a preset time threshold; Obtain a classifier corresponding to the first vector and the second vector, and use the classifier to calculate an intrusion risk probability distribution result corresponding to the semantic vector; The intrusion risk value is determined according to the intrusion risk probability distribution result, and the intrusion detection result corresponding to the traffic data is determined using the intrusion risk value.

[0014] In a second aspect, the present invention provides a network intrusion detection system, the system comprising: An access data determination module, used to obtain flow data including network protocol data, and determine access data corresponding to the flow data based on the network protocol data; A semantic data determination module, used to determine semantic data corresponding to access data using attribute parameters corresponding to network protocol data; A semantic vector determination module, used to determine a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and to determine a semantic vector corresponding to the semantic data using the conversion strategy; The intrusion detection calculation module is used to obtain the classifier corresponding to the semantic vector, use the classifier to calculate the intrusion risk value corresponding to the semantic vector, and use the intrusion risk value to determine the intrusion detection result corresponding to the traffic data.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the steps of the network intrusion detection method provided in the first aspect.

[0016] In a fourth aspect, an embodiment of the present invention further provides a storage medium storing computer executable instructions. When the computer executable instructions are called and executed by a processor, the computer executable instructions prompt the processor to implement the steps of the network intrusion detection method provided in the first aspect.

[0017] A network intrusion detection method, system and electronic device provided by the embodiment of the present invention, in the process of intrusion detection on IPv6 traffic data, firstly obtains traffic data containing network protocol data, and determines access data corresponding to the traffic data based on the network protocol data; then determines semantic data corresponding to the access data using attribute parameters corresponding to the network protocol data; then determines a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and determines a semantic vector corresponding to the semantic data using the conversion strategy; finally obtains a classifier corresponding to the semantic vector, calculates an intrusion risk value corresponding to the semantic vector using the classifier, and determines an intrusion detection result corresponding to the traffic data using the intrusion risk value. The method can perform a full semantic analysis on the traffic data corresponding to IPv6, and can accurately detect network intrusion behaviors through the generated semantic vectors, thereby alleviating the problem of a high missed detection rate when performing intrusion detection on IPv6 traffic data.

[0018] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0019] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flowchart of a network intrusion detection method provided by an embodiment of the present invention; Figure 2 A flowchart of step S101 in a network intrusion detection method provided by an embodiment of the present invention; Figure 3 A flowchart of step S102 in a network intrusion detection method provided by an embodiment of the present invention; Figure 4 A flowchart of step S103 in a network intrusion detection method provided by an embodiment of the present invention; Figure 5 A flow chart of determining a first conversion strategy corresponding to access behavior data based on location information in a network intrusion detection method provided by an embodiment of the present invention; Figure 6 A flow chart of determining a second conversion strategy corresponding to access source data based on location information in a network intrusion detection method provided by an embodiment of the present invention; Figure 7 A flowchart of determining a third conversion strategy corresponding to access time data based on access time in a network intrusion detection method provided by an embodiment of the present invention; Figure 8 A flowchart of step S104 in a network intrusion detection method provided by an embodiment of the present invention; Fig. 9 A schematic diagram of a network intrusion detection system provided by an embodiment of the present invention; Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0022] icon: 910 - access data determination module; 920 - semantic data determination module; 930 - semantic vector determination module; 940 - intrusion detection calculation module; 101 - processor; 102 - memory; 103 - bus; 104 - communication interface. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described in combination with the embodiments below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Network security issues have become an important consideration in the current network ecology. With the widespread application of the IPv6 protocol, related network security issues have become increasingly complex. IPv6 has significant advantages over IPv4 in terms of address space and network efficiency, but it also brings new security challenges. The address space of IPv6 is extremely large, so that almost every device can have a globally unique IP address. This solves the problem of IPv4 address exhaustion while also making devices more vulnerable to attack targets. Compared to IPv4 address sharing (such as through NAT), which limits the number of devices directly exposed to the public network, IPv6's address allocation mechanism allows devices to communicate directly with external networks. This improves network efficiency while also allowing attackers to launch attacks by directly accessing the network.

