Network security threat monitoring method and system based on deep learning

Abstract

The invention relates to the field of network security monitoring, in particular to a network security threat monitoring method based on deep learning, which comprises the following steps: collecting flow data on a network node, and preprocessing the collected flow data; constructing a deep neural network model to analyze the flow data, and adjusting model parameters through an optimization algorithm to minimize a loss function; evaluating the network security threat according to an output result of the deep learning model; determining response measures according to the threat assessment result, and taking corresponding response operations for different threat levels; according to the method, the timeliness of the response is evaluated according to the time interval from threat detection to response measure implementation, the deep neural network is utilized, the deep features can be automatically extracted from the network flow, and the recognition precision of the complex attack mode is remarkably improved. Compared with a traditional rule-based detection method and a simple machine learning algorithm, the scheme can effectively reduce the false report rate and the missing report rate, and improve the accuracy of network threat monitoring.

Description

Technical Field

[0001] The present invention relates to the field of network security monitoring, and more particularly to a network security threat monitoring method and system based on deep learning. Background Art

[0002] Network security threat monitoring technology plays a vital role in the current information security field. With the rapid development of the Internet and information technology, the means of network attacks are constantly updated and diversified. Traditional rule-based detection methods and simple machine learning algorithms have gradually shown many shortcomings and are difficult to meet the real-time response requirements for complex attack scenarios.

[0003] Traditional network security threat monitoring methods mostly rely on rule engines to identify potential attacks by comparing features in network traffic. The main problem with this type of method is its poor adaptability. Once new attack methods or malware variants appear, existing rules may not be updated in time, resulting in new threats not being detected. Especially in the face of rapidly changing and complex attack patterns, the effectiveness of rule-based detection methods is greatly reduced.

[0004] In addition, simple machine learning algorithms (such as decision trees and support vector machines) can improve the accuracy of network threat detection to a certain extent, but the performance of machine learning algorithms is often limited when dealing with complex network traffic and attack patterns. These algorithms have a high dependence on feature selection and model training, and may be easily affected by factors such as imbalanced training data, insufficient data volume, or changes in attack patterns, resulting in high false positive and false negative rates. In particular, when faced with complex and hidden attack patterns, simple machine learning algorithms are difficult to achieve high-precision identification.

[0005] Therefore, when faced with large-scale network traffic, the processing capabilities of traditional rule-based detection systems and simple machine learning models are often insufficient. These systems may not be able to meet the real-time monitoring needs of high traffic and large data volumes, especially in enterprise-level network environments. Detection delays may occur, resulting in potential threats not being discovered in time, and thus failing to effectively protect the system from attacks.

[0006] In view of the above shortcomings of existing technologies, the field of network security threat monitoring urgently needs a more efficient, intelligent, and adaptable solution that can respond to new attack modes in real time, improve detection accuracy, and reduce false positives and missed reports. In addition, the processing capacity for large-scale network traffic also needs to be further optimized to meet the needs of real-time monitoring. Summary of the invention

[0007] The technical solution of the present invention aims to solve the deficiencies of traditional network security threat monitoring methods in terms of adaptability, accuracy and processing capabilities, and proposes a network security threat monitoring method and system based on deep learning. By utilizing the powerful feature learning capabilities of the deep learning model, there is no need to manually define a large number of rules, so that new types of threats can be automatically identified and responded to. At the same time, the optimized deep learning algorithm can effectively improve detection accuracy, reduce false positive and false negative rates, and enhance the system's real-time processing capabilities for large-scale network traffic through parallel computing and efficient algorithms, meeting the needs of immediate response to security threats in modern complex network environments. The present invention is achieved through the following technical solutions: A network security threat monitoring method based on deep learning includes the following steps: S1. Collecting flow data on a network node and preprocessing the collected flow data, wherein the preprocessing includes removing irrelevant data and extracting key information related to network characteristics; S2. Construct a deep neural network model to analyze the traffic data, wherein the deep neural network model maps input data to an output vector, and the processing process of the deep neural network model is characterized by a parameterized function; The model is trained using a training set containing labeled data, and the model parameters are adjusted using an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. S3. Evaluate network security threats based on the output of the deep learning model; set multiple threat levels to classify the evaluation results; and measure the effectiveness of the evaluation by calculating the evaluation accuracy. S4. Determine response measures based on threat assessment results and take appropriate response actions for different threat levels; evaluate the timeliness of the response based on the time interval from threat detection to implementation of response measures.

