Intelligent management method and system for network attack blacklist

Abstract

The invention provides an intelligent management method and system for a network attack blacklist, and relates to the technical field of network blacklists, and the method comprises the steps: carrying out the threat level evaluation of attack data through building a multi-level network attack feature library in combination with a decision tree and a dual-channel neural network model; implementing a differentiated blacklist strategy on the IP address according to the threat level; threat detection is carried out by adopting a distributed edge node network, and intelligent sharing and updating of a blacklist are realized by utilizing deep learning, a graph neural network and federal learning. According to the invention, accurate identification and dynamic protection of network attacks can be realized, the intelligent level of blacklist management is improved, and the network security protection effect is enhanced.

Description

Technical Field

[0001] The present invention relates to network blacklist technology, and in particular to an intelligent management method and system for a network attack blacklist. Background Art

[0002] With the rapid development of Internet technology and the increasing popularity of network applications, the network security situation is becoming increasingly severe, and network attacks are becoming more diverse, intelligent, and continuous. As an important means of network security protection, network attack blacklists protect network system security by identifying and blocking malicious IP addresses. However, in the face of the ever-evolving forms of network attacks and attackers' evasion techniques, traditional blacklist management methods can no longer meet the current needs of network security protection.

[0003] The existing network attack blacklist management technology has the following main deficiencies: First, the blacklist update mechanism is relatively simple, and it is impossible to make real-time adjustments according to the dynamic changes of attack behaviors, resulting in delayed protection effects; second, the threat assessment method is too single, lacking multi-dimensional analysis and in-depth mining of attack characteristics, making it difficult to accurately identify complex attack behaviors; third, blacklist management lacks a coordination mechanism, and insufficient information sharing between protection nodes, making it impossible to form a unified threat intelligence system, reducing the overall protection effect.

[0004] The present invention aims to solve the technical problems in the intelligent management of network attack blacklists. Specifically, by establishing a multi-level network attack feature library and combining machine learning and deep learning technologies, accurate identification of attack behaviors and dynamic assessment of threat levels can be achieved; at the same time, a distributed edge node network and federated learning methods are used to build an intelligent blacklist sharing mechanism, improve the accuracy and real-time performance of network attack protection, and form a more efficient network security protection system. Summary of the invention

[0005] The embodiments of the present invention provide an intelligent management method and system for a network attack blacklist, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention, Provides intelligent management methods for network attack blacklists, including: Establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receive network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; perform feature matching between the attack data and the features in the network attack feature library; Based on the result of the feature matching, a machine learning model is used to evaluate the threat level of the attack data, and the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform preliminary classification of the attack data, and the dual-channel neural network model is used to perform in-depth analysis based on the preliminary classification result to obtain a deep analysis result, and the threat level of the attack is comprehensively evaluated based on the preliminary classification result, the deep analysis result, and the impact weights corresponding to the historical attack behavior, and a threat level evaluation record is established; according to the threat level evaluation record, the threat level of the attack source IP address is determined, and the attack source IP address is classified into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; Different blacklist validity periods and blocking strategies are set for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, respectively, where the validity period of high-risk IP addresses is permanent blocking, the validity period of medium-risk IP addresses is 30 days, and the validity period of low-risk IP addresses is 7 days; the network behavior of IP addresses of each threat level is dynamically monitored, and when changes in the attack behavior of the IP address are detected, the threat level is re-evaluated and the blacklist strategy is updated; a blacklist sharing mechanism is established, local threat detection and data collection are performed through a distributed edge node network, deep learning and graph neural networks are used to perform threat association analysis to form IP groups, and model collaborative optimization between nodes is achieved based on federated learning, and differentiated distribution strategies are used to complete real-time updating and synchronization of the blacklist.

[0007] Matching the attack data with features in the network attack feature library includes: Construct a multi-level network attack feature library, which includes a basic layer, a behavior layer, a time series feature layer and a target association layer; the basic layer uses a prefix tree structure to store attack source IP address information, and the attack source IP address information includes IP address reputation score, geographical location distribution information and organizational affiliation information; the behavior layer uses a state transition diagram to store attack type information and attack behavior feature information; the time series feature layer records attack frequency information and attack time feature information through a sliding time window; the target association layer uses a graph database to store attack target information; A multi-threaded parallel processing architecture is used to collect network traffic data, and the network traffic data is subjected to protocol analysis to obtain original feature data; regularization processing is used to clean the original feature data; a sliding window mechanism is used to convert the network behavior sequence into a feature sequence to obtain a standardized feature vector; a Bloom filter is used to quickly pre-match the standardized feature vector to filter out the data to be analyzed; and the Knuth-Morris-Pratt algorithm is used to perform accurate feature matching on the data to be analyzed.

[0008] Using the Knuth-Morris-Pratt algorithm to accurately match the features of the data to be analyzed includes: Receive data to be matched, calculate characteristic entropy values ​​of characteristic patterns, select the most discriminative character positions as fast filtering points based on the characteristic entropy values, and establish a filtering point lookup table; pre-filter the data to be matched based on the filtering point lookup table to obtain pre-filtered data; Constructing a feature index for the pre-filtered data, performing first-level grouping of feature patterns based on feature length to obtain feature groups, and using a dictionary tree structure to merge and store feature patterns with a common prefix in the feature groups to form a secondary index, thereby obtaining a two-level feature index structure; Analyzing the prefix-suffix matching relationship of the feature pattern in the two-level feature index structure and the repetitive pattern of the intermediate character sequence, identifying the periodic subsequence in the feature pattern, and constructing a bidirectionally extended partial matching table based on the periodic subsequence; Dividing the pre-filtered data into blocks according to the width of a single instruction multiple data register to obtain data blocks, performing parallel character comparison on the data blocks, recording mismatch positions and mismatch patterns in the matching process, and establishing a multi-level mismatch cache of mismatch patterns and optimal jump positions; Analyzing the distribution characteristics of the characters before and after the current matching position based on the multi-level mismatch cache, using a machine learning method to predict the next potential matching point position, and dynamically updating the jump distance in the partial matching table according to the potential matching point position; During the matching process, a sliding matching window is dynamically maintained based on the length of the feature pattern, and feature distribution information within the sliding matching window is recorded; when the pre-filtered data crosses a data packet boundary, partial matching state information within the sliding matching window is saved; and continuous matching of cross-packet features is achieved based on the partial matching state information.

[0009] Based on the result of the feature matching, a machine learning model is used to evaluate the threat level of the attack data. The machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform preliminary classification of the attack data, and the dual-channel neural network model is used to perform in-depth analysis according to the preliminary classification result to obtain a deep analysis result. Based on the preliminary classification result, the deep analysis result, and the impact weight corresponding to the historical attack behavior, the threat level of the attack is comprehensively evaluated, and the establishment of a threat level assessment record includes: Receive feature matching results, extract attack feature frequency, time series features, and behavior features to construct a multidimensional feature vector, perform standardization on the multidimensional feature vector to obtain a standardized feature, and perform dimensionality reduction on the standardized feature using a principal component analysis method to obtain a reduced dimensionality feature; A multi-layer decision tree model is constructed based on the dimensionality reduction features, the Gini coefficient is used for feature selection, a dynamic split threshold mechanism is introduced to split the decision tree nodes, misclassified samples are recorded to form an misclassified sample library, and the decision tree model is optimized and trained based on the sample weights in the misclassified sample library; Constructing a dual-channel neural network model, wherein the temporal channel of the dual-channel neural network model uses a long short-term memory network to process the temporal features in the dimensionality reduction features, and the spatial channel uses a convolutional neural network to process the spatial features in the dimensionality reduction features, and the outputs of the temporal channel and the spatial channel are feature fused through an attention mechanism; Performing preliminary classification of the attack data based on the decision tree model to obtain preliminary classification results, calculating the confidence of the preliminary classification results, and when the confidence is lower than a preset threshold, inputting the corresponding attack data into the dual-channel neural network model for in-depth analysis to obtain in-depth analysis results; Record the historical attack behaviors of the attack source, and use the time decay function to calculate the impact weight of the historical attack behaviors; comprehensively evaluate the threat level of the attack based on the preliminary classification result, the in-depth analysis result, and the impact weight, and establish a threat level evaluation record.

