A network intelligence threat countermeasure method and system

Abstract

The present invention relates to the field of network security technology, and in particular to a network intelligence threat countermeasure method and system, the method comprising: obtaining normal communication data and abnormal communication data of a network terminal to form a communication terminal data set; using a pre-trained type recognition model to identify the abnormal type of the communication data and generate a corresponding deception strategy; obtaining a data generation model, using adversarial sample technology to generate input data that can deceive the data generation model, implanting a backdoor in the data generation model training stage, so that the data generation model generates an erroneous output under a specific input; according to the deception strategy, generating a corresponding deception data packet based on data in the erroneous output data set, and sending the deception data packet to a network terminal that generates an abnormal access event; constructing a misleading database, the data generation model stores the deception data packet in the misleading database; monitoring the access record of the misleading database, and triggering an alarm when it is detected that the misleading database is accessed.

Description

Technical Field

[0001] The present invention relates to the field of network intelligence technology, and in particular to a network intelligence threat countermeasure method and system. Background Art

[0002] Cyber ​​intelligence is a term that has become increasingly important in the digital age. It involves the process of collecting, analyzing, and interpreting information over the Internet, with the goal of supporting decision-making for individuals and businesses. There are many types of cyber intelligence, including publicly available information (such as news reports and posts on social media), semi-public data (such as company financial reports and market research reports), and information obtained through more covert means.

[0003] With the rapid development of technology and the popularization of the Internet, cyber intelligence has become a key factor in the fields of corporate competitive intelligence and personal privacy protection. For example, companies can use cyber intelligence to analyze competitors' market strategies and adjust their own business directions; cyber intelligence is also used as a means of confrontation, not only for defensive purposes, but also as an attack tool. The main forms of cyber intelligence threats include cyber attacks and data leaks, which pose serious threats to personal information security and corporate data protection.

[0004] In the strategy of countering cyber intelligence threats, artificial intelligence and machine learning technologies can monitor network behavior in real time, quickly identify abnormal activities and automatically respond. To this end, we propose an active countermeasure method for cyber intelligence threats based on artificial intelligence models. Summary of the invention

[0005] The present invention generates a corresponding deception data packet according to a deception strategy by identifying anomalies in communication data. The content of the deception data packet is generated by a data generation model with a preset backdoor, and the generated deception data packet is sent to a data stealer.

[0006] The technical solution proposed by the present invention is: a method for countering network intelligence threats, the method comprising:

[0007] Acquire normal communication data and abnormal communication data of network terminals to form a communication terminal data set;

[0008] Use the pre-trained type recognition model to identify abnormal types of communication data and generate corresponding deception strategies;

[0009] Obtain a data generation model, use adversarial sample technology to generate input data that can deceive the data generation model, implant a backdoor in the data generation model training phase, and make the data generation model generate erroneous outputs under specific inputs; the generated erroneous outputs constitute an erroneous output data set; the data generation model is constructed based on a random forest algorithm;

[0010] According to the deception strategy, a corresponding deception data packet is generated based on the data in the error output data set, and the deception data packet is sent to the network terminal where the abnormal access event occurs;

[0011] Construct a misleading database with the same structure as the real database, and the data generation model stores the deceptive data packets in the misleading database;

[0012] Monitor the access records of the misleading database, and trigger an alarm when it is detected that the misleading database is accessed.

[0013] Preferably, the acquiring of normal communication data and abnormal communication data of a network terminal to form a communication terminal data set includes:

[0014] Obtain historical normal network normal communication data and abnormal communication data from the database;

[0015] Extract normal communication feature data from normal communication data to form a normal communication feature vector set A;

[0016] Extract abnormal communication feature data from the abnormal communication data to form an abnormal communication feature vector set B;

[0017] The normal communication feature set and the abnormal communication feature set are combined into a communication terminal data set.

[0018] Preferably, the method of using a pre-trained type recognition model to identify the abnormal type of communication data comprises the following steps:

[0019] Acquire communication data in real time, extract communication data features, and form a real-time communication feature data sequence;

[0020] Input the preprocessed real-time communication feature data sequence into the type recognition model, and output the abnormal type of communication data;

[0021] The communication data anomaly types include abnormal data packet transmission frequency, abnormal time interval between data packets, abnormal data packet size, and abnormal data content format or coding.