[0025] In addition to the expansion of address space, IPv6 introduces a number of new features, the most prominent of which are the Neighbor Discovery Protocol (NDP) and Stateless Address Autoconfiguration (SLAAC). These new features provide the convenience of automated configuration for the network, but also provide potential attack paths for attackers. NDP is responsible for IPv6 address resolution and route discovery, but due to its lack of an authentication mechanism, attackers can launch man-in-the-middle attacks, address spoofing, or sniffing network traffic by forging NDP messages, thereby breaking through network security defenses. In addition, the traffic structure of IPv6 is more complex than that of IPv4, the packet header is longer, and the processing overhead during its routing process is greater. Traditional IPv4-based firewalls and intrusion detection systems (IDS) often cannot effectively deal with IPv6 traffic, especially in the case of encrypted communications. Traditional IDS cannot decrypt and analyze these traffic, resulting in malicious behavior that may be missed.

[0026] With the popularization of IPv6, many IPv4-based attack methods have also been extended to IPv6 networks. DDoS attacks, IP spoofing, address scanning and other attacks also exist in IPv6 environments. Due to the huge IPv6 address space, attackers can easily conduct large-scale IP scans to find potential targets for attack. Traditional IP and port-based filtering strategies face greater challenges in IPv6. The extended addresses and diverse traffic patterns of IPv6 greatly reduce the effectiveness of traditional protection measures. Even the IPsec encryption and authentication mechanisms provided by the IPv6 protocol itself have not been widely adopted. Many network application devices do not force the use of these security features, resulting in a portion of traffic still being transmitted in plain text, exposed to attackers.

[0027] It can be seen that the prior art still has the problems of high missed detection rate and poor detection effect in the process of intrusion detection on IPv6 traffic data. Based on this, the present invention implements a network intrusion detection method, system and electronic device, which can perform sufficient semantic analysis on the traffic data corresponding to IPv6, and can accurately detect network intrusion behavior through the generated semantic vector, thereby alleviating the problem of high missed detection rate when performing intrusion detection on IPv6 traffic data.

[0028] To facilitate understanding of this embodiment, a network intrusion detection method disclosed in an embodiment of the present invention is first described in detail. Figure 1 As shown, including: Step S101, acquiring flow data including network protocol data, and determining access data corresponding to the flow data based on the network protocol data; Step S102, using the attribute parameters corresponding to the network protocol data, determining the semantic data corresponding to the access data; Step S103, determining a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and determining a semantic vector corresponding to the semantic data using the conversion strategy; Step S104, obtaining a classifier corresponding to the semantic vector, using the classifier to calculate an intrusion risk value corresponding to the semantic vector, and using the intrusion risk value to determine an intrusion detection result corresponding to the traffic data.

[0029] The method first obtains the flow data containing IPv6 network protocol data, and extracts and parses it according to the IPv6 format to obtain the access data. Then, the access data corresponding to the flow data is vectorized and constructed, and the access data is semantically analyzed using the attribute parameters corresponding to IPv6 to obtain the semantic data corresponding to the access data.

[0030] Then, the location information and access time in the semantic data are obtained, and the corresponding conversion strategy is obtained based on the location information and access time. The conversion strategy is used to transform the semantic data from the perspective of location information and access time to obtain a semantic vector, thereby completing the vectorization processing of the access data.

[0031] After the semantic vector is obtained, it is input into the corresponding classifier to identify the intrusion behavior. Specifically, the intrusion risk value corresponding to the semantic vector is calculated by the classifier, and the intrusion detection result corresponding to the traffic data is obtained by using the relationship between the intrusion risk value and the preset threshold.

[0032] Optionally, the step S101 of acquiring flow data including network protocol data and determining access data corresponding to the flow data based on the network protocol data is as follows: Figure 2 As shown, including: Step S201, acquiring flow data and determining network protocol data corresponding to the flow data; Step S202, determining IP address data, access source data, access behavior data and access time data contained in the traffic data according to the attribute parameters of the network protocol data; Step S203, based on the IP address data, the access source data, the access behavior data and the access time data are used to determine the access data corresponding to the traffic data.

[0033] Specifically, in the process of obtaining access data, it is necessary to first determine the network protocol of the traffic data. For example, for IPv6 traffic data, first determine whether the traffic data is IPv6, and then obtain the IP address data, access source data, access behavior data and access time data corresponding to the traffic data based on the attribute parameters of the IPv6 protocol.

[0034] Specifically, the IP address data can represent the IP address of the traffic data; the access source data can represent the specific source location of the traffic data; the access behavior data can represent the specific access behavior of the traffic data; and the access time data can represent the specific access time of the traffic data.