[0010] Determining the threat level of the attack source IP address according to the threat level assessment result, and classifying the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold includes: Use sliding time windows to extract the time series features of IP addresses, calculate the first appearance time, activity duration, and activity frequency distribution of IP addresses to form time series feature vectors, extract the port scanning behavior, connection establishment mode, and data transmission mode of IP addresses to form behavior sequence features, and collect the geographical distribution, AS number distribution, and subnet distribution of IP addresses to form spatial attribute features; Constructing an attention feature fusion network, the attention feature fusion network includes a time feature extraction branch, a behavior feature extraction branch, and a space feature extraction branch, each feature extraction branch extracts feature representations through an independent feature extractor, calculates the importance weight of each feature representation through an attention layer, and fuses the weighted feature representations to form a unified feature vector; The IP addresses are constructed as graph network nodes, the unified feature vector is used as the attribute of the graph network node, the edge weight of the graph network is constructed based on the similarity between the IP addresses, the graph convolution network is used to perform message transmission and feature aggregation on the graph network nodes, the final representation of the node is obtained through multi-layer graph convolution operations, and the final representation of the node is mapped to a threat score through a fully connected layer; Based on the statistical analysis of historical data, the initial high-risk threshold and low-risk threshold are determined, and the IP addresses whose threat scores exceed the high-risk threshold are classified as high-risk IP addresses, the IP addresses whose threat scores are lower than the low-risk threshold are classified as low-risk IP addresses, and the IP addresses whose threat scores are between the high-risk threshold and the low-risk threshold are classified as medium-risk IP addresses.

[0011] Establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, achieve model collaborative optimization between nodes based on federated learning, and use differentiated distribution strategies to complete real-time update and synchronization of blacklists, including: Build a distributed edge node network and divide network security equipment into central control nodes and edge execution nodes. The central control node is responsible for global policy formulation and data collaboration, while the edge execution node is responsible for local data collection and threat detection. The edge execution node collects local network traffic and security logs, analyzes traffic characteristics through pre-trained deep learning models, identifies abnormal behaviors and potential threats, and generates a threat report containing threat IP addresses, behavior characteristics, and degree of harm; The central control node receives threat reports uploaded by each edge execution node, uses a graph neural network to build a threat correlation analysis model, clusters threat IP addresses with similar behavior characteristics or associated traffic to form threat IP address groups, and determines the blacklist level based on group characteristics; Differentiated distribution strategies are adopted according to the blacklist level. For high-risk IP groups, update instructions are sent to all edge execution nodes through real-time push channels. For low-risk IP groups, batch synchronization is used to push during network idle time. After receiving the blacklist update instruction, the edge execution node stores the threat IP group information in the local cache, continuously optimizes the local threat detection model based on the reinforcement learning algorithm, updates the model parameters through online learning, and improves the accuracy of threat identification; The central control node periodically collects the model optimization results of each edge execution node, aggregates the model parameters using the federated learning framework, generates an optimized global model and distributes it to each edge execution node, thereby achieving continuous evolution of threat detection capabilities.

[0012] According to a second aspect of the embodiments of the present invention, Provides an intelligent management system for network attack blacklists, including: The first unit is used to establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receiving network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; performing feature matching between the attack data and features in the network attack feature library; The second unit is used to use a machine learning model to perform a threat level assessment on the attack data based on the result of the feature matching, and the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform a preliminary classification of the attack data, and the dual-channel neural network model is used to perform a deep analysis based on the preliminary classification result to obtain a deep analysis result, and comprehensively assess the threat level of the attack based on the preliminary classification result, the deep analysis result, and the impact weights corresponding to the historical attack behavior, and establish a threat level assessment record; determine the threat level of the attack source IP address according to the threat level assessment record, and classify the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; The third unit is used to set different blacklist validity periods and ban policies for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, respectively, where the validity period of the high-risk IP address is permanent ban, the validity period of the medium-risk IP address is 30 days, and the validity period of the low-risk IP address is 7 days; dynamically monitor the network behavior of IP addresses of each threat level, and when it is detected that the attack behavior of the IP address has changed, re-evaluate the threat level and update the blacklist policy; establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, realize model collaborative optimization between nodes based on federated learning, and adopt differentiated distribution strategies to complete real-time update and synchronization of the blacklist.

[0013] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0014] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0015] The beneficial effects of this application are as follows: 1. Improve the accuracy and effectiveness of network attack blacklist management: Combination of multi-level feature library and machine learning model: Through the multi-level network attack feature library, the attack is comprehensively characterized from multiple dimensions such as basic behavior, timing characteristics and target association. Combining the decision tree and dual-channel neural network model for threat level assessment can more accurately identify and distinguish different types of attacks, avoid misjudgment and missed judgment, and thus improve the accuracy of blacklist management.

[0016] Dynamic threat level assessment and hierarchical management: Reassess the threat level and update the blacklist strategy based on the dynamic changes in attack behavior to achieve refined management of attack source IPs, avoid "one-size-fits-all" bans, and improve the effectiveness of blacklist management.

[0017] Differentiated blocking strategies based on threat levels: Setting different validity periods and blocking strategies for IP addresses of different threat levels can effectively control risks and minimize the impact on normal network access while ensuring security.

[0018] 2. Enhance the initiative and adaptability of network security defense: Real-time threat detection and dynamic update: Real-time collection of network traffic data and feature matching and threat level assessment can promptly detect new attack behaviors and dynamically update blacklist policies to enhance the proactiveness of network security defense.

[0019] Application of machine learning models: Using machine learning models to assess threat levels can continuously optimize the model based on historical attack behaviors and the latest attack trends, improve the ability to identify new types of attacks, and enhance the adaptability of network security defense.

[0020] 3. Achieve coordination and efficiency in blacklist management: Distributed edge node network and federated learning: Local threat detection and data collection are carried out through a distributed edge node network, and federated learning is used to achieve model collaborative optimization among nodes, which can aggregate security intelligence from multiple parties and improve the efficiency and accuracy of threat detection.

[0021] IP group association analysis and differentiated distribution strategy: Threat association analysis is performed through deep learning and graph neural networks to form IP groups, and differentiated distribution strategies are used to complete real-time updates and synchronization of blacklists, which can quickly disseminate the latest threat intelligence and improve the coordination and efficiency of blacklist management. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of a flow chart of an intelligent management method for a network attack blacklist according to an embodiment of the present invention; Figure 2The figure is a schematic diagram of the structure of the intelligent management system of the network attack blacklist according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0025] Figure 1 FIG. 1 is a flow chart of an intelligent management method for a network attack blacklist according to an embodiment of the present invention. Figure 1 As shown, the method includes: S11. Establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receive network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; perform feature matching on the attack data with the features in the network attack feature library; S12. Based on the result of the feature matching, a machine learning model is used to perform a threat level assessment on the attack data, the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform a preliminary classification of the attack data, and the dual-channel neural network model is used to perform a deep analysis based on the preliminary classification result to obtain a deep analysis result, and based on the preliminary classification result, the deep analysis result, and the impact weight corresponding to the historical attack behavior, the threat level of the attack is comprehensively assessed, and a threat level assessment record is established; based on the threat level assessment record, the threat level of the attack source IP address is determined, and the attack source IP address is classified into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; S13. Set different blacklist validity periods and blocking strategies for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, respectively, where the validity period of high-risk IP addresses is permanent blocking, the validity period of medium-risk IP addresses is 30 days, and the validity period of low-risk IP addresses is 7 days; dynamically monitor the network behavior of IP addresses of each threat level, and when changes in the attack behavior of the IP address are detected, re-evaluate the threat level and update the blacklist strategy; establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, realize model collaborative optimization between nodes based on federated learning, and adopt differentiated distribution strategies to complete real-time update and synchronization of the blacklist.