[0022] Preferably, the generating of the corresponding deception strategy includes:

[0023] Obtain the communication data anomaly type, and generate corresponding strategy call instructions according to the communication data anomaly type;

[0024] Constructing a deception strategy table, wherein the deception strategy table includes deception data packet generation rules matching different communication data anomaly types;

[0025] The spoof data packet generation rule includes the data source of the spoof data packet, the size of the spoof data packet and the identification tag of the spoof data packet.

[0026] Preferably, the use of adversarial sample technology to generate input data that can deceive the data generation model includes:

[0027] Obtain normal communication data and abnormal communication data;

[0028] Calculate the gradient 1 of normal communication data and the gradient 2 of abnormal communication data; the gradient 1 is the gradient of the loss function of the normal communication data relative to the data generation model; the gradient 2 is the gradient of the abnormal communication data relative to the data generation model function;

[0029] Set the perturbation factor to one and disturbance factor 2 ;

[0030] According to the gradient Add disturbances to normal communication data. ;in, is the gradient of normal communication data;

[0031] According to the gradient Add disturbance 2 to abnormal communication data ;in, is the gradient of abnormal communication data;

[0032] The normal communication data with perturbation one added and the abnormal communication data with perturbation two added are combined to generate adversarial sample data.

[0033] Preferably, the step of implanting a backdoor in the data generation model training phase so that the data generation model generates an erroneous output under a specific input comprises the following steps:

[0034] Obtain normal communication feature vector set A, abnormal communication feature vector set B and adversarial sample data;

[0035] Select a portion of the anti-sample data as a trigger, and activate the backdoor through the trigger; and add an original identification tag to the selected portion of the data;

[0036] When training the data generation model, the original identification label corresponding to the trigger is modified to an incorrect label, so that when the data generation model recognizes the trigger during the training process, it learns an incorrect mapping relationship;

[0037] Use the data with wrong labels to train the data generation model to learn the association between triggers and wrong labels;

[0038] By selecting different trigger data from A and B respectively to test the data generation model, it is ensured that the data generation model produces erroneous output under specific trigger data input.

[0039] Preferably, the method of generating a corresponding spoof data packet based on the data in the error output data set according to the spoof strategy, and sending the spoof data packet to the network terminal where the abnormal access event occurs includes:

[0040] Get the deception strategy table and strategy call instructions;

[0041] Get the spoofed data packet generation rules according to the policy call instructions;

[0042] If the data packet transmission frequency is abnormal, the data in the error output data set is selected as the data source of the spoof packet. The data packet size is not less than 5k, and an identification tag Q1 is added to the spoof packet.

[0043] If the data packet size is abnormal, the historical abnormal communication data is selected as the data source of the spoofing packet. The size of the data packet is not less than 10k, and an identification tag Q2 is added to the spoofing data packet;

[0044] If the data content format or encoding is abnormal, the data in the error output data set is selected as the data source of the spoofing packet. The size of the data packet is not less than 5k, and the label Q3 is added to the spoofing data packet;

[0045] The IP address information and data request information of the network terminal that generates the abnormal access time are obtained, and a corresponding spoofed data packet is sent to the corresponding IP address information.

[0046] Also includes:

[0047] Obtain the index of the backdoor feature of the data generation model; monitor abnormal network access events in real time, and isolate the data generation model with the backdoor after the abnormal access event ends.

[0048] Preferably, the real-time monitoring of the access records of the misleading database and triggering an alarm when it is detected that the misleading database is accessed include:

[0049] Obtain network access logs to determine whether any abnormal access events have occurred;

[0050] If not, check for unusual query patterns, access from unknown or suspicious IP addresses, and data operations that do not conform to normal business logic;

[0051] If not, check whether the network system has been implanted with a backdoor, specifically by checking the integrity of system files, checking processes, and analyzing network traffic;

[0052] If no abnormality occurs after the above checks, it is judged that the misleading database is abnormally accessed by the data generation model, and the isolation of the data generation model with a backdoor is abnormal;

[0053] Generate an alarm message to notify technicians to take physical isolation measures.

[0054] The present invention also provides a network intelligence threat countermeasure system, wherein the system is used to execute the network intelligence threat countermeasure method.

[0055] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the network intelligence threat countermeasure method.

