Intelligent network environment security detection algorithm
Through the deep learning neural network model, network traffic data is dimensionalized and feature extraction, and combined with random forests and SVM for classification and anomaly detection, it solves the problem of difficult to identify unknown attacks in the existing technology and achieves more efficient and accurate network security detection.
Patent Information
- Application Number
- CN202411919736.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-03-28
AI Technical Summary
Existing network security detection methods rely on static rules and signature matching, making it difficult to effectively identify unknown attacks, and the algorithm burden of dynamic models is difficult to recognize.
The intelligent network environment security detection algorithm is adopted to reduce the dimensionality and feature extraction of network traffic data through deep learning neural network models, and combine random forests and support vector machines (SVMs) to classify behavioral data and abnormal detection.
It improves the efficiency and accuracy of network security detection, reduces the false alarm rate, and can better adapt to the complexity and dynamic nature of network behavior.
Smart Images
Figure CN119728260A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to an intelligent network environment security detection algorithm. Background Art
[0002] In existing network security detection methods and systems, static rules and signature matching technologies are mainly relied on to identify known threats. These systems often include intrusion detection systems (IDS), firewalls, and rule-based behavior analysis tools. They identify potential security threats by comparing network traffic and user behavior with the characteristics of known attack patterns. In addition, some systems also use simple anomaly detection technology to identify abnormal behavior based on statistical models of network behavior.
[0003] For example, a network security detection method and system disclosed in the Chinese invention patent publication number CN117914629A, the detection method can effectively eliminate noise and redundant information in the original data through preprocessing and feature extraction steps, and extract key features that contribute to detection, thereby improving the accuracy of detection. Using a data enhancement method based on a variational autoencoder, the present invention can expand and generate feature subsets, enrich the data set and improve the generalization ability of the model, so that the detection method has better adaptability when facing unknown attacks. The enhanced data is decomposed into different time scales using a wavelet transform method, which can reveal the inherent structure and multi-scale characteristics of the data. By using anomaly detection algorithms to identify anomalies in time series data of different time scales, the present invention can accurately detect abnormal behaviors that deviate from normal patterns, and improve the performance and efficiency of anomaly detection. The method of the present invention is flexible and scalable, and can be adjusted and optimized according to different network environments and security requirements.
[0004] The above invention enriches the data set and improves the generalization ability of the model by expanding and generating feature subsets, so that the detection method has better adaptability when facing unknown attacks. However, these feature subsets are still extracted based on the attack features of the original historical data and belong to static models. At present, network attacks are becoming more and more covert and updated more and more rapidly. Although the dynamic model has higher detection efficiency, the burden of the algorithm running in the background is still unacceptable. Therefore, on the basis of the above, the processing method for network traffic data still requires more detailed capture and extraction methods. Summary of the invention
[0005] In view of the deficiencies of the prior art, the present invention provides an intelligent network environment security detection algorithm, which solves the problems raised in the above background technology.
[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: an intelligent network environment security detection algorithm, including the following specific detection steps:
[0007] Monitor network traffic packets in real time, collect network traffic behavior data, store and analyze them, and then display the network data packet header information in the same format;
[0008] Based on the deep learning neural network model, feature extraction is completed for the collected network traffic behavior data according to the established feature subset;
[0009] It should be noted that, unlike other artificial expert subjective experience setting methods of the number of hidden layers and the number of neuron nodes in each layer of neural networks, this application completes the dimensionality reduction processing of network traffic data based on a deep learning neural network model before completing feature extraction with the established feature subset, and re-decodes the optimal low-dimensional representation of the network traffic behavior data. This cyclic process greatly avoids the high false alarm rate that is often seen in the prior art, and avoids the situation where the static model fails to fully consider the complexity and dynamics of network behavior.
[0010] Based on the collaboration of random forest and SVM, the classification of behavioral data extraction features is completed, the mean, variance and standardization of network traffic behavior data are obtained, the optimal support vector machine parameters are selected, and a verification model is established based on the optimal support vector machine parameters to verify abnormal traffic.
[0011] A further improvement of the technical solution of the present invention is to monitor network traffic in real time and collect behavior data, including:
[0012] The detection algorithm activates the network message monitoring and interception library in the Winpcap library to capture network traffic data, and the Winpcap library completes the unpacking of the captured network traffic data to obtain the obtained network traffic behavior data;
[0013] While the network traffic behavior data is being sent for analysis, it is also stored in the database built into the capturer.
[0014] Compared with the prior art which derives from historical data experience and learns the cognitive standards of network behavior through adaptive algorithms to identify the pattern of network behavior, this application directly captures data at the port. Although there is the problem of increased computing rate, it can better avoid the occurrence of security vulnerabilities.