[0035] Then, based on the IP address data and using the access source data, access behavior data and access time data, the data is aggregated to obtain the access data corresponding to the traffic data for subsequent semantic processing. Optionally, the step S102 of determining the semantic data corresponding to the access data using the attribute parameters corresponding to the network protocol data is as follows: Figure 3 As shown, including: Step S301, obtaining IP address data, access source data, access behavior data and access time data corresponding to the network protocol data according to the attribute parameters; Step S302, using a preset separator, sequentially connect the character strings corresponding to the access time data, the IP address data, the access source data and the access behavior data to generate semantic data corresponding to the access data.

[0036] After obtaining the IP address data, access source data, access behavior data and access time data, the access time data, IP address data, access source data and access behavior data are connected in the order of time-IP-location-behavior, which can be realized by using a preset separator. Specifically, the separator can be set to a comma, and the obtained semantic data is as follows: "On January 1st, 10:00, the IP is AAA, from a certain place, and a resource acquisition was performed", "On January 1st, 10:30, the IP is AAA, from a certain place, and a resource acquisition was performed", "On January 1st, 12:00, the IP is AAA, from a certain place, and a command control was performed".

[0037] Optionally, a conversion strategy for the semantic data is determined based on the location information and access time contained in the semantic data, and a step S103 of determining a semantic vector corresponding to the semantic data using the conversion strategy is performed, such as Figure 4 As shown, including: Step S401, based on the IP address data, obtaining the corresponding access source data, access behavior data and access time data in the semantic data under the same IP address; Step S402, using the access source data and the access behavior data to determine the location information in the semantic data; determining a first conversion strategy corresponding to the access behavior data based on the location information, and determining a second conversion strategy corresponding to the access source data based on the location information; Step S403, using the access time data to determine the access time in the semantic data, and determining a third conversion strategy corresponding to the access time data based on the access time; Step S404 , after format conversion is performed on the semantic data according to the first conversion strategy, the second conversion strategy and the third conversion strategy, a semantic vector corresponding to the semantic data is obtained.

[0038] Specifically, the semantic vector generation process needs to use the semantic data under the same IP address for unified processing. First, based on the IP address data, the corresponding access source data, access behavior data and access time data in the semantic data under the same IP address are obtained, and then the location information is used to determine the location conversion strategy corresponding to the access behavior data and access source data; then the access time is used to determine the time conversion strategy corresponding to the access time data; finally, the access behaviors of the same IP are processed one by one according to the above conversion strategy, so as to obtain the access vector corresponding to the semantic data.

[0039] Specifically, the first conversion strategy corresponding to the access behavior data is determined based on the location information, such as Figure 5 As shown, including: Step S501, obtaining access behavior data corresponding to the IP address data in the location information; Step S502, determining resource acquisition behavior data included in the access behavior data, and determining a first access value corresponding to the resource acquisition behavior data; Step S503, determining the instruction control behavior data included in the access behavior data, and determining the second access value corresponding to the resource acquisition behavior data; Step S504, determining the byte stream data interaction behavior data included in the access behavior data, and determining a third access value corresponding to the resource acquisition behavior data; Step S505, determining the polling event behavior data included in the access behavior data, and determining a fourth access value corresponding to the resource acquisition behavior data; Step S506, determining the interruption event behavior data included in the access behavior data, and determining a fifth access value corresponding to the resource acquisition behavior data; Step S507 , determining a first conversion strategy corresponding to the access behavior data based on the first access value, the second access value, the third access value, the fourth access value, and the fifth access value.

[0040] In the process of determining the first conversion strategy corresponding to the access behavior data based on the location information, the access behaviors are defined as follows: resource acquisition, instruction control, byte stream data interaction, polling events, and interruption events. After step S502-step S506, the resource acquisition behavior data corresponds to the first access value 0; the instruction control behavior data corresponds to the second access value 1; the byte stream data interaction behavior data corresponds to the third access value 2; the polling event behavior data corresponds to the fourth access value 3; and the interruption event behavior data corresponds to the fifth access value 4. By matching the above-mentioned placement positions with specific access behaviors, the first conversion strategy corresponding to the access behavior data is obtained.

[0041] Optionally, a second conversion strategy corresponding to the access source data is determined based on the location information, such as Figure 6 As shown, including: Step S601, obtaining access source data corresponding to the IP address data in the location information; Step S602, determining the location data contained in the access source data, and determining the location code corresponding to the location data; Step S603: determining a second conversion strategy corresponding to the access source data based on the location data and the location code.