[0008] Furthermore, in step S1, the flow data is collected at key network nodes by means of a network probe or flow mirroring; The preprocessing includes removing noise data and invalid data, and extracting characteristic information of source address, destination address and protocol type in the traffic data; The collected traffic data satisfies the relationship ,in Indicates the total amount of traffic data. Indicates the number of packets. Indicates the size of each data packet.

[0009] Furthermore, the deep neural network model described in step S2 includes a convolutional neural network or a recurrent neural network, and the deep neural network model maps the input traffic data into an output vector, that is, the input traffic data is represented as , after being processed by the deep neural network model, the output vector is generated , and its conversion process satisfies: in, A function representing a deep neural network model, Represents model parameters.

[0010] Furthermore, the deep neural network model in step S2 is trained using a training set containing labeled data, and the model parameters are adjusted using an optimization algorithm to minimize the loss function and improve the analysis accuracy; The optimization algorithm includes batch gradient descent, and the model parameters are updated using the set batch size and learning rate. The parameter update formula is: in, Indicates the current parameters. represents the updated parameters, represents the gradient of the loss function with respect to the parameters, represents the learning rate, Indicates the batch size.

[0011] Further, the threat level described in step S3 includes a high threat level, a medium threat level, and a low threat level; By calculating the accuracy Measure the effectiveness of cybersecurity threat assessment and assess accuracy: in, represents the number of threats that are correctly assessed, Indicates the actual total number of threats.

[0012] Furthermore, the response measures include issuing an alarm, blocking attack traffic, and modifying security policies; When the threat level is a high threat level, the firewall rule is activated to block the IP address of the attack source.

[0013] Furthermore, in step S4, the response timeliness is defined as , Represents the time interval between threat detection and the completion of response measures.

[0014] The present invention also proposes a network security threat monitoring system based on deep learning, comprising: A data collection module, used to collect flow data at a network node through a network probe or flow mirroring, and the data collection module pre-processes the collected flow data; A deep learning model module is used to construct a deep neural network model to analyze traffic data. The deep neural network model includes a convolutional neural network and a recurrent neural network. The deep neural network model is trained by a training set containing labeled data, and the model parameters are adjusted by an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. The optimization algorithm includes batch gradient descent. A threat assessment module is used to assess network security threats based on the output results of the deep learning analysis module, set multiple threat levels, including high threat level, medium threat level and low threat level, and classify the assessment results; The response module is used to determine the response measures according to the results of the threat assessment module and take corresponding response actions for different threat levels; the response measures include issuing alarms, blocking attack traffic and modifying security policies; when a high threat level is detected, the firewall rules are activated to block the IP address of the attack source.