[0015] A further improvement of the technical solution of the present invention is to extract features from the behavior data collected by S1 according to an established feature subset based on a deep learning neural network model, including:
[0016] Numerical processing is performed on the symbolic characteristic attributes in the obtained network traffic behavior data;
[0017] Normalize all data to obtain standardized network traffic behavior data;
[0018] The pre-processed high-dimensional and nonlinear data is subjected to dimensionality reduction processing through a feature extraction model based on an improved autoencoder to obtain the optimal low-dimensional representation of the network traffic behavior data, and the optimal low-dimensional representation of the network traffic behavior data is re-decoded and compared with the established feature subset to complete feature extraction;
[0019] The optimal low-dimensional representation decoding result of network traffic behavior data is used as the input of the SVM classifier to identify normal network data and network attack data respectively.
[0020] A further improvement of the technical solution of the present invention is to perform dimensionality reduction processing based on an improved autoencoder feature extraction model, including:
[0021] pass The input data x input into the feature extraction model is transformed into the encoded data y. When the number of nodes of the hidden layer neurons is less than the standardized network traffic behavior data, the low-dimensional representation of the input data is completed, where m is the number of hidden layer neurons of the standardized network traffic behavior data, μ j is the average value of all output values of the jth neuron in the hidden layer of the standardized network traffic behavior data. The preset value of p is close to the average activation of the neurons in the hidden layer.
[0022] It should be noted that μ j is the average value of all outputs of the jth neuron in the hidden layer of the standardized network traffic behavior data. There are related introductions in the prior art, which are briefly disclosed here. Calculate the average value of all data output values, where y[i] is a point in the filtered data sequence, representing the moving average value of position i in the original data sequence. The top m of the summation symbol in the original formula is N, where N is the window size of the moving average filter, representing the number of data points to be considered when calculating the moving average value of a point. In this application, the relevant data is not windowed, so it is set to m. x[ij] is a point in the original data sequence, representing the data value at position ij.
[0023] A further improvement of the technical solution of the present invention is to use the optimal low-dimensional representation of network traffic behavior data as the input of the SVM classifier, including:
[0024] The standardized network traffic behavior data is used as the input and output of the SVMA classifier. If the output result is normal, it is used as normal network data. If the output result is abnormal, it is network attack traffic data. The network attack traffic data output by SVMA is input into SVMB. If the output result is normal, the attack is used as a Fuzzers network attack. If the output result is abnormal, it is output to the SVM classifier end point in sequence.
[0025] A further improvement of the technical solution of the present invention is that the SVM classifier includes classifiers that can identify Fuzzers, Worms, Shellcode, Generic, Reconnaissance, Backdoor, Exploits, DoS and Analysis, and multiple SVM classifiers form a progressive binary tree structure to form a multi-class classifier.
[0026] A further improvement of the technical solution of the present invention is to obtain the mean, variance and standardization of network traffic behavior data, including:
[0027] pass Calculate the mean of network traffic behavior data by Calculate the variance of network traffic behavior data and pass Each network traffic behavior data is standardized, and the optimal support vector machine parameters are selected according to the mean, variance and standardization and based on the KLDA algorithm analysis.
[0028] A further improvement of the technical solution of the present invention is to establish a verification model based on the optimal support vector machine parameters to verify abnormal traffic, including:
[0029] Convert the selected vector machine parameters into an n×l matrix The coefficients of the projection of the input vector on its orthogonal basis are used as the algorithm to verify the matrix features, and these coefficients are used again as the input features of the classifier for re-verification.
[0030] Compared with the prior art, the beneficial effect of the present invention is that by combining advanced algorithms such as deep learning, support vector machines, neural networks, and optimizing the key steps of some of the algorithms, the accuracy of the detection results is ensured through feature extraction and pattern recognition. The algorithm can effectively improve the efficiency and accuracy of network security detection;
[0031] Before the established feature subset completes feature extraction, the network traffic data is reduced in dimension based on the deep learning neural network model, and the optimal low-dimensional representation of the network traffic behavior data is re-decoded. This cyclic process avoids the high false alarm rate that often occurs in existing technologies, and avoids the situation where static models fail to fully consider the complexity and dynamics of network behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] Figure 1 It is a flowchart of the intelligent network environment security detection algorithm;
[0033] Figure 2 A schematic diagram of feature extraction of feature subsets in the intelligent network environment security detection algorithm during the decoding and encoding process;
[0034] Figure 3 A schematic diagram of the recognition of a progressive binary tree structure formed by multiple SVM classifiers in the intelligent network environment security detection algorithm; DETAILED DESCRIPTION
[0035] Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.