[0042] In the process of determining the second conversion strategy corresponding to the access source data based on the location information, the access source data corresponding to the IP address data is first obtained. Specifically, the IP address data is a string of IP addresses, which is essentially a series of strings; and the access source data is the specific location corresponding to the IP address, which is essentially text. When the two are used to construct semantic vectors, the vector data will be more complex. Therefore, it can be characterized based on the position code corresponding to the access source data. The position code can use a three-digit code to describe the access source data, so after the position data and the position code are matched with each other, the second conversion strategy corresponding to the access source data is obtained.

[0043] Optionally, a third conversion strategy corresponding to the access time data is determined based on the access time, such as Figure 7 As shown, including: Step S701, obtaining access time data corresponding to the IP address data in the access time; Step S702, determining a reference time corresponding to the access time data, and obtaining a time interval between the data access moment in the access time data and the reference time; Step S703: determining a third conversion strategy corresponding to the access time data based on the time interval.

[0044] In the process of determining the third conversion strategy corresponding to the access time data based on the access time, the access time data corresponding to the IP address data is first obtained. Since the access time data is usually in the form of a timestamp, including year, month, day, hour, minute, and second, it is relatively complex and difficult to calculate. When used to construct a semantic vector, it will cause the vector data to be relatively complex. Therefore, the access time data can be described by obtaining the reference time corresponding to the access time data and calculating the time interval between the data access moments of each data in the access time data through the reference time. Therefore, after the time interval and the access time data are mutually corresponded, the third conversion strategy corresponding to the access time data is obtained.

[0045] Specifically, the semantic data is: "On January 1, at 10:00, the IP address was AAA, coming from a certain place, and a resource acquisition was performed."

[0046] "On January 1, at 10:30, the IP address was AAA, coming from a certain place, and a resource acquisition was performed."

[0047] "On January 1, at 12:00, the IP address was AAA, coming from a certain place, and carried out a command control."

[0048] According to the above conversion strategy, "January 1, 10:00, IP is AAA, from a certain place, and a resource acquisition was performed" is the first visit, and the third conversion strategy can be used to set the access time to -1; "January 1, 10:30, IP is AAA, from a certain place, and a resource acquisition was performed" is 30 minutes away from the first visit, and "January 1, 12:00, IP is AAA, from a certain place, and a command control was performed" is 120 minutes away from the first visit. Therefore, the access time data in the three vectors corresponding to the three semantic data are -1, 30, and 120, respectively.

[0049] Therefore, the semantic vectors corresponding to the above IP being AAA are specifically: [-1, 101, 0], [30, 101, 0], [120, 101, 1].

[0050] Optionally, a classifier corresponding to the semantic vector is obtained, the intrusion risk value corresponding to the semantic vector is calculated using the classifier, and the intrusion risk value is used to determine the intrusion detection result corresponding to the traffic data in step S104, such as Figure 8 As shown, including: Step S801, determining a first vector and a second vector corresponding to the semantic vector based on a numerical relationship between the time interval and a preset time threshold; Step S802, obtaining a classifier corresponding to the first vector and the second vector, and using the classifier to calculate an intrusion risk probability distribution result corresponding to the semantic vector; Step S803: determining an intrusion risk value according to the intrusion risk probability distribution result, and determining an intrusion detection result corresponding to the traffic data using the intrusion risk value.

[0051] After the semantic vector is obtained, it can be adjusted according to the size of the time interval. For example, if the time threshold is 100, if two adjacent vectors are less than 100 minutes apart, they are classified as a group of short vectors, namely the first vector. For example, [-1,101,0] and [30,101,0] constitute a group of short vectors. If there are 10,000 visits to AAA, then the 10,000 semantic vectors obtained constitute the long vector of AAA. In layman's terms, the long vector of each IP address is regarded as a "sentence" and the short vector as a "word". The intrusion risk probability distribution result can be calculated through the corresponding classifiers of the two.

[0052] The specific calculation process can be implemented using a related model, which can be implemented by training a transformer model and combining it with a softmax classifier. Specifically, first label the known data. Malicious access traffic is marked as 1; normal access traffic is marked as 0. Then initialize the model parameters, initialize the weight W (usually a small random value) and the bias b (usually 0); then forward propagate the transformer model to calculate the linear transformation z = W·F(V)+b for each input sample V. V is the semantic vector of AAA, and F(V) is the vectorized result of V. After using the Softmax function to calculate the probability distribution of each class, the loss value of the model is calculated. Specifically, the cross entropy loss is calculated using the true label and the predicted probability, and then the gradient of the loss function to W and b is calculated through back propagation. In this process, relevant optimization algorithms (such as SGD and Adam) are used to update the parameters of the model, and the training data is repeatedly iterated and trained many times until the loss function converges or the training stops when a specific condition is reached, and the trained softmax classifier is obtained, which is S.