[0015] Beneficial effects of the present invention: (1) The present invention proposes a network security threat monitoring method based on deep learning. By using deep neural networks, it can automatically extract deep features from network traffic, significantly improving the recognition accuracy of complex attack patterns. Compared with traditional rule-based detection methods and simple machine learning algorithms, this solution can effectively reduce false positive and false negative rates and improve the accuracy of network threat monitoring; (2) The present invention proposes a network security threat monitoring method based on deep learning. The deep learning model has strong generalization ability and can automatically learn and identify new attack patterns without manually updating rules. Therefore, when facing new or variant attacks, the system can adapt quickly, avoiding the problem of delayed response of traditional rule-based methods when new threats appear; (3) The network security threat monitoring method based on deep learning proposed in the present invention can efficiently process large-scale network traffic data through optimized deep learning algorithms and batch gradient descent optimization methods to meet the needs of real-time monitoring and response. Through parallel computing and efficient data processing capabilities, it can ensure that the system can still respond in time under large traffic conditions to avoid delay problems; (4) The present invention proposes a network security threat monitoring method based on deep learning, which provides a multi-level threat assessment system. By classifying threats (such as high, medium, and low threat levels), the system can take precise response measures for different threat levels, such as issuing alarms, blocking attack traffic, and modifying security policies. For high threat levels, the system can automatically activate firewall rules to quickly block the IP address of the attack source and minimize losses; (5) The present invention proposes a network security threat monitoring system based on deep learning. The network security threat monitoring system based on deep learning significantly improves the efficiency and accuracy of network security protection through automated data collection, preprocessing, deep learning analysis, threat assessment and response modules. The system automatically collects traffic data of key network nodes through network probes or traffic mirroring, and performs denoising and invalid data removal to ensure the validity of the data. The deep learning module uses convolutional neural networks (CNN) or recurrent neural networks (RNN) to automatically extract complex features, improves the accuracy and adaptability of threat detection, and can respond to new attack modes in real time. The threat assessment module helps to accurately identify the severity of the attack through multi-level threat classification and guides the corresponding response measures. The response module can automatically take corresponding measures, such as issuing alarms, blocking attack traffic or modifying security policies, and activating firewall rules for attack sources with high threat levels to quickly cut off the attack path. At the same time, the system ensures rapid response, shortens the time interval from detection to response, and minimizes potential losses. Through these highly integrated and automated functions, the present invention provides an efficient and intelligent solution for network security monitoring, greatly enhancing the ability to monitor in real time, adapt to new threats and respond quickly.

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 A flowchart of a network security threat monitoring method based on deep learning proposed by the present invention; Figure 2 A schematic diagram of a terminal device for a network security threat monitoring method based on deep learning proposed by the present invention; Figure 3 A schematic diagram of a readable storage medium of a network security threat monitoring method based on deep learning proposed by the present invention; In the figure, 200-terminal device, 210-memory, 211-RAM, 212-cache memory, 213-ROM, 214-program / utility, 215-program module, 220-processor, 230-bus, 240-external device, 250-I / O interface, 260-network adapter, 300-program product. DETAILED DESCRIPTION

[0018] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0019] Example 1 refer to Figure 1 , a network security threat monitoring method based on deep learning, comprising the following steps: 1. Collecting traffic data on network nodes and preprocessing the collected traffic data, wherein the preprocessing includes removing irrelevant data and extracting key information related to network characteristics; In step 1, the flow data is collected at key network nodes through network probes or flow mirroring; the preprocessing includes removing noise data and invalid data, and extracting characteristic information of source address, destination address, and protocol type in the flow data. In this embodiment, the flow data is collected through network probes or flow mirroring devices deployed in the network. Network probes are installed on key network nodes including border routers and switches, and network flow information is obtained in real time by capturing network flow packets (such as TCP / IP data packets) passing through the node. Alternatively, flow mirroring technology is used to copy network flow to the monitoring system through the switch to achieve data collection.

[0020] Included in this embodiment: Network probes are connected at key locations on network nodes and can capture data packets entering or leaving the network. They are suitable for monitoring specific nodes or data flows.

[0021] Traffic mirroring, by configuring the network switch, mirrors all data traffic in the network to an independent port for traffic analysis, which is suitable for scenarios that require full network monitoring.

[0022] In this embodiment, the collected raw traffic data is preprocessed to remove irrelevant data and extract key information related to network characteristics. The preprocessing step includes the following steps: 1.1. Remove noise data and invalid data. The system cleans up the useless data collected, such as network interruption packets, empty packets, duplicate packets or transmission error packets, etc. Through data cleaning technology, remove irrelevant or invalid traffic to ensure that the analyzed data is more accurate and reliable.

[0023] 1.2. Extract key information. From the cleaned traffic data, extract key fields related to network security features. These fields include but are not limited to: Source address: The source IP address of the data packet, used to analyze the source of the attack.