[0056] Beneficial effects of the present invention:

[0057] 1. The present invention uses adversarial sample technology to generate input data that can deceive the data generation model, implants a backdoor in the data generation model training phase, causes the data generation model to generate erroneous output under specific input, and uses the erroneous output data as the data source for deceiving data packets. The generated data packets are made more concealed and more standardized, conform to the format of normal data, and are not easily identified by network attackers. At the same time, the erroneous output of the data generation model is predictable, so the data generation model itself has the ability to resist external attacks, and is more robust when dealing with attacks on the data generation model itself.

[0058] 2. The present invention monitors abnormal network access events in real time, and isolates the data generation model with the backdoor after the abnormal access event ends, thereby preventing the data generation model with the backdoor from being abnormally called. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 The present invention is a flowchart of a method for countering network intelligence threats. DETAILED DESCRIPTION

[0060] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art can think of other obvious variations. The basic principles of the present invention defined in the following description can be applied to other embodiments, variations, improvements, equivalents, and other technical solutions that do not deviate from the spirit and scope of the present invention.

[0061] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the element may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0062] refer to Figure 1 The technical solution provided by the present invention is: a method for countering network intelligence threats, comprising the following steps:

[0063] 1. Obtaining normal communication data and abnormal communication data of network terminals to form a communication terminal data set; including the following steps:

[0064] Obtain historical normal network normal communication data and abnormal communication data from the database;

[0065] Normal communication feature data is extracted from normal communication data to form a normal communication feature vector set A; abnormal communication feature data is extracted from abnormal communication data to form an abnormal communication feature vector set B. The normal communication feature set and the abnormal communication feature set are combined into a communication terminal data set.

[0066] 2. Use the pre-trained type recognition model to identify the abnormal type of communication data and generate the corresponding deception strategy; including the following steps:

[0067] 2.1. Obtain communication data in real time, which can be achieved by monitoring network ports or using API calls;

[0068] 2.2. Extract communication data features to form a real-time communication feature data sequence; for each received data packet, we need to extract the following features:

[0069] Transmission frequency: the number of packets transmitted per unit time. Time interval: the time difference between two consecutive packets. Packet size: the number of bytes in a packet. Content format and encoding: check whether the data conforms to the expected format and encoding standards.

[0070] 2.3. Input the preprocessed real-time communication feature data sequence into the type recognition model and output the abnormal type of communication data;

[0071] The communication data anomaly types include abnormal data packet transmission frequency, abnormal time interval between data packets, abnormal data packet size, and abnormal data content format or coding.

[0072] 2.4. Obtain the communication data anomaly type and generate corresponding strategy call instructions according to the communication data anomaly type;

[0073] 2.5. Construct a deception strategy table, which includes deception data packet generation rules matching different communication data anomaly types;

[0074] The spoof data packet generation rule includes the data source of the spoof data packet, the size of the spoof data packet and the identification tag of the spoof data packet.

[0075] 3. Obtain a data generation model, use adversarial sample technology to generate input data that can deceive the data generation model, implant a backdoor in the data generation model training phase, and make the data generation model produce erroneous output under specific input; the generated erroneous output constitutes an erroneous output data set; the data generation model is constructed based on the random forest algorithm.

[0076] Among them, using adversarial sample technology to generate input data that can deceive the data generation model includes the following steps:

[0077] Obtain normal communication data and abnormal communication data;

[0078] Calculate the gradient 1 of normal communication data and the gradient 2 of abnormal communication data; the gradient 1 is the gradient of the loss function of the normal communication data relative to the data generation model; the gradient 2 is the gradient of the abnormal communication data relative to the data generation model function;

[0079] Set the perturbation factor to one and disturbance factor 2 ;

[0080] According to the gradient Add disturbances to normal communication data. ;in, is the gradient of normal communication data;

[0081] According to the gradient Add disturbance 2 to abnormal communication data ;in, is the gradient of abnormal communication data;

[0082] The normal communication data with perturbation one added and the abnormal communication data with perturbation two added are combined to generate adversarial sample data.

[0083] Among them, a backdoor is implanted in the data generation model training stage to make the data generation model produce erroneous output under specific input, including the following steps:

[0084] Obtain normal communication feature vector set A, abnormal communication feature vector set B and adversarial sample data;

[0085] Select a portion of the anti-sample data as a trigger, and activate the backdoor through the trigger; and add an original identification tag to the selected portion of the data;

[0086] When training the data generation model, the original identification label corresponding to the trigger is modified to an incorrect label, so that when the data generation model recognizes the trigger during the training process, it learns an incorrect mapping relationship;

[0087] Use the data with wrong labels to train the data generation model to learn the association between triggers and wrong labels;

[0088] By selecting different trigger data from A and B respectively to test the data generation model, it is ensured that the data generation model produces incorrect output under specific trigger data input.

