Asset operation risk prediction method and system based on flow autonomous learning

Abstract

The invention discloses an asset operation risk prediction method and system based on flow autonomous learning, and relates to the field. The asset operation risk prediction method based on traffic autonomous learning is characterized by comprising the following steps: acquiring network traffic data related to asset operation; performing deep learning and feature analysis on the network traffic data related to the asset operation, and extracting traffic acquisition equipment attributes of a traffic acquisition equipment layer, features of a service layer and asset interaction features of a business layer; generating an asset topological structure based on the asset interaction characteristics; performing feature analysis on the asset features, the features of the service layer and the asset topological structure by using a deep learning technology, and extracting multiple groups of asset abnormal features and multiple groups of asset normal features; and constructing an asset operation risk prediction model based on the multiple groups of asset abnormal features and the multiple groups of asset normal features. According to the invention, different network assets can be effectively distinguished and managed, so that risk control can be better carried out.

Description

Technical Field

[0001] The present invention relates to the field of network asset analysis, and in particular to a method and system for predicting asset operation risks based on traffic autonomous learning. Background Art

[0002] Network assets refer to entities that exist in the form of a network and can perform independent functions, including traffic collection equipment, services and applications. With the continuous improvement of the level of informatization, the number of assets involved in the organization's intranet has also increased rapidly, and the complexity has become increasingly higher, and the difficulty of management has also increased. Traditional network monitoring and management rely on manual maintenance by administrators, which is difficult to cope with challenges in large-scale network changes and distributed environments. The increase in market demand and the increase in demand for network security have made the security management of asset attributes in the network an urgent problem to be solved. Prior art CN102680570A "A network anomaly detection method based on user behavior analysis" discloses a network anomaly detection method based on user behavior analysis. The method collects the traffic data of the gateway, establishes a normal behavior model, and uses a clustering algorithm to analyze and compare the behavior of the current traffic, finds abnormal traffic, and realizes the detection of malicious intrusion behavior. However, the invention only focuses on the extraction of traffic features and the calculation of similarity, and cannot effectively distinguish and identify the feature differences of different types of network assets, which will lead to a high false alarm rate. Therefore, there is a need for a method and system that can realize active learning of network asset attributes, which can effectively distinguish and manage different network assets, so as to better perform risk control and troubleshooting. Summary of the invention

[0003] The technical problem to be solved by the present invention is that the network anomaly detection method based on user behavior analysis in the prior art cannot effectively distinguish and identify the characteristic differences of different types of network assets, resulting in a high false alarm rate. The purpose is to provide a method that can actively learn the attributes of network assets, which can effectively distinguish and manage different network assets so as to better control risks and solve the above technical problems.

[0004] The present invention is achieved through the following technical solutions:

[0005] An asset operation risk prediction method based on traffic autonomous learning, comprising:

[0006] Obtain network traffic data related to asset operations;

[0007] Perform deep learning and feature analysis on the network traffic data related to the asset operation, extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer;

[0008] generating an asset topology structure based on the asset interaction characteristics;

[0009] The asset characteristics, the service layer characteristics and the asset topology structure are analyzed using deep learning technology to extract multiple groups of abnormal asset characteristics and multiple groups of normal asset characteristics; an asset operation risk prediction model is constructed based on the multiple groups of abnormal asset characteristics and multiple groups of normal asset characteristics.

[0010] The acquisition of network traffic data related to asset operations includes:

[0011] The network traffic data of any one or more asset operations in daily asset management, asset depreciation management, asset transfer, asset classification and asset evaluation are collected through network logs.

[0012] The deep learning and feature analysis of the network traffic data related to the asset operation is performed to extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer, including:

[0013] Analyze the traffic collection device layer information, establish traffic collection device fingerprints, and identify abnormal behaviors of traffic collection devices through anomaly detection algorithms;

[0014] Parse the requests and responses of the service layer interactions and build a service layer model to extract asset trading node types, API call patterns, and dependencies between asset trading nodes;

[0015] Analyze business layer data, capture the operation types, related assets, upstream and downstream asset calls, transaction subject information and risk assessment indicator data of multiple asset operations, form a business process diagram, and apply graph neural network to build an asset operation risk assessment model to identify key asset transaction nodes and abnormal asset transaction paths.

