Security protection capability assessment method based on attack data analysis
By using the combination of CNN and LSTM models in the intrusion detection system, the problems of high false alarm rate and difficult network status prediction in abnormal attack detection are solved, and more accurate and efficient abnormal attack detection is achieved.
Patent Information
- Application Number
- CN202411930396.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-26
- Publication Date
- 2025-04-01
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
The prior art has a high false alarm rate in abnormal attack detection, intrusion detection performance depends on functional design, and it is difficult to accurately predict network status and attack data characteristics.
Using machine learning models based on CNN and LSTM, we establish attack detection and prediction models through time series prediction and attack classification, predict network traffic and identify attack patterns.
It effectively reduces the false alarm rate, improves the accuracy and performance of abnormal attack detection, and can identify attack patterns related to time and space.
Smart Images
Figure CN119743312A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to information security technology, and in particular to a security protection capability evaluation method based on attack data analysis. Background Art
[0002] In the current abnormal attack traffic detection, network intrusion detection systems are often created to effectively defend against various types of network attacks and further protect the normal operation of information systems.
[0003] At present, intrusion detection systems mainly identify abnormal attack behaviors by analyzing network traffic at key nodes of the network. In the past few years, deep learning has made significant progress in solving artificial intelligence problems in application scenarios such as speech and image recognition, object detection, and semantic translation. Many studies have shown that deep learning has outperformed traditional methods in abnormal attack detection, classification, and prediction. However, intrusion detection performance is highly dependent on functional design, and anomaly-based attack data has a high false alarm rate and performs poorly in practical applications. Therefore, how to analyze and characterize network attack data traffic is still a problem worth studying. At the same time, in practical situations, accurate time series prediction and reliable estimation of prediction uncertainty are crucial for abnormal attack detection. Therefore, a new detection mechanism is needed that can predict the network status and provide detailed attack data feature information. Summary of the invention
[0004] The technical problem to be solved by the present invention is to provide a security protection capability evaluation method based on attack data analysis in view of the defects in the prior art.
[0005] The technical solution adopted by the present invention to solve the technical problem is: a security protection capability evaluation method based on attack data analysis, comprising the following steps:
[0006] 1) Collect network traffic and attack data from multiple heterogeneous data sources; the data sources include display consoles, computing service platforms, authentication and authorization services, firewalls, intrusion detection systems, and log files;
[0007] 2) Data preprocessing: removing redundant and irrelevant data;
[0008] 3) Establish an attack detection prediction model to output the identified attack mode and the risk probability detection results of being attacked;
[0009] The attack detection prediction model consists of a time series prediction model and an attack classification model;
[0010] The time series prediction model is used to predict the network traffic sequence in the next period; the details are as follows:
[0011] First, the real-time traffic data collected in time period t is preprocessed, and the time series-based predictor predicts the network traffic sequence Seq_p(t+1) for the next period according to Seq(t);
[0012] The time series prediction module is implemented by the LSTM model.
[0013] The input sequence, hidden vector sequence and output vector sequence are represented by In, Hid and Out respectively, that is, the input sequence is In = (in1, in2, ..., in T ), hidden vector sequence (Hid=(hid1,hid2,...,hid T )) and the output vector sequence (Out = (out1, out2, ..., out T ), the sequence calculation method is as follows:
[0014] hid t =σ(W in，hid in t +W n，hid hid t-1 +b hid )
[0015] out t =W hid，out hid t +b out
[0016] Among them, t = 1, 2, ..., T, σ is a nonlinear function, W is a weight matrix, and b is a bias term.
[0017] The LSTM neural network adds a hidden layer LSTM unit to the original RNN to learn the temporal features based on the network packet vector sequence. The key to LSTM is how to control the addition and weight of long-term states. It uses gates to control the weighted function of the information flow in the LSTM unit input. The LSTM unit has three gates, namely the input gate, the forget gate, and the output gate, which control the information flow through neurons and neural networks in different stages.
[0018] At time t, the input is x t , the hidden layer output is h t , the previous output is h t-1 , the unit input state is The unit output state is C t , the previous state is C t-1 , the states of the three doors are i t 、f t and t , C in LSTM unit t and h tare transmitted to the next neuron. In order to calculate C t and h t , using the following equations in order.