[0089] 4. According to the deception strategy, a corresponding deception data packet is generated based on the data in the error output data set, and the deception data packet is sent to the network terminal where the abnormal access event occurs; including the following steps:

[0090] Get the deception strategy table and strategy call instruction; the deception strategy table is shown in Table 1;

[0091] Get the spoofed data packet generation rules according to the policy call instructions;

[0092] If the data packet transmission frequency is abnormal, the data in the error output data set is selected as the data source of the spoofing packet through the policy call instruction 1. The data packet size is not less than 5k, and an identification tag Q1 is added to the spoofing data packet;

[0093] If the size of the data packet is abnormal, the historical abnormal communication data is selected as the data source of the spoofing packet through the policy call instruction 2. The size of the data packet is not less than 10k, and an identification tag Q2 is added to the spoofing data packet;

[0094] If the data content format or encoding is abnormal, the data in the error output data set is selected as the data source of the spoofing packet through the strategy call instruction three. The size of the data packet is not less than 5k, and the label Q3 is added to the spoofing data packet; the IP address information and data request information of the network terminal that generates the abnormal access time are obtained, and the corresponding spoofing data packet is sent to the corresponding IP address information.

[0095] In some preferred embodiments, the method further includes: obtaining an index of the backdoor feature of the data generation model; monitoring abnormal network access events in real time, and isolating the data generation model with the backdoor after the abnormal access event ends.

[0096] Table 1

[0097]

[0098] 5. Construct a misleading database with the same structure as the real database. The data generation model stores the deceptive data packets in the misleading database.

[0099] 6. Monitor the access records of the misleading database, and trigger an alarm when the misleading database is detected to be accessed. The following steps are included:

[0100] Obtain network access logs to determine whether any abnormal access events have occurred;

[0101] If not, check for unusual query patterns, access from unknown or suspicious IP addresses, and data operations that do not conform to normal business logic;

[0102] If not, check whether the network system has been implanted with a backdoor, specifically by checking the integrity of system files, checking processes, and analyzing network traffic;

[0103] If no abnormalities occur after the above checks, it is determined that the misleading database is abnormally accessed by the data generation model, and the isolation of the data generation model with a backdoor is abnormal; an alarm message is generated to notify the technical staff to take physical isolation measures.

[0104] The present invention also provides a network intelligence threat countermeasure system, wherein the system is used to execute the network intelligence threat countermeasure method.

[0105] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the network intelligence threat countermeasure method.

[0106] In the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. The embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part, and / or installed from a removable medium. When the computer program is executed by the central processing unit (CPU), the above functions defined in the method of the present application are executed. It should be noted that the computer-readable medium mentioned above in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wire segments, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, electrical wire, optical cable, RF, etc., or any suitable combination of the foregoing.

[0107] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0108] Those skilled in the art should understand that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The objectives of the present invention have been fully and effectively achieved. The functions and structural principles of the present invention have been demonstrated and explained in the embodiments. Without departing from the principles, the implementation methods of the present invention may be subject to any changes or modifications.