[0053] In the specific implementation process, when a new IP address CCC accesses, the vector V is first constructed according to the above process, and F(V) is calculated, then S(F(V)) is obtained, and the traffic data of the IP address is calculated to see whether it is an intrusion. Specifically, when S(F(V))=1, it is an intrusion, and S(F(V))=0 is a normal access.

[0054] From the network intrusion detection method mentioned in the above embodiment, it can be seen that the method can perform sufficient semantic analysis on the traffic data corresponding to IPv6, and can accurately detect network intrusion behavior through the generated semantic vector, thereby alleviating the problem of high missed detection rate when performing intrusion detection on IPv6 traffic data.

[0055] Corresponding to the network intrusion detection method provided in the above embodiment, the embodiment of the present invention provides a network intrusion detection system, such as Fig. 9 As shown, the system includes: The access data determination module 910 is used to obtain the flow data including the network protocol data, and determine the access data corresponding to the flow data based on the network protocol data; A semantic data determination module 920, for determining semantic data corresponding to the access data using attribute parameters corresponding to the network protocol data; A semantic vector determination module 930, for determining a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and determining a semantic vector corresponding to the semantic data using the conversion strategy; The intrusion detection calculation module 940 is used to obtain a classifier corresponding to the semantic vector, calculate an intrusion risk value corresponding to the semantic vector using the classifier, and determine an intrusion detection result corresponding to the traffic data using the intrusion risk value.

[0056] From the network intrusion detection system mentioned in the above embodiment, it can be seen that the system can perform sufficient semantic analysis on the traffic data corresponding to IPv6, and can accurately detect network intrusion behavior through the generated semantic vectors, thereby alleviating the problem of high missed detection rate when performing intrusion detection on IPv6 traffic data.

[0057] The network intrusion detection system provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned network intrusion detection method embodiment. For the sake of brief description, for matters not mentioned in the system embodiment, reference may be made to the corresponding contents in the aforementioned network intrusion detection method embodiment.

[0058] This embodiment also provides an electronic device. The structural diagram of the electronic device is as follows: Fig.10 As shown, the device includes a processor 101 and a memory 102; wherein the memory 102 is used to store one or more computer instructions, and the one or more computer instructions are executed by the processor to implement the steps of the above-mentioned network intrusion detection method.

[0059] Fig.10 The electronic device shown further includes a bus 103 and a communication interface 104 , and the processor 101 , the communication interface 104 and the memory 102 are connected via the bus 103 .

[0060] The memory 102 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The bus 103 may be an ISA bus, a PCI bus, or an EISA bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0061] The communication interface 104 is used to connect to at least one user terminal and other network units through a network interface, and send the encapsulated IPv4 message or IPv4 message to the user terminal through the network interface.

[0062] The processor 101 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 101. The above processor 101 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 102, and the processor 101 reads the information in the memory 102 and completes the steps of the method of the above embodiment in combination with its hardware.

[0063] An embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the network intrusion detection method in the above embodiment are executed.

[0064] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, equipment and methods can be implemented in other ways. The system embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0065] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0066] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0067] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that can be executed by a processor. Based on this understanding, the technical solution of the present invention can essentially or in other words, the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0068] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network intrusion detection method, characterized in that: The method comprises: Acquire flow data including network protocol data, and determine access data corresponding to the flow data based on the network protocol data; Determine semantic data corresponding to the access data using attribute parameters corresponding to the network protocol data; Determining a conversion strategy for the semantic data based on the location information and access time contained in the semantic data, and determining a semantic vector corresponding to the semantic data using the conversion strategy; A classifier corresponding to the semantic vector is obtained, an intrusion risk value corresponding to the semantic vector is calculated using the classifier, and an intrusion detection result corresponding to the traffic data is determined using the intrusion risk value.

2. The network intrusion detection method according to claim 1, characterized in that: Acquiring flow data including network protocol data, and determining access data corresponding to the flow data based on the network protocol data, including: Acquire the flow data, and determine the network protocol data corresponding to the flow data; Determine the IP address data, access source data, access behavior data and access time data contained in the traffic data according to the attribute parameters of the network protocol data; Based on the IP address data, the access source data, the access behavior data and the access time data are used to determine the access data corresponding to the traffic data.