[0019] First, the states of the three gates and the cell input state are calculated. The input gate determines which values in the input are used to update the memory state:
[0020]
[0021] The forget gate determines what information to discard from the cell:
[0022]
[0023] The input gate and forget gate are used to update the internal state. The output gate determines the output content based on the input and the unit's memory:
[0024]
[0025] The output gate limits the actual output of the unit. The current input unit state is:
[0026]
[0027] Among them, W xi , W xf , W xo , W xC Is the connection x t The weight matrix to the three gates and the unit input, W hi , W hf , W ho , W hC It is connected t-1 The weight matrix to the three gates and the unit input, b i 、b f 、b o 、b C is the bias term of the three gates and the unit input. σ represents the activation function used by the gate, where the input gate and the forget gate are sigmoid functions and the output gate is the tanh function. Then, the unit output state is calculated:
[0028]
[0029] Among them, f t , C t-1 and C t Have the same vector dimensions. Finally, calculate the hidden layer output:
[0030] h t =o t ×tanh(C t )
[0031] A time series is an ordered sequence of a certain type of variable at equal time intervals, with autocorrelation and time series. Sequence prediction takes advantage of the characteristics of time series, retains the learning results of the training model in chronological order and sorts them, so that the future change behavior and probability of occurrence of the data flow can be estimated from a set of time series. In order to predict network traffic, an LSTM neural network is constructed using LSTM units. At time t, the input of the network is the observed historical data x t , the output is the predicted future data Through the above LSTM calculation, we get h t , calculate the network output:
[0032]
[0033] Where W is the weight matrix between the output layer and the hidden layer, and b is the bias term of the output layer. The network uses an encoder-decoder framework with multiple layers of LSTM units: extract features to generate the time series {xt} t The input prediction network consists of an encoder and a decoder, where the encoder reads the previous T timestamps {x1, x2, …, x T} to train the LSTM unit, the decoder is in {x T-F+1 ,x T-F+2 ,…,x T} Output the predicted next time series {x through the trained LSTM unit T+1 ,x T+2 ,…,x T+F}, and output it as the prediction result.
[0034] The attack classification model classifies network security events in the predicted time series to estimate the risk probability of being attacked in the next time period; after identifying the manifestations of attacks in different time periods, it uses them as the step process of a certain attack to complete the mining and identification matching between different continuous steps of the attack, and finally outputs the identified attack patterns and detection results.
[0035] The attack classification model is implemented by the CNN (LetNet) network model;
[0036] The CNN model structure includes: input layer, convolution layer 1, pooling layer 1, convolution layer 2, pooling layer 2 and fully connected layer; the LSTM model structure includes: LSTM layer 1, LSTM layer 2, fully connected layer and output layer;
[0037] CNN is applied to the entire network traffic identification, and the network traffic data usually has multi-dimensional features (e.g., source IP, destination IP, port number, protocol type, etc.).
[0038] First, these traffic data with n-dimensional features are encoded using One-Hot Encoding (OHE);
[0039] Convert the one-hot encoded data into an image of size m×m, where The extra digits are set to 0;
[0040] The image is recognized by the trained CNN model, and the final output is a flow vector representing the classification code: it consists of multiple label vectors, and these grouping vectors represent the classification of each traffic packet, such as normal traffic, abnormal traffic, different types of attacks, etc.
[0041] 4) Attack effect evaluation;
[0042] 4.1) Establish a set of evaluation factors: attack traffic size (e.g. GBps), attack duration, importance of the attacked system, and number of affected users;
[0043] 4.2) Determine the fuzzy judgment set;
[0044] 4.3) Establish a fuzzy relationship matrix and obtain the weight of each evaluation factor;
[0045] 4.4) Combining the fuzzy relationship matrix and the fuzzy weight vector, a fuzzy comprehensive operation is performed: the comprehensive evaluation vector obtained after the operation is used as the evaluation result;
[0046] 5) Adjust the system's protection measures as needed based on the system's security protection capability assessment results.
[0047] The beneficial effects produced by the present invention are:
[0048] 1. Based on the spatial feature recognition capability of CNN and the temporal feature recognition capability of LSTM, the present invention can mine out attacks that are related in time and against different attack points. The CNN model connects the data with related features in space (attacks launched against multiple targets, etc.) and outputs the recognition results. Then, based on the LSTM model, the temporal level related features are completed, and the manifestation of a certain attack in different time periods is identified (the step flow of a certain attack), and the mining and identification between different continuous steps of the attack are completed. Based on the combination of these two models, the identified attack mode and detection results are finally output.