[0016] The asset operation risk prediction model is constructed based on multiple sets of asset abnormal features and multiple sets of asset normal features, including:

[0017] Based on the abnormal behavior of the traffic collection device, the asset transaction node type, the API call mode and the dependencies between the asset transaction nodes, the key asset transaction nodes of the multiple asset operations and the abnormal asset transaction paths, the deep learning model is trained to obtain an asset operation risk prediction model.

[0018] The analyzing of the traffic collection device layer information, establishing the traffic collection device fingerprint, and identifying the abnormal behavior of the traffic collection device through an abnormal detection algorithm include:

[0019] Establish a traffic collection device fingerprint based on the IP address, MAC address and port number of the network traffic data to identify the type of traffic collection device, operating system and hardware model; and count the known fault history data of each traffic collection device type, each operating system and each hardware model to identify abnormal behavior of the traffic collection device.

[0020] The request and response of the parsing service layer interaction is constructed to construct a service layer model to extract the asset transaction node type, API call mode and the dependency relationship between asset transaction nodes, including:

[0021] Collect the interaction logs of the service layer, perform structured analysis on the interaction logs, and extract the URL and HTTP status code; identify the asset transaction node type and establish the API call mode based on the method of the requested URL and HTTP status code; analyze the call relationship between asset transaction nodes by tracking the flow and response of requests; use the graph database to store asset transaction nodes and call edges, and build a service dependency graph; integrate the service dependency graph of the service layer to build a service layer model.

[0022] The tracking request flow and response and analyzing the calling relationship between asset trading nodes include: extracting the time node of successful asset trading node calling according to the calling path, response time and abnormal information of each asset trading node for multiple requests.

[0023] An asset operation risk prediction system based on traffic autonomous learning, comprising:

[0024] Data collection module: obtains network traffic data related to asset operations;

[0025] Feature extraction module: performs deep learning and feature analysis on the network traffic data related to the asset operation, extracts the traffic collection device attributes of the traffic collection device layer, the features of the service layer, and the asset interaction features of the business layer;

[0026] Topology generation module: generating an asset topology structure based on the asset interaction characteristics;

[0027] Model building module: Use deep learning technology to perform feature analysis on the asset characteristics, the service layer characteristics and the asset topology structure, extract multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics; build an asset operation risk prediction model based on the multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics.

[0028] An electronic flow collection device includes a memory, a processor, and a computer program running on the processor. When the processor executes the computer program, the steps of the asset operation risk prediction method based on flow autonomous learning are implemented.

[0029] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an asset operation risk prediction method based on flow autonomous learning.

[0030] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0031] The present invention provides an asset operation risk prediction method based on traffic autonomous learning, which extracts the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer by performing deep learning and feature analysis on the network traffic data related to asset operation; generates an asset topology structure based on the asset interaction characteristics; thereby using deep learning technology to perform feature analysis on the asset characteristics, the characteristics of the service layer, and the asset topology structure, extracts multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics; and constructs an asset operation risk prediction model based on the multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics. The present invention can effectively distinguish and identify the feature differences of different types of network assets, so as to better perform risk control and troubleshooting, and solve the problem of high false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0033] Figure 1 This is a flowchart of an asset operation risk prediction method based on traffic autonomous learning in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0035] Example

[0036] like Figure 1 As shown, the embodiment of the present application provides an asset operation risk prediction method based on traffic autonomous learning, including:

[0037] Obtain network traffic data related to asset operations;

[0038] Perform deep learning and feature analysis on the network traffic data related to the asset operation, extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer;

[0039] generating an asset topology structure based on the asset interaction characteristics;

[0040] The asset characteristics, the service layer characteristics and the asset topology structure are analyzed using deep learning technology to extract multiple groups of abnormal asset characteristics and multiple groups of normal asset characteristics; an asset operation risk prediction model is constructed based on the multiple groups of abnormal asset characteristics and multiple groups of normal asset characteristics.

[0041] First, deploy network sniffing tools such as Wireshark to asset network service nodes to collect network traffic data. Clean the raw data and remove irrelevant information, such as broadcast packets and duplicate packets.