[0036] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
[0037] In addition, in order to better illustrate the present application, numerous specific details are provided in the specific embodiments below. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, and elements well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.
[0038] The present invention provides an intelligent network environment security detection algorithm, which includes the following specific detection steps:
[0039] Monitor network traffic packets in real time, collect network traffic behavior data, store and analyze them, and then display the network data packet header information in the same format;
[0040] Based on the deep learning neural network model, feature extraction is completed for the collected network traffic behavior data according to the established feature subset;
[0041] It should be noted that, unlike other artificial expert subjective experience setting methods of the number of hidden layers and the number of neuron nodes in each layer of neural networks, this application completes the dimensionality reduction processing of network traffic data based on a deep learning neural network model before completing feature extraction with the established feature subset, and re-decodes the optimal low-dimensional representation of the network traffic behavior data. This cyclic process greatly avoids the high false alarm rate that is often seen in the prior art, and avoids the situation where the static model fails to fully consider the complexity and dynamics of network behavior.
[0042] Based on the collaboration of random forest and SVM, the classification of behavioral data extraction features is completed, the mean, variance and standardization of network traffic behavior data are obtained, the optimal support vector machine parameters are selected, and a verification model is established based on the optimal support vector machine parameters to verify abnormal traffic.
[0043] Monitor network traffic in real time and collect behavioral data, including:
[0044] The detection algorithm activates the network message monitoring and interception library in the Winpcap library to capture network traffic data, and the Winpcap library completes the unpacking of the captured network traffic data to obtain the obtained network traffic behavior data;
[0045] While the network traffic behavior data is being sent for analysis, it is also stored in the database built into the capturer.
[0046] Compared with the prior art which derives from historical data experience and learns the cognitive standards of network behavior through adaptive algorithms to identify the pattern of network behavior, this application directly captures data at the port. Although there is the problem of increased computing rate, it can better avoid the occurrence of security vulnerabilities.
[0047] Based on the deep learning neural network model, feature extraction is completed for the behavioral data collected by S1 according to the established feature subset, including:
[0048] Numerical processing is performed on the symbolic characteristic attributes in the obtained network traffic behavior data;
[0049] Normalize all data to obtain standardized network traffic behavior data;
[0050] The pre-processed high-dimensional and nonlinear data is subjected to dimensionality reduction processing through a feature extraction model based on an improved autoencoder to obtain the optimal low-dimensional representation of the network traffic behavior data, and the optimal low-dimensional representation of the network traffic behavior data is re-decoded and compared with the established feature subset to complete feature extraction;
[0051] The optimal low-dimensional representation decoding result of network traffic behavior data is used as the input of the SVM classifier to identify normal network data and network attack data respectively.
[0052] Dimensionality reduction is performed based on the improved autoencoder feature extraction model, including:
[0053] pass The input data x input into the feature extraction model is transformed into the encoded data y. When the number of nodes of the hidden layer neurons is less than the standardized network traffic behavior data, the low-dimensional representation of the input data is completed, where m is the number of hidden layer neurons of the standardized network traffic behavior data, μj is the average value of all output values of the jth neuron in the hidden layer of the standardized network traffic behavior data. The preset value of p is close to the average activation of the neurons in the hidden layer.
[0054] It should be noted that μ j is the average value of all outputs of the jth neuron in the hidden layer of the standardized network traffic behavior data. There are related introductions in the prior art, which are briefly disclosed here. Calculate the average value of all data output values, where y[i] is a point in the filtered data sequence, representing the moving average value of position i in the original data sequence. In the original formula, the top m of the summation symbol is N, and N is the window size of the moving average filter, which represents the number of data points to be considered when calculating the moving average value of a point. In this application, the relevant data is not windowed, so it is set to m, and x[ij] is a point in the original data sequence, representing the data value at position ij;
[0055] The optimal low-dimensional representation of network traffic behavior data is used as the input of the SVM classifier, including:
[0056] The standardized network traffic behavior data is used as the input and output of the SVMA classifier. If the output result is normal, it is used as normal network data. If the output result is abnormal, it is network attack traffic data. The network attack traffic data output by SVMA is input into SVMB. If the output result is normal, the attack is used as a Fuzzers network attack. If the output result is abnormal, it is output to the SVM classifier end point in sequence.
[0057] The SVM classifier includes classifiers that can identify Fuzzers, Worms, Shellcode, Generic, Reconnaissance, Backdoor, Exploits, DoS and Analysis. Multiple SVM classifiers form a progressive binary tree structure to form a multi-class classifier.