3. The network intrusion detection method according to claim 2, characterized in that: Determining semantic data corresponding to the access data using attribute parameters corresponding to the network protocol data includes: Acquire the IP address data, the access source data, the access behavior data and the access time data corresponding to the network protocol data according to the attribute parameters; By using a preset separator, the character strings corresponding to the access time data, the IP address data, the access source data and the access behavior data are sequentially connected to generate the semantic data corresponding to the access data.

4. The network intrusion detection method according to claim 2, characterized in that: Determining a conversion strategy for the semantic data based on the location information and access time included in the semantic data, and determining a semantic vector corresponding to the semantic data using the conversion strategy, including: Based on the IP address data, obtain the access source data, the access behavior data and the access time data corresponding to the semantic data under the same IP address; Determine the location information in the semantic data using the access source data and the access behavior data; determine a first conversion strategy corresponding to the access behavior data based on the location information, and determine a second conversion strategy corresponding to the access source data based on the location information; Determine the access time in the semantic data using the access time data, and determine a third conversion strategy corresponding to the access time data based on the access time; After the format of the semantic data is converted according to the first conversion strategy, the second conversion strategy, and the third conversion strategy, the semantic vector corresponding to the semantic data is obtained.

5. The network intrusion detection method according to claim 4, characterized in that: Determining a first conversion strategy corresponding to the access behavior data based on the location information includes: Obtain the access behavior data corresponding to the IP address data in the location information; Determining resource acquisition behavior data included in the access behavior data, and determining a first access value corresponding to the resource acquisition behavior data; Determining instruction control behavior data included in the access behavior data, and determining a second access value corresponding to the resource acquisition behavior data; Determine the byte stream data interaction behavior data included in the access behavior data, and determine a third access value corresponding to the resource acquisition behavior data; Determine the polling event behavior data included in the access behavior data, and determine a fourth access value corresponding to the resource acquisition behavior data; Determine the interruption event behavior data included in the access behavior data, and determine a fifth access value corresponding to the resource acquisition behavior data; The first conversion strategy corresponding to the access behavior data is determined based on the first access value, the second access value, the third access value, the fourth access value, and the fifth access value.

6. The network intrusion detection method according to claim 4, characterized in that: Determining a second conversion strategy corresponding to the access source data based on the location information includes: Obtain the access source data corresponding to the IP address data in the location information; Determine the location data contained in the access source data, and determine the location code corresponding to the location data; The second conversion strategy corresponding to the access source data is determined based on the location data and the location code.

7. The network intrusion detection method according to claim 4, characterized in that: Determining a third conversion strategy corresponding to the access time data based on the access time includes: Obtain the access time data corresponding to the IP address data in the access time; Determine a reference time corresponding to the access time data, and obtain a time interval between a data access moment in the access time data and the reference time; The third conversion strategy corresponding to the access time data is determined based on the time interval.

8. The network intrusion detection method according to claim 7, characterized in that: Obtaining a classifier corresponding to the semantic vector, using the classifier to calculate an intrusion risk value corresponding to the semantic vector, and using the intrusion risk value to determine an intrusion detection result corresponding to the traffic data, including: Determine a first vector and a second vector corresponding to the semantic vector based on a numerical relationship between the time interval and a preset time threshold; Obtaining the classifier corresponding to the first vector and the second vector, and using the classifier to calculate the intrusion risk probability distribution result corresponding to the semantic vector; The intrusion risk value is determined according to the intrusion risk probability distribution result, and the intrusion detection result corresponding to the traffic data is determined using the intrusion risk value.

9. A network intrusion detection system, characterized in that: The system comprises: An access data determination module, used to obtain flow data including network protocol data, and determine access data corresponding to the flow data based on the network protocol data; A semantic data determination module, used to determine the semantic data corresponding to the access data using the attribute parameters corresponding to the network protocol data; A semantic vector determination module, configured to determine a conversion strategy for the semantic data based on location information and access time contained in the semantic data, and to determine a semantic vector corresponding to the semantic data using the conversion strategy; The intrusion detection calculation module is used to obtain a classifier corresponding to the semantic vector, use the classifier to calculate an intrusion risk value corresponding to the semantic vector, and use the intrusion risk value to determine an intrusion detection result corresponding to the traffic data.

10. An electronic device, characterized in that: The invention comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the steps of the network intrusion detection method according to any one of claims 1 to 8.

Images