[0042] Traffic collection device layer feature extraction: Analyze traffic collection device layer information such as IP address, MAC address, port number, etc., establish traffic collection device fingerprints, and identify traffic collection device type, operating system, hardware model and other attributes. Identify potential abnormal behaviors of traffic collection devices through anomaly detection algorithms (such as Isolation Forest). Service layer feature analysis: Parse the requests and responses of service layer interactions, extract features such as URL, HTTP method, HTTP status code, build service layer models, identify asset transaction node types, API call patterns, and dependencies between asset transaction nodes. Business layer relationship modeling: Analyze business layer data such as transaction ID, user behavior sequence, timestamp, etc., apply graph neural network (GNN) to capture the interaction relationship between multiple asset operations, form a business process diagram, and identify key asset transaction nodes and abnormal paths of asset transactions. Deep learning model construction and training: Use the above extracted features and relationships to build deep learning models, such as long short-term memory network (LSTM) or self-attention model (Transformer), to learn asset attributes and interaction relationship patterns. Train through supervised learning or unsupervised learning methods to identify normal patterns and abnormal behaviors. Monitoring and early warning system: Integrate the trained model into the monitoring system to analyze network traffic in real time. Once abnormalities in traffic collection equipment, service interruptions, or business process abnormalities are detected, an early warning will be issued immediately to provide decision support.

[0043] Traffic collection device layer information may include any one or more of the following attributes: hardware identification features, MAC address and manufacturer information (parsed through OUI library), traffic collection device type fingerprint (identifying IoT traffic collection devices / servers / workstations based on traffic patterns), physical location features (inferred through LLDP protocol or network layer), operating system features, TCP / IP protocol stack fingerprint (identified through TCP window size, TTL value, etc.), OS type identification in DHCP requests, specific protocol behavior features (such as Windows SMB protocol version), network interface features, network interface card rate mode (identified through traffic burst mode), VLAN tag and priority configuration, and physical port active time mode (periodic online / continuous online).

[0044] The requests and responses of the service layer include one or more of the following attributes: protocol interaction characteristics, open port and service association (such as port 22 → SSH service, but the actual application needs to be distinguished), TLS / SSL certificate information (organization name, validity period, key algorithm), DNS query mode (domain name resolution frequency, CNAME chain relationship), application behavior characteristics, User-Agent fingerprint in HTTP traffic, API call sequence mode (such as URL path structure of RESTful interface), database query statement characteristics (SQL syntax template recognition), communication mode characteristics, session duration and traffic throughput distribution, cross-protocol association (such as WebSocket connection embedded in HTTP traffic), abnormal protocol load (such as ICMP tunnel traffic of non-standard ports). Based on the above multiple attributes, the source of service agencies can be identified and distinguished, and service agencies can be classified, so as to obtain different types of API call patterns and dependencies between asset trading nodes.

[0045] Among them, the API call mode usually uses the POST, GET, DELETE, PUT and other methods of the HTTP protocol for calling. Whether the service agency is directly subordinate to the superior or symbiotic relationship can be used to determine whether it is a dependent relationship or independent of each other. Specific examples are as follows: the internal agencies of power grid enterprises belong to a directly subordinate relationship, and the power trading agency and the power trading agency belong to a relatively independent relationship. The independent relationship between carbon emission rights trading intermediary service agencies: In carbon emission rights trading, intermediary service agencies include emission rights exchanges, brokerage companies, law firms and commercial banks, which provide platforms, information and settlement services for transactions. The service dependency relationship between securities service agencies and securities companies: Securities service agencies help securities companies understand market dynamics and identify investment opportunities by providing professional services. The regulatory dependency relationship between securities service agencies and regulatory authorities. The service dependency relationship between the public resource trading center and related parties: As a public service platform, the public resource trading center adheres to and strengthens the positioning of public service functions and provides comprehensive services to market entities, the general public and administrative regulatory departments. In this way, asset trading nodes with dependencies are associated to facilitate the judgment of transaction risks.

[0046] The acquisition of network traffic data related to asset operations includes:

[0047] The network traffic data of any one or more asset operations in daily asset management, asset depreciation management, asset transfer, asset classification and asset evaluation are collected through network logs.

[0048] The deep learning and feature analysis of the network traffic data related to the asset operation is performed to extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer, including:

[0049] Analyze the traffic collection device layer information, establish traffic collection device fingerprints, and identify abnormal behaviors of traffic collection devices through anomaly detection algorithms;

[0050] Parse the requests and responses of the service layer interactions and build a service layer model to extract asset trading node types, API call patterns, and dependencies between asset trading nodes;

[0051] Analyze business layer data, capture the operation types, related assets, upstream and downstream asset calls, transaction subject information and risk assessment indicator data of multiple asset operations, form a business process diagram, and apply graph neural network to build an asset operation risk assessment model to identify key asset transaction nodes and abnormal asset transaction paths.