[0026] First, a multi-level network attack feature library is constructed. The feature library is divided into four levels: basic layer, behavior layer, time series feature layer and target association layer.

[0027] The base layer stores basic network attack features, such as known malicious IP addresses, domain names, URLs, virus signatures, etc. The behavior layer records various network attack behavior patterns, such as port scanning, brute force cracking, SQL injection, cross-site scripting attacks, etc. The timing feature layer captures the timing relationship of attack behaviors, such as a large number of connection attempts in a short period of time, a specific sequence of requests, etc. The target association layer records the association between the attack target and the attack source, such as the attacker's attack behavior against a specific server or service.

[0028] Network security equipment (such as firewalls, intrusion detection systems, network traffic analyzers, etc.) collects network traffic data in real time. This data includes attack source IP address information, data packet feature information (such as protocol type, port number, data packet size, etc.), network behavior feature information (such as number of connections, connection duration, data transmission volume, etc.), and attack target information (such as target IP address, target port, target service, etc.).

[0029] The collected attack data is matched with the features in the network attack feature library. The matching process can adopt a variety of technologies, such as string matching, regular expression matching, hash matching, etc.

[0030] A machine learning model is used to assess the threat level of attack data. First, a decision tree model is used to preliminarily classify attack data and classify attack behaviors into different categories, such as scanning attacks, denial of service attacks, vulnerability exploitation attacks, etc. Then, based on the preliminary classification results, a dual-channel neural network model is used for in-depth analysis. One channel analyzes the static features of attack data (such as attack source IP address, target port, etc.), and the other channel analyzes the dynamic features of attack data (such as number of connections, data transmission volume, etc.). The dual-channel neural network model outputs in-depth analysis results, combines the preliminary classification results and the impact weights corresponding to historical attack behaviors (such as the number of successful attacks, the losses caused, etc.), and comprehensively assesses the threat level of the attack. The assessment results are recorded in the threat level assessment record.

[0031] Determine the threat level of the attack source IP address based on the threat level assessment record. According to the preset threat level threshold, the attack source IP address is classified into high-risk IP addresses, medium-risk IP addresses, and low-risk IP addresses. For example, IP addresses with a threat level higher than 0.8 are marked as high-risk, those between 0.5 and 0.8 are marked as medium-risk, and those below 0.5 are marked as low-risk.

[0032] Set different blacklist validity periods and ban policies for IP addresses of different threat levels. High-risk IP addresses are permanently banned, medium-risk IP addresses are banned for 30 days, and low-risk IP addresses are banned for 7 days.

[0033] Dynamically monitor the network behavior of IP addresses at different threat levels. When changes are detected in the attack behavior of an IP address, re-evaluate the threat level and update the blacklist policy. For example, if an IP address that was originally marked as low-risk suddenly initiates a large number of connection attempts, the system will re-evaluate its threat level and may upgrade it to medium or high risk.

[0034] Establish a blacklist sharing mechanism. Perform local threat detection and data collection through a distributed edge node network. Use deep learning and graph neural networks to perform threat association analysis and form IP groups. For example, if multiple IP addresses are found to share the same attack characteristics or attack targets, these IP addresses are grouped into one group. Based on federated learning, achieve collaborative optimization of models between nodes, share model parameter updates without sharing original data, and improve overall threat detection capabilities. And use differentiated distribution strategies to complete real-time updates and synchronization of blacklists. For example, synchronize the high-risk IP address blacklist to all edge nodes, and synchronize the low-risk IP address blacklist only to the affected nodes.

[0035] Case: Assume that an IP address attempts to connect to multiple ports in a short period of time, and these ports are all known vulnerable ports. The system collects the attack data of the IP address and matches it with the feature library. The matching result shows that the behavior of the IP address meets the port scanning characteristics. The decision tree model preliminarily classifies it as a scanning attack. The dual-channel neural network model analyzes the dynamic characteristics of the IP address, such as the number of connections and connection frequency, as well as the static characteristics such as the target port, to obtain in-depth analysis results. Combined with the impact weight of historical attack behaviors, the system evaluates the threat level of the IP address to 0.9, marks it as a high-risk IP address, and permanently bans it.

[0036] The beneficial effects of this method can be summarized in the following three aspects: 1. Improved the accuracy and efficiency of network attack detection. The multi-level feature library and machine learning model can more effectively identify various types of network attacks and reduce false positives and false negatives.

[0037] 2. Intelligent blacklist management is realized. The blacklist strategy is dynamically adjusted according to the threat level, avoiding the rigidity and inefficiency of traditional blacklist management methods.

[0038] 3. Enhanced the synergy of network security defense. The blacklist sharing mechanism and federated learning technology enable each edge node to share threat intelligence and model parameters to form a collaborative defense system.

[0039] In an optional implementation, performing feature matching on the attack data and features in the network attack feature library includes: Construct a multi-level network attack feature library, which includes a basic layer, a behavior layer, a time series feature layer and a target association layer; the basic layer uses a prefix tree structure to store attack source IP address information, and the attack source IP address information includes IP address reputation score, geographical location distribution information and organizational affiliation information; the behavior layer uses a state transition diagram to store attack type information and attack behavior feature information; the time series feature layer records attack frequency information and attack time feature information through a sliding time window; the target association layer uses a graph database to store attack target information; A multi-threaded parallel processing architecture is used to collect network traffic data, and the network traffic data is subjected to protocol analysis to obtain original feature data; regularization processing is used to clean the original feature data; a sliding window mechanism is used to convert the network behavior sequence into a feature sequence to obtain a standardized feature vector; a Bloom filter is used to quickly pre-match the standardized feature vector to filter out the data to be analyzed; and the Knuth-Morris-Pratt algorithm is used to perform accurate feature matching on the data to be analyzed.

[0040] In order to achieve efficient network attack detection, this embodiment provides a network attack feature matching method based on a multi-level feature library. The method constructs a network attack feature library including a basic layer, a behavior layer, a timing feature layer, and a target association layer, and adopts multi-threaded parallel processing, data cleaning, feature vector conversion, Bloom filter pre-matching, and precise feature matching to achieve rapid and accurate identification of network attacks.

[0041] First, a multi-level network attack feature library is constructed. The basic layer uses a prefix tree structure to store attack source IP address information, including IP address reputation score, geographic location distribution information, and organizational affiliation information. For example, the reputation score of IP address 203.0.113.1 is 0.8, the geographic location is Beijing, China, and the organizational affiliation is a certain network service provider. The behavior layer uses a state transition graph to store attack type information and attack behavior feature information. For example, the state transition graph of SQL injection attack contains state nodes such as "connect to database", "input malicious SQL statement", "execute SQL statement" and the transition relationship between states. The time series feature layer records attack frequency information and attack time feature information through a sliding time window. For example, in the past 5 minutes, a certain IP address initiated 100 access requests, and the access time was concentrated between 2 am and 3 am. The target association layer uses a graph database to store attack target information, for example, there is a data interaction relationship between server A and server B.