[0024] Destination address: The target IP address of the data packet, which helps analyze the attack target.

[0025] Protocol type: Protocol types such as TCP, UDP, and ICMP help identify abnormal traffic at the protocol level.

[0026] Port number: source port and destination port, used to analyze whether the service port is attacked.

[0027] Packet length: used to determine whether the traffic is abnormal, for example, whether a large number of packets are sent.

[0028] This information is used in subsequent deep learning models for feature extraction and attack pattern recognition.

[0029] 1.3. Data formatting: During the preprocessing process, the data also needs to be formatted so that the subsequent deep learning analysis module can be effectively used. The data formatting method used in this embodiment includes: Timestamps, associate a timestamp with each packet so that the temporal pattern of the traffic can be evaluated during subsequent analysis.

[0030] Data normalization is the process of standardizing data to ensure that the data has a uniform scale when it is input into the deep learning model.

[0031] 2. Construct a deep neural network model to analyze the traffic data. The deep neural network model maps input data to output vectors, and its processing process is characterized by a parameterized function; The model is trained using a training set containing labeled data, and the model parameters are adjusted using an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. The deep neural network model described in step 2 includes a convolutional neural network or a recurrent neural network; 2.1. Construct a deep neural network model, where convolutional neural networks are mainly used for processing images or structured data and can effectively extract spatial features. In network traffic data analysis, the features of each data packet, such as source IP, destination IP, and protocol type, can be converted into a two-dimensional matrix form and processed in a simulated image input manner.

[0032] The CNN structure includes: Input layer: input traffic data It is a matrix with multiple features (e.g. source IP, destination IP, protocol type, port, etc.), each row represents a packet, and each column of the matrix corresponds to a feature.

[0033] Convolution layer: The convolution kernel performs convolution operations on the input matrix to extract local features, such as the time series of traffic and protocol patterns.

[0034] Pooling layer: Downsampling is performed to reduce the dimension of features while retaining the most important information.

[0035] Fully connected layer: In the last layer, the fully connected layer maps the features extracted by the convolutional and pooling layers to the output space for threat classification.

[0036] Recurrent neural networks are suitable for time series data analysis and can effectively handle the time dependencies in network traffic. For example, some malicious behaviors in traffic may be manifested through specific temporal patterns.

[0037] The RNN structure includes: Input layer: traffic data The input is in the form of time series data, and the traffic data at each moment is recursively processed through the hidden units in the RNN.

[0038] Hidden layer: Hidden units (such as LSTM or GRU) process the temporal relationship of the input data to identify the temporal characteristics of the attack pattern.

[0039] Output layer: Generate a vector based on the output of the hidden layer , indicating whether the traffic data contains security threats.

[0040] 2.2. The deep neural network model maps the input traffic data into an output vector, that is, the input traffic data is represented as , after being processed by the deep neural network model, the output vector is generated , and its conversion process satisfies: in, A function representing a deep neural network model, Represents model parameters.

[0041] In this embodiment, the input data to be processed is defined as the characteristics of the network traffic (such as source address, destination address, protocol type, port number), and these characteristics are converted into a vector and used as the input of the deep neural network.

[0042] The specific implementation steps are as follows: Input Data , including source IP address: 192.168.1.1; target IP address: 192.168.2.2; protocol type: TCP; source port number: 12345; target port number: 80.

[0043] Convert the above data into a vector : The vector will be properly standardized or encoded based on data preprocessing, including converting the IP address into a numerical value, converting the protocol type into a category code, etc., to facilitate input into the deep neural network.

[0044] In the model training phase, labeled data is used for learning, and the model is trained through weights, i.e. parameters. To process the input data, the model contains multiple layers of neurons. Each layer transforms the input data through a nonlinear activation function (such as ReLU or Sigmoid) to extract more advanced features.

[0045] The first layer performs a basic linear transformation on the input data, which is a linear combination of weights and biases and processes it through an activation function.

[0046] The middle layer further extracts some hidden features, such as traffic patterns and protocol usage frequency.