Claims

1. A method for countering network intelligence threats, characterized in that: The method comprises: Acquire normal communication data and abnormal communication data of network terminals to form a communication terminal data set; Use the pre-trained type recognition model to identify abnormal types of communication data and generate corresponding deception strategies; Obtain a data generation model and use adversarial sample technology to generate input data that can deceive the data generation model, including the following steps: Obtain normal communication data and abnormal communication data; Calculate the gradient 1 of normal communication data and the gradient 2 of abnormal communication data; the gradient 1 is the gradient of the loss function of the normal communication data relative to the data generation model; the gradient 2 is the gradient of the abnormal communication data relative to the data generation model function; Set the perturbation factor to one and disturbance factor 2 ; According to the gradient and adding disturbances to normal communication data ;in, is the gradient of normal communication data; According to the gradient and adding disturbances to abnormal communication data ;in, is the gradient of abnormal communication data; Combine the normal communication data with perturbation 1 and the abnormal communication data with perturbation 2 to generate adversarial sample data; A backdoor is implanted during the data generation model training phase, causing the data generation model to produce incorrect output under specific inputs, including the following steps: Obtain normal communication feature vector set A, abnormal communication feature vector set B and adversarial sample data; Select a portion of the anti-sample data as a trigger, and activate the backdoor through the trigger; and add an original identification tag to the selected portion of the data; When training the data generation model, the original identification label corresponding to the trigger is modified to an incorrect label, so that when the data generation model recognizes the trigger during the training process, it learns an incorrect mapping relationship; Use the data with wrong labels to train the data generation model to learn the association between triggers and wrong labels; By selecting different trigger data from A and B respectively to test the data generation model, it is ensured that the data generation model produces an erroneous output under a specific trigger data input; The generated error outputs constitute an error output data set; the data generation model is constructed based on a random forest algorithm; According to the deception strategy, a corresponding deception data packet is generated based on the data in the error output data set, and the deception data packet is sent to the network terminal where the abnormal access event occurs, including the following steps: Get the deception strategy table and strategy call instructions; Get the spoofed data packet generation rules according to the policy call instructions; If the data packet transmission frequency is abnormal, the data in the error output data set is selected as the data source of the spoof packet. The data packet size is not less than 5k, and an identification tag Q1 is added to the spoof packet. If the data packet size is abnormal, the historical abnormal communication data is selected as the data source of the spoofing packet. The size of the data packet is not less than 10k, and an identification tag Q2 is added to the spoofing data packet; If the data content format or encoding is abnormal, the data in the error output data set is selected as the data source of the spoofing packet. The size of the data packet is not less than 5k, and the label Q3 is added to the spoofing data packet; Acquire the IP address information and data request information of the network terminal that generates the abnormal access time, and send a corresponding spoofed data packet to the corresponding IP address information; Also includes: Get the index of the backdoor feature of the data generation model; Monitor abnormal network access events in real time, and isolate the data generation model with backdoors after the abnormal access event ends; Construct a misleading database with the same structure as the real database, and the data generation model stores the deceptive data packets in the misleading database; Monitor the access records of the misleading database, and trigger an alarm when it is detected that the misleading database is accessed.

2. A network intelligence threat countermeasure method according to claim 1, characterized in that: The obtaining of normal communication data and abnormal communication data of the network terminal to form a communication terminal data set includes: Obtain historical normal network normal communication data and abnormal communication data from the database; Extract normal communication feature data from normal communication data to form a normal communication feature vector set A; Extract abnormal communication feature data from the abnormal communication data to form an abnormal communication feature vector set B; The normal communication feature set and the abnormal communication feature set are combined into a communication terminal data set.

3. A network intelligence threat countermeasure method according to claim 2, characterized in that: The method of using the pre-trained type recognition model to identify the abnormal type of communication data includes the following steps: Acquire communication data in real time, extract communication data features, and form a real-time communication feature data sequence; Input the preprocessed real-time communication feature data sequence into the type recognition model, and output the abnormal type of communication data; The communication data anomaly types include abnormal data packet transmission frequency, abnormal time interval between data packets, abnormal data packet size, and abnormal data content format or coding.

4. A network intelligence threat countermeasure method according to claim 3, characterized in that: Said Generate corresponding deception strategies, including: Obtain the communication data anomaly type, and generate corresponding strategy call instructions according to the communication data anomaly type; Constructing a deception strategy table, wherein the deception strategy table includes deception data packet generation rules matching different communication data anomaly types; The spoof data packet generation rule includes the data source of the spoof data packet, the size of the spoof data packet and the identification tag of the spoof data packet.

5. A network intelligence threat countermeasure method according to claim 4, characterized in that: The real-time monitoring of the access records of the misleading database and triggering an alarm when it is detected that the misleading database is accessed include: Obtain network access logs to determine whether any abnormal access events have occurred; If not, check for unusual query patterns, access from unknown or suspicious IP addresses, and data operations that do not conform to normal business logic; If not, check whether the network system has been implanted with a backdoor, specifically by: checking the integrity of system files, checking processes, and analyzing network traffic; If no abnormality occurs after the above checks, it is judged that the misleading database is abnormally accessed by the data generation model, and the isolation of the data generation model with a backdoor is abnormal; Generate an alarm message to notify technicians to take physical isolation measures.

6. A network intelligence threat countermeasure system, characterized in that: The system is used to execute a network intelligence threat countermeasure method as described in any one of claims 1-5 above.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement a network intelligence threat countermeasure method as described in any one of claims 1 to 5.

Images