[0042] Next, collect network traffic data and perform preprocessing. Use a multi-threaded parallel processing architecture to collect network traffic data, and perform protocol parsing on the collected network traffic data to extract original feature data, such as source IP address, destination IP address, port number, protocol type, etc. Then, use regularization processing to clean the original feature data, such as removing invalid characters and formatting data. For example, convert the IP address "203.0.113.001" to the standard format "203.0.113.1". Subsequently, use a sliding window mechanism to convert the network behavior sequence into a feature sequence to obtain a standardized feature vector. For example, convert the network access behavior sequence in the past 1 minute into a feature vector containing information such as the number of visits and the time interval between visits.

[0043] Then, feature matching is performed. The standardized feature vectors are quickly pre-matched using a Bloom filter to filter out the data to be analyzed. For example, the feature vector is compared with the known attack features in the Bloom filter. If the match is successful, the feature vector is marked as the data to be analyzed. Finally, the Knuth-Morris-Pratt algorithm is used to accurately match the features of the data to be analyzed. For example, the data to be analyzed is compared one by one with the features in the multi-level network attack feature library. If the match is successful, it is determined to be a network attack. For example, if the source IP address of the data to be analyzed is 203.0.113.1, and the reputation score of the IP address in the base layer is lower than 0.5, the data is determined to be at risk of attack.

[0044] The beneficial effects of this method can be summarized in the following three aspects: 1. Improve detection efficiency: The multi-level feature library and Bloom filter pre-matching mechanism can quickly screen out potential attack data, reducing the amount of calculation for precise matching, thereby improving detection efficiency.

[0045] 2. Improve detection accuracy: The multi-level feature library contains rich attack feature information, which can more accurately identify various types of network attacks, thereby improving detection accuracy.

[0046] 3. Enhance system scalability: The design of the multi-level feature library makes the system easy to expand and new attack features can be easily added, thereby enhancing the scalability of the system.

[0047] In an optional implementation, using the Knuth-Morris-Pratt algorithm to perform accurate feature matching on the data to be analyzed includes: Receive data to be matched, calculate characteristic entropy values ​​of characteristic patterns, select the most discriminative character positions as fast filtering points based on the characteristic entropy values, and establish a filtering point lookup table; pre-filter the data to be matched based on the filtering point lookup table to obtain pre-filtered data; Constructing a feature index for the pre-filtered data, performing first-level grouping of feature patterns based on feature length to obtain feature groups, and using a dictionary tree structure to merge and store feature patterns with a common prefix in the feature groups to form a secondary index, thereby obtaining a two-level feature index structure; Analyzing the prefix-suffix matching relationship of the feature pattern in the two-level feature index structure and the repetitive pattern of the intermediate character sequence, identifying the periodic subsequence in the feature pattern, and constructing a bidirectionally extended partial matching table based on the periodic subsequence; Dividing the pre-filtered data into blocks according to the width of a single instruction multiple data register to obtain data blocks, performing parallel character comparison on the data blocks, recording mismatch positions and mismatch patterns in the matching process, and establishing a multi-level mismatch cache of mismatch patterns and optimal jump positions; Analyzing the distribution characteristics of the characters before and after the current matching position based on the multi-level mismatch cache, using a machine learning method to predict the next potential matching point position, and dynamically updating the jump distance in the partial matching table according to the potential matching point position; During the matching process, a sliding matching window is dynamically maintained based on the length of the feature pattern, and feature distribution information within the sliding matching window is recorded; when the pre-filtered data crosses a data packet boundary, partial matching state information within the sliding matching window is saved; and continuous matching of cross-packet features is achieved based on the partial matching state information.

[0048] Receive the data to be matched, such as a text "abcabcabcabdabcabc". Calculate the characteristic entropy value of the characteristic pattern. For example, the characteristic pattern is "abc", and the frequency of each character is counted. A appears 5 times, B appears 5 times, C appears 5 times, and D appears 1 time, for a total of 16 characters. The characteristic entropy value is calculated using the logarithmic weighted sum of the probability of occurrence of each character. The probability of occurrence of a, b, and c is 5 / 16, and the probability of occurrence of d is 1 / 16. Based on the characteristic entropy value, the most discriminative character position is selected as the quick filtering point. For example, d is selected as the quick filtering point because it has the lowest entropy value, which means it is the most discriminative. Establish a filter point lookup table to record the position of d in the data to be matched, for example, d is at the 10th position.

[0049] Pre-filter the matching data based on the filter point lookup table to obtain pre-filtered data. Since d only appears once, the pre-filtered data is "abcabcabcabd". Construct a feature index for the pre-filtered data. The feature pattern "abc" has a length of 3. Perform the first-level grouping of feature patterns based on feature length. Group all feature patterns with a length of 3 into one group. Use a dictionary tree structure to merge and store feature patterns with a common prefix in the feature grouping to form a secondary index. For example, there is only one feature pattern "abc", so it is directly stored in the dictionary tree. Finally, a two-level feature index structure is obtained.

[0050] Analyze the prefix-suffix matching relationship of the feature pattern in the two-level feature index structure and the repetitive pattern of the intermediate character sequence. Identify the periodic subsequence in the feature pattern "abc". For example, "abc" itself is a periodic subsequence. Construct a bidirectional extended partial matching table based on the periodic subsequence "abc". The partial matching table records the length of the longest common prefix and suffix of each prefix of the pattern string. For example, the longest common prefix and suffix length of "a" is 0, the longest common prefix and suffix length of "ab" is 0, and the longest common prefix and suffix length of "abc" is 0.

[0051] Divide the pre-filtered data "abcabcabcabd" into blocks according to the SIMD register width (assumed to be 4) to obtain data blocks "abca", "bcab", and "cabd". Perform parallel character comparison on the data blocks. For example, compare "abca" with "abc" and find a complete match. Record the mismatch position and mismatch pattern during the matching process. For example, compare "cabd" with "abc", and there is a mismatch at the third character, and the mismatch pattern is "d". Establish a multi-level mismatch cache of mismatch patterns and optimal jump positions. For example, when the mismatch pattern is "d", the optimal jump position is 3, because "abc" does not contain "d".

[0052] Analyze the distribution characteristics of the characters before and after the current matching position based on the multi-level mismatch cache. For example, the current matching position is the third character "d" of "cabd", the previous character is "c", and the next character is the end. Use machine learning methods (e.g., decision trees) to predict the next potential matching point position. Dynamically update the jump distance in the partial matching table based on the potential matching point position.

[0053] During the matching process, the sliding matching window is dynamically maintained based on the length (3) of the feature pattern "abc". The feature distribution information within the sliding matching window is recorded. When the pre-filtered data crosses the packet boundary, it is assumed that the pre-filtered data is divided into two packets "abca" and "bcabcabd". After processing the first packet "abca", the partial matching state information within the sliding matching window is saved, for example, "abc" has been matched. Continuous matching of cross-packet features is achieved based on the partial matching state information. When processing the second packet "bcabcabd", matching continues from the last saved state.

[0054] Beneficial effects:

[0055] 1. Improve matching efficiency: By selecting fast filtering points through feature entropy values, building a two-level feature index, and using partial matching tables and multi-level mismatch caches, the number of unnecessary character comparisons can be reduced, thereby improving matching speed.

[0056] 2. Enhance matching accuracy: By predicting potential matching points based on machine learning methods and dynamically updating partial matching tables, the matching accuracy can be improved and mismatches can be reduced.

[0057] 3. Support cross-packet matching: By saving and restoring partial matching state information, continuous matching across data packet boundaries can be achieved, which is suitable for scenarios such as network data flow.