[0047] The output layer maps the final hidden layer features into an output vector , represented as a multidimensional vector, where each dimension corresponds to the probability of a class or a threat level.

[0048] In this embodiment, network traffic data is divided into two categories: normal traffic and attack traffic. The output vector As shown below: The first element represents the probability of normal traffic (0.85), and the second element represents the probability of attack traffic (0.15). Based on the probability value of the output vector, the model can determine whether the traffic is malicious traffic. Through the training process, the deep neural network will continuously adjust the parameters of the model according to the loss function. , so that the output Match the true label more accurately. This process is completed through the back-propagation algorithm. The model continuously iterates and optimizes parameters to improve the prediction accuracy.

[0049] The deep neural network model described in step 2 is trained by a training set containing labeled data. In this embodiment, during the training process, a training set containing labeled data is first prepared. The labeled data set includes a large amount of traffic data, and each piece of data corresponds to a known label (for example, normal traffic or attack traffic). Assume that the training set contains samples, denoted as: in, Indicates The input feature vector of the flow data, Indicates The true label of the traffic data.

[0050] The characteristic source IP address, destination port, etc. in the data set will be converted into a format suitable for deep neural network processing through preprocessing. It can be a category label such as normal or attack, or it can be a numerical value corresponding to the threat level such as 1 for normal, 2 for low threat, and 3 for high threat.

[0051] During training, the loss function is used to measure the difference between the model prediction results and the true labels. Assuming the cross entropy loss function is used, the loss function Defined as: in, Indicates the output probability value predicted by the model, such as the probability of normal traffic, Indicates the actual label value, such as 0 for normal traffic and 1 for attack traffic.

[0052] In each iteration, batch gradient descent calculates the gradient of the loss function using a batch of training data and uses this gradient to update the model parameters.

[0053] The optimization algorithm includes batch gradient descent, and the model parameters are updated using the set batch size and learning rate. The parameter update formula is: in, Indicates the current parameters. represents the updated parameters, represents the gradient of the loss function with respect to the parameters, represents the learning rate, Indicates the batch size.

[0054] For each sample , calculate the loss function About Model Parameters The partial derivative is the gradient, and the gradients of all samples are summed and averaged to update the model parameters.

[0055] 3. Evaluate network security threats based on the output of the deep learning model; set multiple threat levels to classify the evaluation results; and measure the effectiveness of the evaluation by calculating the evaluation accuracy; The threat levels described in step 3 include a high threat level, a medium threat level, and a low threat level; By calculating the accuracy Measure the effectiveness of cybersecurity threat assessment and assess accuracy: in, represents the number of threats that are correctly assessed, Indicates the total number of actual threats. The response measures include issuing an alarm, blocking attack traffic, modifying security policies, and when the threat level is a high threat level, starting firewall rules to block the IP address of the attack source.

[0056] In this embodiment, it is assumed that 100 network traffic data samples are evaluated and the number of correctly evaluated threats is 85, that is, The accuracy of the network security threat assessment system is 85%.

[0057] Based on the threat assessment results, the system will take corresponding response measures. Depending on the assessed threat level, the system will take different protective actions.

[0058] Among them, high threat level: If the threat assessed by the model is high threat (Threat Level 3), the system will immediately take the following response measures: Sound an alarm: The system triggers an alarm, notifying the network administrator or security personnel to intervene.

[0059] Blocking attack traffic: The system may block attack traffic, for example, by isolating the source IP address through firewall rules to prevent the attack from spreading further.

[0060] Modify security policies: The system may dynamically adjust firewall, intrusion detection system (IDS), or intrusion prevention system (IPS) rules to increase protection against specific attack types.

[0061] Medium Threat Level: If the attack is assessed as medium threat (Threat Level 2), the system will perform the following actions: Sound an alarm: Although the threat level is low, the system will still sound an alarm.

[0062] Real-time monitoring: Enhance monitoring of relevant traffic and regularly analyze whether traffic behavior has changed.

[0063] Low Threat Level: If the threat level is low (Threat Level 1), the system will do the following: Record logs: Record traffic data and save logs for later analysis.