[0052] The asset operation risk prediction model is constructed based on multiple sets of asset abnormal features and multiple sets of asset normal features, including:

[0053] Based on the abnormal behavior of the traffic collection device, the asset transaction node type, the API call mode and the dependencies between the asset transaction nodes, the key asset transaction nodes of the multiple asset operations and the abnormal asset transaction paths, the deep learning model is trained to obtain an asset operation risk prediction model.

[0054] The analyzing of the traffic collection device layer information, establishing the traffic collection device fingerprint, and identifying the abnormal behavior of the traffic collection device through an abnormal detection algorithm include:

[0055] Establish a traffic collection device fingerprint based on the IP address, MAC address and port number of the network traffic data to identify the type of traffic collection device, operating system and hardware model; and count the known fault history data of each traffic collection device type, each operating system and each hardware model to identify abnormal behavior of the traffic collection device.

[0056] Fingerprint generation method: Extract the device type, operating system and hardware model of the device from the network traffic data, and generate a unique device fingerprint through the extracted features through a hash algorithm. Among them, the device type of the traffic device is such as routers, switches, cameras, servers, etc.; operating systems are such as Windows, Linux, macOS, etc.; the manufacturer of the device can be identified by the prefix (OUI) of the MAC address, and the existing hardware model can be further inferred by combining the traffic characteristics. According to the known fault history data, the behavioral characteristics, fault type, occurrence time, duration, repair method, etc. are identified. Through statistical analysis, the common failure modes of different device types, operating systems and hardware models are identified. Among them, the behavioral characteristics are such as port usage mode, protocol distribution, traffic pattern, etc. By constructing device fingerprints, identifying device types, operating systems and hardware models, and combining fault history data for statistical analysis, abnormal behaviors of traffic collection devices can be effectively identified.

[0057] The request and response of the parsing service layer interaction is constructed to construct a service layer model to extract the asset transaction node type, API call mode and the dependency relationship between asset transaction nodes, including:

[0058] Collect the interaction logs of the service layer, perform structured analysis on the interaction logs, and extract the URL and HTTP status code; identify the asset transaction node type and establish the API call mode based on the method of the requested URL and HTTP status code; analyze the call relationship between asset transaction nodes by tracking the flow and response of requests; use the graph database to store asset transaction nodes and call edges, and build a service dependency graph; integrate the service dependency graph of the service layer to build a service layer model.

[0059] The tracking request flow and response and analyzing the calling relationship between asset trading nodes include: extracting the time node of successful asset trading node calling according to the calling path, response time and abnormal information of each asset trading node for multiple requests.

[0060] Identify the specified asset trading node type based on a custom method of the requested URL and HTTP status code. Establish an API call mode for data transmission and function calls between different software applications for asset trading nodes, such as data exchange: API calls are the main way to transmit data between different applications. Through API calls, applications can obtain data from other applications, or send their own data to other applications. Functional extension: API calls enable developers to use the functions of other applications in their own applications, thereby expanding the functions and capabilities of their own applications. Interoperability: API calls enable different applications to interact with each other to achieve data sharing and functional linkage. API Monitor: is a tool for monitoring and analyzing application program interface (API) calls. API Monitor usually has the following functions: intercepting and recording API calls, debugging and analysis, performance monitoring, data visualization, and compatibility analysis.

[0061] In summary, the embodiment of the present application provides an asset operation risk prediction method based on autonomous learning of traffic: by performing deep learning and feature analysis on network traffic data related to asset operation, the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer are extracted; the asset topology structure is generated based on the asset interaction characteristics; thereby using deep learning technology to perform feature analysis on asset characteristics, service layer characteristics, and asset topology structure, extract multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics; and construct an asset operation risk prediction model based on multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics. The present invention can effectively distinguish and identify the feature differences of different types of network assets, so as to better control risks and solve the problem of high false alarm rate.

[0062] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for predicting asset operation risk based on traffic autonomous learning, characterized in that: include: Obtain network traffic data related to asset operations; Perform deep learning and feature analysis on the network traffic data related to the asset operation, extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer; generating an asset topology structure based on the asset interaction characteristics; Using deep learning technology to perform feature analysis on the asset interaction features, the service layer features, and the asset topology structure, and extract multiple groups of asset abnormal features and multiple groups of asset normal features; An asset operation risk prediction model is constructed based on multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics.