[0058] In an optional implementation, based on the result of the feature matching, a machine learning model is used to evaluate the threat level of the attack data, and the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform preliminary classification of the attack data, and the dual-channel neural network model is used to perform in-depth analysis based on the preliminary classification results to obtain in-depth analysis results, and the threat level of the attack is comprehensively evaluated based on the preliminary classification results, the in-depth analysis results, and the impact weights corresponding to the historical attack behaviors, and establishing a threat level assessment record includes: Receive feature matching results, extract attack feature frequency, time series features, and behavior features to construct a multidimensional feature vector, perform standardization on the multidimensional feature vector to obtain a standardized feature, and perform dimensionality reduction on the standardized feature using a principal component analysis method to obtain a reduced dimensionality feature; A multi-layer decision tree model is constructed based on the dimensionality reduction features, the Gini coefficient is used for feature selection, a dynamic split threshold mechanism is introduced to split the decision tree nodes, misclassified samples are recorded to form an misclassified sample library, and the decision tree model is optimized and trained based on the sample weights in the misclassified sample library; Constructing a dual-channel neural network model, wherein the temporal channel of the dual-channel neural network model uses a long short-term memory network to process the temporal features in the dimensionality reduction features, and the spatial channel uses a convolutional neural network to process the spatial features in the dimensionality reduction features, and the outputs of the temporal channel and the spatial channel are feature fused through an attention mechanism; Performing preliminary classification of the attack data based on the decision tree model to obtain preliminary classification results, calculating the confidence of the preliminary classification results, and when the confidence is lower than a preset threshold, inputting the corresponding attack data into the dual-channel neural network model for in-depth analysis to obtain in-depth analysis results; Record the historical attack behaviors of the attack source, and use the time decay function to calculate the impact weight of the historical attack behaviors; comprehensively evaluate the threat level of the attack based on the preliminary classification result, the in-depth analysis result, and the impact weight, and establish a threat level evaluation record.

[0059] Get the attack data to be evaluated, which contains multiple features, such as source IP address, destination IP address, port number, protocol type, access frequency, access time, etc. For example, an attack data record is: source IP: 192.168.1.10, destination IP: 10.0.0.1, port number: 80, protocol type: TCP, access frequency: 100 times per second, access time: January 1, 2024 8:00.

[0060] The features extracted from the attack data are matched to obtain feature matching results. For example, the source IP 192.168.1.10 is identified as a known malicious IP, the destination port 80 is a common Web service port, and the access frequency of 100 times per second far exceeds the normal access frequency.

[0061] Based on the feature matching results, extract the attack feature frequency, timing features, and behavior features. For example, the attack feature frequency is 100 times per second, the timing feature is 8:00 on January 1, 2024, and the behavior feature is attempting to access the Web service. Construct these features into a multidimensional feature vector. For example, the vector can be expressed as [100, 202401010800, 1], where 1 represents an attempt to access the Web service.

[0062] The multi-dimensional feature vector is normalized. For example, the access frequency 100 is converted to a value between 0 and 1, and the time series feature is similarly converted. The normalized feature vector is, for example, [0.8, 0.5, 1].

[0063] The principal component analysis method is used to reduce the dimension of the standardized features. For example, the three-dimensional feature vector is reduced to a two-dimensional vector [0.6, 0.7].

[0064] Construct a multi-layer decision tree model based on dimensionality reduction features. For example, the first layer is divided according to whether the value of feature 1 is greater than 0.5, and the second layer is divided according to whether the value of feature 2 is greater than 0.6. Use the Gini coefficient for feature selection, for example, calculate the Gini coefficient of each feature, and select the feature with the smallest Gini coefficient as the split node. Introduce a dynamic split threshold mechanism to split the decision tree nodes, for example, dynamically adjust the split threshold according to the distribution of sample data instead of using a fixed threshold. Record misclassified samples in the misclassified sample library. For example, if the real threat level of a sample is high, but it is classified as low by the decision tree model, then the sample is added to the misclassified sample library. Optimize the training of the decision tree model according to the sample weights in the misclassified sample library. For example, increase the weight of the misclassified sample so that it gets more attention in the next training.

[0065] Construct a dual-channel neural network model. The temporal channel uses a long short-term memory network (LSTM) to process the temporal features in the dimensionality reduction features. For example, the temporal feature sequence is input into the LSTM network for processing. The spatial channel uses a convolutional neural network (CNN) to process the spatial features in the dimensionality reduction features. For example, the spatial features are converted into a two-dimensional matrix and then the CNN network is used to extract features. The outputs of the temporal channel and the spatial channel are fused through the attention mechanism. For example, weights are dynamically assigned according to the importance of the temporal features and the spatial features, and they are fused into a final feature vector.

[0066] Use the decision tree model to preliminarily classify the attack data, obtain the preliminary classification results, and calculate the confidence. For example, the decision tree model classifies the attack data as a medium-level threat with a confidence of 0.8. Set the preset threshold to 0.7. Since the confidence of 0.8 is greater than the preset threshold of 0.7, the classification result of the decision tree model is directly used.

[0067] If the confidence level is lower than a preset threshold, such as 0.6, the corresponding attack data is input into the dual-channel neural network model for deep analysis to obtain a deep analysis result. For example, the dual-channel neural network model classifies the attack data as a high-level threat.

[0068] Record the historical attack behaviors of the attack source. For example, record the attack source IP address, attack times, attack time and other information. Use the time decay function to calculate the impact weight of the historical attack behaviors. For example, the most recent attack behaviors have a higher weight, and the earlier attack behaviors have a lower weight.

[0069] Comprehensively evaluate the threat level of the attack based on the preliminary classification results (or in-depth analysis results) and impact weights. For example, if the preliminary classification result is a medium threat and the impact weight is 0.9, the final threat level is assessed as high. Create a threat level assessment record to record information such as attack data, classification results, confidence, impact weight, and final threat level.

[0070] The beneficial effects can be summarized into the following three parts: 1. Improve the accuracy of threat level assessment: Combining the preliminary classification of the decision tree model and the in-depth analysis of the dual-channel neural network model, the threat level of the attack can be assessed more accurately, especially for attack data with low confidence. The dual-channel neural network can provide more refined analysis results, thereby improving the accuracy of the overall assessment.

[0071] 2. Improve the efficiency of threat level assessment: The decision tree model can quickly perform preliminary classification of attack data. For attack data with high confidence, the preliminary classification results can be used directly, avoiding the complex in-depth analysis process, thereby improving the evaluation efficiency.

[0072] 3. Enhance the adaptability of the model: The dynamic split threshold mechanism and optimized training based on the misclassified sample library can make the decision tree model better adapt to new attack patterns. At the same time, the introduction of the time decay function also enables the model to better consider the impact of historical attack behaviors, thereby enhancing the adaptability of the model.

[0073] In an optional implementation, determining the threat level of the attack source IP address according to the threat level assessment result, and classifying the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold includes: Use sliding time windows to extract the time series features of IP addresses, calculate the first appearance time, activity duration, and activity frequency distribution of IP addresses to form time series feature vectors, extract the port scanning behavior, connection establishment mode, and data transmission mode of IP addresses to form behavior sequence features, and collect the geographical distribution, AS number distribution, and subnet distribution of IP addresses to form spatial attribute features; Constructing an attention feature fusion network, the attention feature fusion network includes a time feature extraction branch, a behavior feature extraction branch, and a space feature extraction branch, each feature extraction branch extracts feature representations through an independent feature extractor, calculates the importance weight of each feature representation through an attention layer, and fuses the weighted feature representations to form a unified feature vector; The IP addresses are constructed as graph network nodes, the unified feature vector is used as the attribute of the graph network node, the edge weight of the graph network is constructed based on the similarity between the IP addresses, the graph convolution network is used to perform message transmission and feature aggregation on the graph network nodes, the final representation of the node is obtained through multi-layer graph convolution operations, and the final representation of the node is mapped to a threat score through a fully connected layer; Based on the statistical analysis of historical data, the initial high-risk threshold and low-risk threshold are determined, and the IP addresses whose threat scores exceed the high-risk threshold are classified as high-risk IP addresses, the IP addresses whose threat scores are lower than the low-risk threshold are classified as low-risk IP addresses, and the IP addresses whose threat scores are between the high-risk threshold and the low-risk threshold are classified as medium-risk IP addresses.