[0058] Get the mean, variance and standardization of network traffic behavior data, including:
[0059] pass Calculate the mean of network traffic behavior data by Calculate the variance of network traffic behavior data and pass Each network traffic behavior data is standardized, and the optimal support vector machine parameters are selected according to the mean, variance and standardization and based on the KLDA algorithm analysis.
[0060] A verification model is established based on the optimal support vector machine parameters to verify abnormal traffic, including:
[0061] Convert the selected vector machine parameters into an n×l matrix The coefficients of the projection of the input vector on its orthogonal basis are used as the algorithm to verify the matrix features, and these coefficients are used again as the input features of the classifier for re-verification.
[0062] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0063] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.
Claims
1. An intelligent network environment security detection algorithm, characterized in that: The specific detection steps include the following: Monitor network traffic packets in real time, collect network traffic behavior data, store and analyze them, and then display the network data packet header information in the same format; Based on the deep learning neural network model, feature extraction is completed for the collected network traffic behavior data according to the established feature subset; Based on the collaboration of random forest and SVM, the classification of behavioral data extraction features is completed, the mean, variance and standardization of network traffic behavior data are obtained, the optimal support vector machine parameters are selected, and a verification model is established based on the optimal support vector machine parameters to verify abnormal traffic.
2. According to claim 1, an intelligent network environment security detection algorithm is characterized in that: Monitor network traffic in real time and collect behavioral data, including: The detection algorithm activates the network message monitoring and interception library in the Winpcap library to capture network traffic data, and the Winpcap library completes the unpacking of the captured network traffic data to obtain the obtained network traffic behavior data; While the network traffic behavior data is being sent for analysis, it is also stored in the database built into the capturer.
3. An intelligent network environment security detection algorithm according to claim 2, characterized in that: Based on the deep learning neural network model, feature extraction is completed for the behavioral data collected by S1 according to the established feature subset, including: Numerical processing is performed on the symbolic characteristic attributes in the obtained network traffic behavior data; Normalize all data to obtain standardized network traffic behavior data; The pre-processed high-dimensional and nonlinear data is subjected to dimensionality reduction processing through a feature extraction model based on an improved autoencoder to obtain the optimal low-dimensional representation of the network traffic behavior data, and the optimal low-dimensional representation of the network traffic behavior data is re-decoded and compared with the established feature subset to complete feature extraction; The optimal low-dimensional representation decoding result of network traffic behavior data is used as the input of the SVM classifier to identify normal network data and network attack data respectively.
4. The intelligent network environment security detection algorithm according to claim 3 is characterized in that: Dimensionality reduction is performed based on the improved autoencoder feature extraction model, including: pass The input data x input into the feature extraction model is transformed into the encoded data y. When the number of nodes of the hidden layer neurons is less than the standardized network traffic behavior data, the low-dimensional representation of the input data is completed, where m is the number of hidden layer neurons of the standardized network traffic behavior data, μ j is the average value of all output values of the jth neuron in the hidden layer of the standardized network traffic behavior data. The preset value of p is close to the average activation of the neurons in the hidden layer.
5. The intelligent network environment security detection algorithm according to claim 3 is characterized in that: The optimal low-dimensional representation of network traffic behavior data is used as the input of the SVM classifier, including: The standardized network traffic behavior data is used as the input and output of the SVMA classifier. If the output result is normal, it is used as normal network data. If the output result is abnormal, it is network attack traffic data. The network attack traffic data output by SVMA is input into SVMB. If the output result is normal, the attack is used as a Fuzzers network attack. If the output result is abnormal, it is output to the SVM classifier end point in sequence.
6. An intelligent network environment security detection algorithm according to claim 5, characterized in that: The SVM classifier includes classifiers that can identify Fuzzers, Worms, Shellcode, Generic, Reconnaissance, Backdoor, Exploits, DoS and Analysis. Multiple SVM classifiers form a progressive binary tree structure to form a multi-class classifier.
7. The intelligent network environment security detection algorithm according to claim 1, characterized in that: Get the mean, variance and standardization of network traffic behavior data, including: pass Calculate the mean of network traffic behavior data by Calculate the variance of network traffic behavior data and pass Each network traffic behavior data is standardized, and the optimal support vector machine parameters are selected according to the mean, variance and standardization and based on the KLDA algorithm analysis.
8. The intelligent network environment security detection algorithm according to claim 3 is characterized in that: A verification model is established based on the optimal support vector machine parameters to verify abnormal traffic, including: Convert the selected vector machine parameters into an n×l matrix The coefficients of the projection of the input vector on its orthogonal basis are used as the algorithm to verify the matrix features, and these coefficients are used again as the input features of the classifier for re-verification.
Citation Information
Patent Citations
Network security detection method and system
CN117914629A