[0049] 2. Machine learning-based detection can identify anomalies and potential attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:
[0051] Figure 1 It is a method flow chart of an embodiment of the present invention. DETAILED DESCRIPTION
[0052] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0053] like Figure 1 As shown, a security protection capability evaluation method based on attack data analysis includes the following steps
[0054] 1) Collect network traffic and attack data from multiple heterogeneous data sources; the data sources include display consoles, computing service platforms, authentication and authorization services, firewalls, intrusion detection systems, and log files;
[0055] Data collection mainly collects attack data during the network attack process, such as network traffic change data and host performance change data caused by DDoS attacks. In the application process, data collection will be independent of the network attack process to reduce the impact of its operation on attack data.
[0056] 2) Data preprocessing: removing redundant and irrelevant data;
[0057] The data cleaning, standardization and denoising engine needs to extract, select and construct features of abnormal traffic. It will extract unprocessed data from the preprocessing database, remove or correct errors, anomalies or incomplete information in the data, convert the data into a format or structure suitable for analysis, and use data compression, format conversion or data sharding technology to determine which data should be saved and where to save it. Finally, it is stored back to the database. For example, after preprocessing operations such as data collection, adding labels, and feature extraction, a data set with a regular format is formed. The format and content of a certain data is as follows:
[0058] {FlowID: bdeaacdbae, SourceIP: 104.16.207.165, Source Port: 443,
[0059] DestinationIP: 192.168.10.5, Destination Port: 54865,...,
[0060] SYN Flag Count: 3, ACK Flag Count: 1, ..., Label: DDoS, ...}
[0061] The data set is then further processed to obtain a sequence data set which is input into the detection model.
[0062] 3) Establish an attack detection prediction model to output the identified attack mode and the risk probability detection results of being attacked;
[0063] The attack detection prediction model consists of a time series prediction model and an attack classification model;
[0064] The time series prediction model is used to predict the network traffic sequence in the next period; the details are as follows:
[0065] First, the real-time traffic data collected in time period t is preprocessed, and the time series-based predictor predicts the network traffic sequence Seq_p(t+1) for the next period according to Seq(t);
[0066] The time series prediction module is implemented by the LSTM model.
[0067] The input sequence, hidden vector sequence and output vector sequence are represented by In, Hid and Out respectively, that is, the input sequence is In = (in1, in2, ..., in T ), hidden vector sequence (Hid=(hid1,hid2,...,hid T )) and the output vector sequence (Out = (out1, out2, ..., out T ), the sequence calculation method is as follows:
[0068] hid t =σ(W in，hid in t +W n，hid hid t-1 +b hid )
[0069] out t =W hid，out hid t +b out
[0070] Among them, t = 1, 2, ..., T, σ is a nonlinear function, W is a weight matrix, and b is a bias term.
[0071] The LSTM neural network adds a hidden layer LSTM unit to the original RNN to learn the temporal features based on the network packet vector sequence. The key to LSTM is how to control the addition and weight of long-term states. It uses gates to control the weighted function of the information flow in the LSTM unit input. The LSTM unit has three gates, namely the input gate, the forget gate, and the output gate, which control the information flow through neurons and neural networks in different stages.
[0072] At time t, the input is x t , the hidden layer output is h t, the previous output is h t-1 , the unit input state is The unit output state is C t , the previous state is C t-1 , the states of the three doors are i t 、f t and t . C in LSTM unit t and h t are transmitted to the next neuron. In order to calculate C t and h t , using the following equations in order.