[0074] First, collect network traffic data, including IP address, access time, access port, access protocol, geographic location, AS number, etc. For example, collect an access record of an IP address of 192.168.1.100, access time of 10:00:00 on October 27, 2024, access port 80, access protocol TCP, geographic location Beijing, China, and AS number AS4134.

[0075] Then, the collected data is preprocessed, including data cleaning, deduplication, format conversion and other operations. For example, duplicate access records are removed and timestamps are converted to standard time format. The cleaned data is as follows: IP address 192.168.1.100, access time 2024-10-27 10:00:00, access port 80, access protocol TCP, geographical location Beijing, China, AS number AS4134.

[0076] Next, extract the temporal features, behavioral features, and spatial features of the IP address. For the IP address 192.168.1.100, count its first appearance time, activity duration, and access frequency within the sliding time window (e.g., the past hour) to form a time series feature vector. Analyze its port scanning behavior (e.g., accessing a large number of different ports in a short period of time), connection establishment mode (e.g., frequent establishment and disconnection of connections), and data transmission mode (e.g., large amounts of data uploaded or downloaded) to form behavioral sequence features. Extract its geographical distribution (Beijing, China), AS number distribution (AS4134), and subnet distribution (192.168.1.0 / 24) to form spatial attribute features.

[0077] After that, an attention feature fusion network is constructed. The network contains three branches: temporal feature extraction branch, behavioral feature extraction branch, and spatial feature extraction branch. Each branch uses an independent feature extractor (for example, recurrent neural network RNN ​​for temporal feature extraction, convolutional neural network CNN for behavioral feature extraction, and fully connected network for spatial feature extraction) to extract feature representation. Then, the importance weight of each feature representation is calculated through the attention layer, and the weighted feature representations are fused to form a unified feature vector. For example, the weight of the temporal feature is 0.4, the weight of the behavioral feature is 0.3, and the weight of the spatial feature is 0.3. The weighted sum of the three feature vectors is obtained to obtain a unified feature vector.

[0078] Next, construct an IP address graph network. Take each IP address as a node and the unified feature vector obtained in the previous step as the node attribute. Calculate the edge weights between nodes based on the similarity between IP addresses (e.g., common access targets, overlapping access times, etc.) to form a graph network.

[0079] Then, the graph network is processed using a graph convolutional network. Through multi-layer graph convolution operations, messages are passed between nodes and features are aggregated to obtain the final representation of the nodes. For example, there is a connection between nodes A and B. The feature vector of node A is multiplied by the edge weight and then passed to node B. Node B aggregates the information passed by all neighboring nodes and updates its own feature vector.

[0080] The final representation of the node is then mapped to a threat score through a fully connected layer. For example, the final representation of the node is input into a fully connected layer, and a value between 0 and 1 is output, indicating the threat score of the IP address.

[0081] Finally, classify the IP addresses according to the preset threat level threshold. Based on the statistical analysis of historical data, determine the high-risk threshold and the low-risk threshold. For example, the high-risk threshold is 0.8 and the low-risk threshold is 0.2. IP addresses with threat scores exceeding the high-risk threshold are classified as high-risk IP addresses, IP addresses with threat scores below the low-risk threshold are classified as low-risk IP addresses, and IP addresses with threat scores between the high-risk threshold and the low-risk threshold are classified as medium-risk IP addresses. For example, the threat score of IP address 192.168.1.100 is 0.9, which is classified as a high-risk IP address.

[0082] The beneficial effects of this method are reflected in the following three aspects: 1. Improved the accuracy of threat assessment: By integrating temporal, behavioral, and spatial multi-dimensional features and using graph convolutional networks to capture the correlation between IP addresses, the threat level of IP addresses can be more comprehensively characterized, thereby improving the accuracy of threat assessment.

[0083] 2. Enhanced the generalization ability of the model: The attention mechanism can adaptively learn the importance of different features, enabling the model to better adapt to different network environments and attack types, thereby enhancing the generalization ability of the model.

[0084] 3. Automated threat classification has been achieved: Through the preset threat level threshold, IP addresses can be automatically divided into three threat levels: high, medium and low, which facilitates security personnel to respond and handle quickly and improves the efficiency of security protection.

[0085] In an optional implementation, a blacklist sharing mechanism is established, local threat detection and data collection are performed through a distributed edge node network, threat association analysis is performed using deep learning and graph neural networks to form IP groups, model collaborative optimization between nodes is achieved based on federated learning, and differentiated distribution strategies are used to complete real-time update and synchronization of blacklists, including: Build a distributed edge node network and divide network security equipment into central control nodes and edge execution nodes. The central control node is responsible for global policy formulation and data collaboration, while the edge execution node is responsible for local data collection and threat detection. The edge execution node collects local network traffic and security logs, analyzes traffic characteristics through pre-trained deep learning models, identifies abnormal behaviors and potential threats, and generates a threat report containing threat IP addresses, behavior characteristics, and degree of harm; The central control node receives threat reports uploaded by each edge execution node, uses a graph neural network to build a threat correlation analysis model, clusters threat IP addresses with similar behavior characteristics or associated traffic to form threat IP address groups, and determines the blacklist level based on group characteristics; Differentiated distribution strategies are adopted according to the blacklist level. For high-risk IP groups, update instructions are sent to all edge execution nodes through real-time push channels. For low-risk IP groups, batch synchronization is used to push during network idle time. After receiving the blacklist update instruction, the edge execution node stores the threat IP group information in the local cache, continuously optimizes the local threat detection model based on the reinforcement learning algorithm, updates the model parameters through online learning, and improves the accuracy of threat identification; The central control node periodically collects the model optimization results of each edge execution node, aggregates the model parameters using the federated learning framework, generates an optimized global model and distributes it to each edge execution node, thereby achieving continuous evolution of threat detection capabilities.

[0086] A dynamic blacklist sharing mechanism based on a distributed edge node network and federated learning for real-time threat detection and response. The mechanism divides network security devices into a central control node and multiple edge execution nodes, which work together to achieve efficient threat identification and defense.

[0087] First, build a distributed edge node network. Select a server with high computing and storage capabilities as the central control node, which is responsible for global policy formulation, data collaboration, and model training. Other network security devices, such as firewalls, intrusion detection systems, etc., are used as edge execution nodes to collect local data, detect threats, and update blacklists. Data is transmitted between the central control node and the edge execution node through a secure and reliable communication protocol, such as a TLS / SSL encrypted channel.

[0088] The edge execution node collects local network traffic and security logs. For example, the firewall can record the network connection information, including the source IP address, destination IP address, port number, protocol type, etc.; the intrusion detection system can record suspicious network activities, such as port scanning, malware downloads, etc. The collected data is pre-processed, such as formatting, deduplication, outlier processing, etc., and then input into the pre-trained deep learning model for analysis.