[0064] No immediate response is required: the system continues to monitor the traffic and waits for subsequent behavior changes.

[0065] 4. Determine response measures based on threat assessment results and take appropriate response actions for different threat levels; evaluate the timeliness of the response based on the time interval from threat detection to implementation of response measures.

[0066] In step 4, the response timeliness is defined as , Represents the time interval between threat detection and the completion of response measures.

[0067] The response system also evaluates the timeliness of the response. Response timeliness represents the time interval between threat detection and implementation of response measures. Set the time interval Used to measure whether response measures are initiated within the specified time.

[0068] High threat level response time: For high threat levels, the system requires that the response measures be initiated in a shorter time, such as within 1 minute.

[0069] Medium and low threat level response time: For medium and low threat levels, the response time can be slightly longer, usually within 10 minutes.

[0070] Example 2 This embodiment proposes a network security threat monitoring system based on deep learning on the basis of embodiment 1. A network security threat monitoring system based on deep learning, comprising: A data collection module, used to collect flow data at a network node through a network probe or flow mirroring, and the data collection module pre-processes the collected flow data; A deep learning model module is used to construct a deep neural network model to analyze traffic data. The deep neural network model includes a convolutional neural network and a recurrent neural network. The deep neural network model is trained by a training set containing labeled data, and the model parameters are adjusted by an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. The optimization algorithm includes batch gradient descent. A threat assessment module is used to assess network security threats based on the output results of the deep learning analysis module, set multiple threat levels, including high threat level, medium threat level and low threat level, and classify the assessment results; The response module is used to determine the response measures according to the results of the threat assessment module and take corresponding response actions for different threat levels; the response measures include issuing alarms, blocking attack traffic and modifying security policies; when a high threat level is detected, the firewall rules are activated to block the IP address of the attack source.

[0071] Example 3 refer to Figure 2 Based on Example 1, this embodiment proposes a terminal device for a network security threat monitoring method based on deep learning. The terminal device 200 includes at least one memory 210, at least one processor 220, and a bus 230 connecting different platform systems.

[0072] The memory 210 may include a readable medium in the form of a volatile memory, such as a RAM 211 and / or a cache memory 212 , and may further include a ROM 213 .

[0073] Among them, the memory 210 also stores a computer program, and the computer program can be executed by the processor 220, so that the processor 220 executes any one of the above-mentioned network security threat monitoring methods based on deep learning in the embodiments of the present application. The specific implementation method is consistent with the implementation method and the technical effect achieved in the embodiments of the above-mentioned application, and some contents are not repeated. The memory 210 may also include a program / utility 214 having a set (at least one) of program modules 215, such program modules include but are not limited to: an operating system, one or more applications, other program modules and program data, each of these examples or some combination may include the implementation of a network environment.

[0074] Accordingly, the processor 220 may execute the above-mentioned computer programs, and may execute the program / utility 214 .

[0075] The bus 230 may be a bus representing one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0076] The terminal device 200 may also communicate with one or more external devices 240 such as keyboards, pointing devices, Bluetooth devices, etc., and may also communicate with one or more devices that can interact with the terminal device 200, and / or communicate with any device (such as a router, a modem, etc.) that enables the terminal device 200 to communicate with one or more other computing devices. Such communication may be performed through an I / O interface 250. In addition, the terminal device 200 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 260. The network adapter 260 may communicate with other modules of the terminal device 200 through a bus 230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the terminal device 200, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms, etc.

[0077] Example 4 refer to Figure 3This embodiment proposes a computer-readable storage medium for a network security threat monitoring method based on deep learning. Instructions are stored on the computer-readable storage medium. When the instructions are executed by the processor, any one of the above-mentioned network security threat monitoring methods based on deep learning is implemented. The specific implementation method is consistent with the implementation method and the technical effect achieved in the above-mentioned application embodiment, and some contents will not be repeated here.