[0073] First, the states of the three gates and the cell input state are calculated. The input gate determines which values in the input are used to update the memory state:
[0074]
[0075] The forget gate determines what information to discard from the cell:
[0076]
[0077] The input gate and forget gate are used to update the internal state. The output gate determines the output content based on the input and the unit's memory:
[0078]
[0079] The output gate limits the actual output of the unit. The current input unit state is:
[0080]
[0081] Among them, W xi , W xf , W xo , W xC Is the connection x t The weight matrix to the three gates and the unit input, W hi , W hf , W ho , W hC It is connected t-1 The weight matrix to the three gates and the unit input, b i 、b f 、b o 、b C is the bias term of the three gates and the unit input. σ represents the activation function used by the gate, where the input gate and the forget gate are sigmoid functions and the output gate is the tanh function. Then, the unit output state is calculated:
[0082]
[0083] Among them, f t , C t-1 and C t Have the same vector dimensions. Finally, calculate the hidden layer output:
[0084] h t =o t ×tanh(C t )
[0085] A time series is an ordered sequence of a certain type of variable at equal time intervals, with autocorrelation and time series. Sequence prediction takes advantage of the characteristics of time series, retains the learning results of the training model in chronological order and sorts them, so that the future change behavior and probability of occurrence of the data flow can be estimated from a set of time series. In order to predict network traffic, an LSTM neural network is constructed using LSTM units. At time t, the input of the network is the observed historical data x t , the output is the predicted future data Through the above LSTM calculation, we get h t , calculate the network output:
[0086]
[0087] Among them, W is the weight matrix between the output layer and the hidden layer, and b is the bias term of the output layer. The network uses an encoder-decoder framework with multi-layer LSTM units: the extracted features are input as a time series {xt}t, and the prediction network consists of an encoder and a decoder, where the encoder reads the previous T timestamps {x1, x2, ..., x T} to train the LSTM unit, the decoder is in {x T-F+1 , x T-F+2 , ..., x T} Output the predicted next time series {x through the trained LSTM unit T+1 , x T+2 , ..., x T+F} and output it as the prediction result.
[0088] The attack classification model classifies network security events in the predicted time series to estimate the risk probability of being attacked in the next time period; after identifying the manifestations of attacks in different time periods, it uses them as the step process of a certain attack to complete the mining and identification matching between different continuous steps of the attack, and finally outputs the identified attack mode and the risk probability detection results of being attacked.
[0089] The attack classification model is implemented by the CNN (LetNet) network model;
[0090] The CNN model structure includes: input layer, convolution layer 1, pooling layer 1, convolution layer 2, pooling layer 2 and fully connected layer; the LSTM model structure includes: LSTM layer 1, LSTM layer 2, fully connected layer and output layer;
[0091] CNN is applied to the entire network traffic identification. Network traffic data usually has multi-dimensional features, such as source IP, destination IP, port number, protocol type, etc.
[0092] First, these traffic data with n-dimensional features are encoded using One-Hot Encoding (OHE);
[0093] Convert the one-hot encoded data into an image of size m×m, where The extra digits are set to 0;
[0094] The image is recognized by the trained CNN model, and the final output is a flow vector representing the classification code: it consists of multiple label vectors, and these grouping vectors represent the classification of each traffic packet, such as normal traffic, abnormal traffic, different types of attacks, etc.
[0095] 4) Attack effect evaluation;
[0096] 4.1) Establish an evaluation factor set based on the attack type;
[0097] Evaluation factors include: attack traffic size, attack duration, importance of the attacked system, and number of affected users;
[0098] 4.2) Determine the fuzzy judgment set;
[0099] 4.3) Establish a fuzzy relationship matrix and obtain the weight of each evaluation factor;
[0100] 4.4) Combining the fuzzy relationship matrix and the fuzzy weight vector, a fuzzy comprehensive operation is performed: the comprehensive evaluation vector obtained after the operation is used as the evaluation result;
[0101] For example, in the fuzzy comprehensive judgment of evaluating the effect of DDoS attacks, ① first establish the evaluation factor set: attack traffic size (such as GBps), attack duration, importance of the attacked system, and number of affected users; ② determine the fuzzy judgment set: for attack traffic size: {"very small", "small", "medium", "large", "very large"}, for attack duration: {"very short", "short", "medium", "long", "very long"}, for importance of the attacked system: {"low", "medium-low", "medium", "medium-high", "high"}, for number of affected users: {"very few", "few", "medium", "many", "many"}; ③ establish a fuzzy relationship matrix: assuming that in this DDoS attack, the attack traffic is 40GBps, the attack lasts for 2 hours, the attacked system is an important payment system, and the number of affected users is 20,000. Based on these data, fuzzy relationships can be established between each factor and the fuzzy judgment set. Input the fuzzy weight vector. Based on the detection driven by machine learning, the weights may be: attack traffic size: 0.3, attack duration: 0.2, importance of the attacked system: 0.4, number of affected users: 0.1; ④ Fuzzy comprehensive evaluation: Combine the fuzzy relationship matrix and the fuzzy weight vector to perform fuzzy comprehensive operation; ⑤ Obtain a clear evaluation result: Assume that the comprehensive evaluation vector obtained after the operation is {0.1, 0.2, 0.4, 0.2}, which means that the impact of this DDoS attack is "medium-high";
[0102] 5) Adjust the system's protection measures as needed based on the system's security protection capability assessment results.