[0089] The deep learning model uses a combination of convolutional neural networks (CNN) and recurrent neural networks (RNN) to effectively extract traffic features and identify abnormal behaviors. For example, CNN can extract spatial features from traffic data, such as packet size, time interval, etc.; RNN can extract time series features from traffic data, such as connection duration, packet sequence, etc. By analyzing these features, the model can identify potential threats, such as DDoS attacks, SQL injections, etc. The model outputs a threat report containing the threatening IP address, behavioral characteristics, and degree of harm. For example, a threat report may contain the following information: IP address: 192.168.1.100, behavioral characteristics: continuous access to sensitive ports, degree of harm: high.

[0090] The central control node receives threat reports uploaded by each edge execution node. In order to reduce communication overhead, edge execution nodes can report threats according to their urgency. For example, high-risk threats can be reported immediately, while low-risk threats can be reported in batches at regular intervals. The central control node uses a graph neural network to build a threat association analysis model. All threat IP addresses are used as nodes of the graph. If there is a correlation between two IP addresses, such as accessing the same target server or belonging to the same botnet, an edge is established between them. The weight of the edge represents the strength of the association. By analyzing the graph structure, the graph neural network can cluster threat IP addresses with similar behavioral characteristics or associated traffic to form threat IP address groups. For example, a threat IP group may include the following IP addresses: 192.168.1.100, 192.168.1.101, 192.168.1.102, all of which participated in the same wave of DDoS attacks. Based on group characteristics, such as the number of IP addresses in the group and the average value of the degree of harm, the blacklist level is determined, such as high risk, medium risk, and low risk.

[0091] Differentiated distribution strategies are adopted according to the blacklist level. For high-risk threat IP groups, update instructions are sent to all edge execution nodes through real-time push channels, such as WebSocket. For low-risk threat IP groups, batch synchronization is used to push during network idle time.

[0092] After receiving the blacklist update instruction, the edge execution node stores the threat IP group information in the local cache for fast matching and interception. At the same time, the edge execution node continuously optimizes the local threat detection model based on the reinforcement learning algorithm. For example, when the model misjudges a normal IP address as a threat, it will receive negative feedback, thereby adjusting the model parameters to reduce the misjudgment rate. The model parameters are updated through online learning to improve the accuracy of threat identification.

[0093] The central control node periodically collects the model optimization results of each edge execution node. For example, each edge node can regularly upload the update of its model parameters. The central control node aggregates model parameters using the federated learning framework. Federated learning allows multiple participants to collaboratively train a shared global model without sharing data. The central control node performs a weighted average of the collected model updates to generate an optimized global model and distributes it to each edge execution node to achieve continuous evolution of threat detection capabilities.

[0094] Beneficial effects:

[0095] 1. Improve the accuracy and efficiency of threat detection: Through the combination of deep learning and graph neural networks, threats can be identified and associated more accurately, reducing false positives and missed negatives.

[0096] 2. Rapid sharing and synchronization of threat intelligence: Distributed architecture and differentiated distribution strategies can ensure real-time updating and synchronization of blacklists and timely response to new threats.

[0097] 3. Continuously optimize threat detection capabilities: The federated learning framework can integrate the learning results of each edge node, continuously improve the performance of the global model, and achieve continuous evolution.

[0098] Figure 2 FIG. 1 is a schematic diagram of the structure of an intelligent management system for a network attack blacklist according to an embodiment of the present invention. Figure 2 As shown, the system comprises: The first unit is used to establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receiving network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; performing feature matching between the attack data and features in the network attack feature library; The second unit is used to use a machine learning model to perform a threat level assessment on the attack data based on the result of the feature matching, and the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform a preliminary classification of the attack data, and the dual-channel neural network model is used to perform a deep analysis based on the preliminary classification result to obtain a deep analysis result, and comprehensively assess the threat level of the attack based on the preliminary classification result, the deep analysis result, and the impact weights corresponding to the historical attack behavior, and establish a threat level assessment record; determine the threat level of the attack source IP address according to the threat level assessment record, and classify the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; The third unit is used to set different blacklist validity periods and ban policies for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, respectively, where the validity period of the high-risk IP address is permanent ban, the validity period of the medium-risk IP address is 30 days, and the validity period of the low-risk IP address is 7 days; dynamically monitor the network behavior of IP addresses of each threat level, and when it is detected that the attack behavior of the IP address has changed, re-evaluate the threat level and update the blacklist policy; establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, realize model collaborative optimization between nodes based on federated learning, and adopt differentiated distribution strategies to complete real-time update and synchronization of the blacklist.

[0099] According to a third aspect of the embodiments of the present invention, An electronic device is provided, comprising: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0100] A fourth aspect of the embodiments of the present invention is: A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0101] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent management method for a network attack blacklist, characterized in that: include: Establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receive network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; perform feature matching between the attack data and the features in the network attack feature library; Based on the result of the feature matching, a machine learning model is used to evaluate the threat level of the attack data, and the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform preliminary classification of the attack data, and the dual-channel neural network model is used to perform in-depth analysis according to the preliminary classification result to obtain a deep analysis result, and the threat level of the attack is comprehensively evaluated based on the preliminary classification result, the deep analysis result, and the impact weights corresponding to the historical attack behavior, and a threat level evaluation record is established; Determine the threat level of the attack source IP address according to the threat level assessment record, and classify the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; Different blacklist validity periods and ban policies are set for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, where the validity period of high-risk IP addresses is permanent ban, the validity period of medium-risk IP addresses is 30 days, and the validity period of low-risk IP addresses is 7 days; dynamically monitor the network behavior of IP addresses of each threat level, and when changes in the attack behavior of the IP address are detected, re-evaluate the threat level and update the blacklist policy; Establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, achieve model collaborative optimization between nodes based on federated learning, and adopt differentiated distribution strategies to complete real-time update and synchronization of the blacklist.

2. The method according to claim 1, characterized in that Matching the attack data with features in the network attack feature library includes: Construct a multi-level network attack feature library, which includes a basic layer, a behavior layer, a time series feature layer and a target association layer; the basic layer uses a prefix tree structure to store attack source IP address information, and the attack source IP address information includes IP address reputation score, geographical location distribution information and organizational affiliation information; the behavior layer uses a state transition diagram to store attack type information and attack behavior feature information; the time series feature layer records attack frequency information and attack time feature information through a sliding time window; the target association layer uses a graph database to store attack target information; A multi-threaded parallel processing architecture is used to collect network traffic data, and the network traffic data is subjected to protocol analysis to obtain original feature data; regularization processing is used to clean the original feature data; a sliding window mechanism is used to convert the network behavior sequence into a feature sequence to obtain a standardized feature vector; a Bloom filter is used to quickly pre-match the standardized feature vector to filter out the data to be analyzed; and the Knuth-Morris-Pratt algorithm is used to perform accurate feature matching on the data to be analyzed.

3. The method according to claim 2, characterized in that Using the Knuth-Morris-Pratt algorithm to accurately match the features of the data to be analyzed includes: Receive data to be matched, calculate characteristic entropy values ​​of characteristic patterns, select the most discriminative character positions as fast filtering points based on the characteristic entropy values, and establish a filtering point lookup table; pre-filter the data to be matched based on the filtering point lookup table to obtain pre-filtered data; Constructing a feature index for the pre-filtered data, performing first-level grouping of feature patterns based on feature length to obtain feature groups, and using a dictionary tree structure to merge and store feature patterns with a common prefix in the feature groups to form a secondary index, thereby obtaining a two-level feature index structure; Analyzing the prefix-suffix matching relationship of the feature pattern in the two-level feature index structure and the repetitive pattern of the intermediate character sequence, identifying the periodic subsequence in the feature pattern, and constructing a bidirectionally extended partial matching table based on the periodic subsequence; Dividing the pre-filtered data into blocks according to the width of a single instruction multiple data register to obtain data blocks, performing parallel character comparison on the data blocks, recording mismatch positions and mismatch patterns in the matching process, and establishing a multi-level mismatch cache of mismatch patterns and optimal jump positions; Analyzing the distribution characteristics of the characters before and after the current matching position based on the multi-level mismatch cache, using a machine learning method to predict the next potential matching point position, and dynamically updating the jump distance in the partial matching table according to the potential matching point position; During the matching process, a sliding matching window is dynamically maintained based on the length of the feature pattern, and feature distribution information within the sliding matching window is recorded; when the pre-filtered data crosses a data packet boundary, partial matching state information within the sliding matching window is saved; and continuous matching of cross-packet features is achieved based on the partial matching state information.