[0078] Figure 3 The program product 300 provided in this embodiment for implementing the above-mentioned application is shown, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product 300 of the present invention is not limited to this. In this embodiment, the readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. The program product 300 can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0079] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium may also be any readable medium other than the readable storage medium, which may send, propagate, or transmit a program used by or in combination with an instruction execution system, an apparatus, or a device. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above. The program code for performing the operation of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on a user computing device, partially on a user device, as an independent software package, partially on a user computing device, partially on a remote computing device, or entirely on a remote computing device or server. Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0080] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A network security threat monitoring method based on deep learning, characterized in that: The following steps are involved: S1. Collecting flow data on a network node and preprocessing the collected flow data, wherein the preprocessing includes removing irrelevant data and extracting key information related to network characteristics; S2. Construct a deep neural network model to analyze the traffic data, wherein the deep neural network model maps input data to an output vector, and the processing process of the deep neural network model is characterized by a parameterized function; The model is trained using a training set containing labeled data, and the model parameters are adjusted using an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. S3. Evaluate network security threats based on the output of the deep learning model; set multiple threat levels to classify the evaluation results; and measure the effectiveness of the evaluation by calculating the evaluation accuracy. S4. Determine response measures based on threat assessment results and take appropriate response actions for different threat levels; evaluate the timeliness of the response based on the time interval from threat detection to implementation of response measures.

2. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: In step S1, the flow data is collected at key network nodes by means of a network probe or flow mirroring; The preprocessing includes removing noise data and invalid data, and extracting characteristic information of source address, destination address and protocol type in the traffic data; The collected traffic data satisfies the relationship ,in Indicates the total amount of traffic data. Indicates the number of packets. Indicates the size of each data packet.

3. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: The deep neural network model described in step S2 includes a convolutional neural network or a recurrent neural network. The deep neural network model maps the input traffic data into an output vector, that is, the input traffic data is represented as , after being processed by the deep neural network model, the output vector is generated , and its conversion process satisfies: in, A function representing a deep neural network model, Represents model parameters.

4. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: The deep neural network model in step S2 is trained using a training set containing labeled data, and the model parameters are adjusted using an optimization algorithm to minimize the loss function and improve the analysis accuracy; The optimization algorithm includes batch gradient descent, and the model parameters are updated using the set batch size and learning rate. The parameter update formula is: in, Indicates the current parameters. represents the updated parameters, represents the gradient of the loss function with respect to the parameters, represents the learning rate, Indicates the batch size.

5. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: The threat level described in step S3 includes a high threat level, a medium threat level, and a low threat level; By calculating the accuracy Measure the effectiveness of cybersecurity threat assessment and assess accuracy: in, represents the number of threats that are correctly assessed, Indicates the actual total number of threats.

6. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: The response measures include issuing an alarm, blocking attack traffic, and modifying security policies; When the threat level is a high threat level, the firewall rule is activated to block the IP address of the attack source.

7. A network security threat monitoring method based on deep learning according to claim 1, characterized in that: In step S4, the response timeliness is defined as , Represents the time interval between threat detection and the completion of response measures.

8. A network security threat monitoring system based on deep learning, characterized in that: The method according to any one of claims 1 to 7, comprising: A data collection module, used to collect flow data at a network node through a network probe or flow mirroring, and the data collection module pre-processes the collected flow data; A deep learning model module is used to construct a deep neural network model to analyze traffic data. The deep neural network model includes a convolutional neural network and a recurrent neural network. The deep neural network model is trained by a training set containing labeled data, and the model parameters are adjusted by an optimization algorithm to minimize the loss function and improve the analysis accuracy of the model. The optimization algorithm includes batch gradient descent. A threat assessment module is used to assess network security threats based on the output results of the deep learning analysis module, set multiple threat levels, including high threat level, medium threat level and low threat level, and classify the assessment results; The response module is used to determine the response measures according to the results of the threat assessment module and take corresponding response actions for different threat levels; the response measures include issuing alarms, blocking attack traffic and modifying security policies; when a high threat level is detected, the firewall rules are activated to block the IP address of the attack source.

Images