[0103] Based on the evaluation results, the administrator may strengthen the system's protection measures or add higher bandwidth to it.
[0104] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.
Claims
1. A security protection capability evaluation method based on attack data analysis, characterized in that: The following steps are involved: 1) Collect network traffic and attack data from multiple heterogeneous data sources; the data sources include display consoles, computing service platforms, authentication and authorization services, firewalls, intrusion detection systems, and log files; 2) Data preprocessing; 3) Establish an attack detection prediction model to output the attack mode identified by detection and the risk probability detection results of being attacked; The attack detection prediction model consists of a time series prediction model and an attack classification model; Time series prediction model, used to predict the network traffic sequence in the next period; The attack classification model classifies network security events in the predicted time series to estimate the risk probability of being attacked in the next time period; After identifying the manifestations of attacks in different time periods, we use them as the steps of a certain attack process to complete the mining and identification matching between different continuous steps of the attack, and finally output the identified attack patterns and detection results; 4) Evaluate the attack effect based on the detection model identification results; 5) Adjust the system's protection measures as needed based on the system's security protection capability assessment results.
2. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: The time series prediction model is used to predict the network traffic sequence in the next period; the details are as follows: The real-time traffic data collected in time period t is preprocessed, and the time series-based predictor predicts the network traffic sequence Seq_p(t+1) for the next period according to Seq(t).
3. The security protection capability evaluation method based on attack data analysis according to claim 2 is characterized in that: The time series calculation method in the time series prediction model is as follows: The input sequence, hidden vector sequence and output vector sequence are represented by In, Hid and Out respectively, that is, the input sequence is In = (in1, in2, ..., in T ), hidden vector sequence Hid = (hid1, hid2, ..., hid T ) and the output vector sequence Out=(out1,out2,...,out T ), The sequence calculation method is as follows: hid t =σ(W in，hid in t +W n，hid hid t-1 +b hid ) out t =W hid，out hid t +b out Among them, the time period t = 1, 2, ..., T, σ is a nonlinear function, W is a weight matrix, and b is a bias term.
4. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: In the time series prediction model, at time t, the input is x t , the hidden layer output is h t , the previous output is h t-1 , the unit input state is The unit output state is C t , the previous state is C t-1 , the states of the three doors are i t 、f t and t , C in LSTM unit t and h t are all transmitted to the next neuron; At time t, the input to the network is data x t , the output is the predicted future data Calculate h through LSTM t , calculate the network output: Among them, W is the weight matrix between the output layer and the hidden layer, and b is the bias term of the output layer.
5. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: The time series prediction model is implemented by the LSTM model, which is as follows: the LSTM model structure includes: LSTM layer 1, LSTM layer 2, a fully connected layer and an output layer.
6. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: The attack classification model is implemented by a CNN network model; The CNN model structure includes: input layer, convolution layer 1, pooling layer 1, convolution layer 2, pooling layer 2 and fully connected layer.
7. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: The attack classification model identifies and classifies the attack performance of the predicted time series as follows: First, these traffic data with n-dimensional features are one-hot encoded; Convert the one-hot encoded data into an image of size m×m, where The extra digits are set to 0; The image is recognized by the trained CNN model, and the final output is a flow vector representing the classification code; the flow vector represents the classification of each traffic packet, including normal traffic, abnormal traffic, and different types of attack traffic.
8. The security protection capability evaluation method based on attack data analysis according to claim 1 is characterized in that: The step 4) performs attack effect evaluation based on the detection model identification result; the details are as follows: 4.1) Establishing an evaluation factor set based on the detection model recognition results; 4.2) Determine the fuzzy judgment set; 4.3) Establish a fuzzy relationship matrix and obtain the weight of each evaluation factor; 4.4) Combine the fuzzy relationship matrix and the fuzzy weight vector to perform fuzzy comprehensive operation: the comprehensive evaluation vector obtained after the operation is used as the evaluation result.
9. An electronic device, characterized in that: include: one or more processors; as well as a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are caused to perform the method according to any one of claims 1 to 8.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.