4. The method according to claim 1, characterized in that: Based on the result of the feature matching, a machine learning model is used to evaluate the threat level of the attack data. The machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform preliminary classification of the attack data, and the dual-channel neural network model is used to perform in-depth analysis according to the preliminary classification result to obtain a deep analysis result. Based on the preliminary classification result, the deep analysis result, and the impact weight corresponding to the historical attack behavior, the threat level of the attack is comprehensively evaluated, and the establishment of a threat level assessment record includes: Receive feature matching results, extract attack feature frequency, time series features, and behavior features to construct a multidimensional feature vector, perform standardization on the multidimensional feature vector to obtain a standardized feature, and perform dimensionality reduction on the standardized feature using a principal component analysis method to obtain a reduced dimensionality feature; A multi-layer decision tree model is constructed based on the dimensionality reduction features, the Gini coefficient is used for feature selection, a dynamic split threshold mechanism is introduced to split the decision tree nodes, misclassified samples are recorded to form an misclassified sample library, and the decision tree model is optimized and trained based on the sample weights in the misclassified sample library; Constructing a dual-channel neural network model, wherein the temporal channel of the dual-channel neural network model uses a long short-term memory network to process the temporal features in the dimensionality reduction features, and the spatial channel uses a convolutional neural network to process the spatial features in the dimensionality reduction features, and the outputs of the temporal channel and the spatial channel are feature fused through an attention mechanism; Performing preliminary classification of the attack data based on the decision tree model to obtain preliminary classification results, calculating the confidence of the preliminary classification results, and when the confidence is lower than a preset threshold, inputting the corresponding attack data into the dual-channel neural network model for in-depth analysis to obtain in-depth analysis results; Record the historical attack behaviors of the attack source, and use the time decay function to calculate the impact weight of the historical attack behaviors; comprehensively evaluate the threat level of the attack based on the preliminary classification result, the in-depth analysis result, and the impact weight, and establish a threat level evaluation record.

5. The method according to claim 1, characterized in that Determining the threat level of the attack source IP address according to the threat level assessment result, and classifying the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold includes: Use sliding time windows to extract the time series features of IP addresses, calculate the first appearance time, activity duration, and activity frequency distribution of IP addresses to form time series feature vectors, extract the port scanning behavior, connection establishment mode, and data transmission mode of IP addresses to form behavior sequence features, and collect the geographical distribution, AS number distribution, and subnet distribution of IP addresses to form spatial attribute features; Constructing an attention feature fusion network, the attention feature fusion network includes a time feature extraction branch, a behavior feature extraction branch, and a space feature extraction branch, each feature extraction branch extracts feature representations through an independent feature extractor, calculates the importance weight of each feature representation through an attention layer, and fuses the weighted feature representations to form a unified feature vector; The IP addresses are constructed as graph network nodes, the unified feature vector is used as the attribute of the graph network node, the edge weight of the graph network is constructed based on the similarity between the IP addresses, the graph convolution network is used to perform message transmission and feature aggregation on the graph network nodes, the final representation of the node is obtained through multi-layer graph convolution operations, and the final representation of the node is mapped to a threat score through a fully connected layer; Based on the statistical analysis of historical data, the initial high-risk threshold and low-risk threshold are determined, and the IP addresses whose threat scores exceed the high-risk threshold are classified as high-risk IP addresses, the IP addresses whose threat scores are lower than the low-risk threshold are classified as low-risk IP addresses, and the IP addresses whose threat scores are between the high-risk threshold and the low-risk threshold are classified as medium-risk IP addresses.

6. The method according to claim 1, characterized in that Establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, achieve model collaborative optimization between nodes based on federated learning, and use differentiated distribution strategies to complete real-time update and synchronization of blacklists, including: Build a distributed edge node network and divide network security equipment into central control nodes and edge execution nodes. The central control node is responsible for global policy formulation and data collaboration, while the edge execution node is responsible for local data collection and threat detection. The edge execution node collects local network traffic and security logs, analyzes traffic characteristics through pre-trained deep learning models, identifies abnormal behaviors and potential threats, and generates a threat report containing threat IP addresses, behavior characteristics, and degree of harm; The central control node receives threat reports uploaded by each edge execution node, uses a graph neural network to build a threat correlation analysis model, clusters threat IP addresses with similar behavior characteristics or associated traffic to form threat IP address groups, and determines the blacklist level based on group characteristics; Differentiated distribution strategies are adopted according to the blacklist level. For high-risk IP groups, update instructions are sent to all edge execution nodes through real-time push channels. For low-risk IP groups, batch synchronization is used to push during network idle time. After receiving the blacklist update instruction, the edge execution node stores the threat IP group information in the local cache, continuously optimizes the local threat detection model based on the reinforcement learning algorithm, updates the model parameters through online learning, and improves the accuracy of threat identification; The central control node periodically collects the model optimization results of each edge execution node, aggregates the model parameters using the federated learning framework, generates an optimized global model and distributes it to each edge execution node, thereby achieving continuous evolution of threat detection capabilities.

7. An intelligent management system for network attack blacklists, used to implement the method according to any one of claims 1 to 6, characterized in that: include: The first unit is used to establish and maintain a multi-level network attack feature library, which includes a basic layer behavior layer, a timing feature layer and a target association layer: receiving network traffic data collected in real time by network security equipment, the network traffic data includes attack source IP address information, data packet feature information, network behavior feature information and attack target information; performing feature matching between the attack data and features in the network attack feature library; A second unit is used to use a machine learning model to perform a threat level assessment on the attack data based on the result of the feature matching, wherein the machine learning model includes a decision tree model and a dual-channel neural network model, wherein the decision tree model is used to perform a preliminary classification of the attack data, and the dual-channel neural network model is used to perform a deep analysis based on the preliminary classification result to obtain a deep analysis result, and based on the preliminary classification result, the deep analysis result, and the impact weight corresponding to the historical attack behavior, comprehensively assess the threat level of the attack, and establish a threat level assessment record; Determine the threat level of the attack source IP address according to the threat level assessment record, and classify the attack source IP address into a high-risk IP address, a medium-risk IP address, and a low-risk IP address based on a preset threat level threshold; The third unit is used to set different blacklist validity periods and ban policies for the high-risk IP addresses, medium-risk IP addresses and low-risk IP addresses, respectively, where the validity period of the high-risk IP address is permanent ban, the validity period of the medium-risk IP address is 30 days, and the validity period of the low-risk IP address is 7 days; dynamically monitor the network behavior of IP addresses of each threat level, and when it is detected that the attack behavior of the IP address has changed, re-evaluate the threat level and update the blacklist policy; Establish a blacklist sharing mechanism, perform local threat detection and data collection through a distributed edge node network, use deep learning and graph neural networks to perform threat association analysis to form IP groups, achieve model collaborative optimization between nodes based on federated learning, and adopt differentiated distribution strategies to complete real-time update and synchronization of the blacklist.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images