2. According to claim 1, a method for predicting asset operation risk based on traffic autonomous learning is characterized in that: The acquisition of network traffic data related to asset operations includes: The network traffic data of any one or more asset operations in daily asset management, asset depreciation management, asset transfer, asset classification and asset evaluation are collected through network logs.

3. According to claim 1, a method for predicting asset operation risk based on traffic autonomous learning is characterized in that: The deep learning and feature analysis of the network traffic data related to the asset operation is performed to extract the traffic collection device attributes of the traffic collection device layer, the characteristics of the service layer, and the asset interaction characteristics of the business layer, including: Analyze the traffic collection device layer information, establish traffic collection device fingerprints, and identify abnormal behaviors of traffic collection devices through anomaly detection algorithms; Parse the requests and responses of the service layer interactions and build a service layer model to extract asset trading node types, API call patterns, and dependencies between asset trading nodes; Analyze business layer data, capture the operation types, related assets, upstream and downstream asset calls, transaction subject information and risk assessment indicator data of multiple asset operations, form a business process diagram, and apply graph neural network to build an asset operation risk assessment model to identify key asset transaction nodes and abnormal asset transaction paths.

4. The asset operation risk prediction method based on traffic autonomous learning according to claim 3 is characterized in that: The asset operation risk prediction model is constructed based on multiple sets of asset abnormal features and multiple sets of asset normal features, including: Based on the abnormal behavior of the traffic collection device, the asset transaction node type, the API call mode and the dependencies between the asset transaction nodes, the key asset transaction nodes of the multiple asset operations and the abnormal asset transaction paths, the deep learning model is trained to obtain an asset operation risk prediction model.

5. The asset operation risk prediction method based on traffic autonomous learning according to claim 3 is characterized in that: The analyzing of the traffic collection device layer information, establishing the traffic collection device fingerprint, and identifying the abnormal behavior of the traffic collection device through an abnormal detection algorithm include: Establish a traffic collection device fingerprint based on the IP address, MAC address and port number of the network traffic data to identify the type of traffic collection device, operating system and hardware model; and count the known fault history data of each traffic collection device type, each operating system and each hardware model to identify abnormal behavior of the traffic collection device.

6. The asset operation risk prediction method based on traffic autonomous learning according to claim 3 is characterized in that: The request and response of the parsing service layer interaction is constructed to construct a service layer model to extract the asset transaction node type, API call mode and the dependency relationship between asset transaction nodes, including: Collect the interaction logs of the service layer, perform structured analysis on the interaction logs, and extract the URL and HTTP status code; identify the asset transaction node type and establish the API call mode based on the method of the requested URL and HTTP status code; analyze the call relationship between asset transaction nodes by tracking the flow and response of requests; use the graph database to store asset transaction nodes and call edges, and build a service dependency graph; integrate the service dependency graph of the service layer to build a service layer model.

7. The asset operation risk prediction method based on traffic autonomous learning according to claim 6 is characterized in that: The tracking request flow and response and analyzing the calling relationship between asset trading nodes include: extracting the time node of successful asset trading node calling according to the calling path, response time and abnormal information of each asset trading node for multiple requests.

8. An asset operation risk prediction system based on traffic autonomous learning, characterized in that: include: Data collection module: obtains network traffic data related to asset operations; Feature extraction module: performs deep learning and feature analysis on the network traffic data related to the asset operation, extracts the traffic collection device attributes of the traffic collection device layer, the features of the service layer, and the asset interaction features of the business layer; Topology generation module: generating an asset topology structure based on the asset interaction characteristics; Model building module: using deep learning technology to perform feature analysis on the asset interaction features, the service layer features and the asset topology structure, and extract multiple groups of asset abnormal features and multiple groups of asset normal features; An asset operation risk prediction model is constructed based on multiple groups of asset abnormal characteristics and multiple groups of asset normal characteristics.

9. An electronic flow collection device, comprising a memory, a processor, and a computer program running on the processor, characterized in that: When the processor executes the computer program, the steps of an asset operation risk prediction method based on traffic autonomous learning as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of an asset operation risk prediction method based on traffic autonomous learning as described in any one of claims 1 to 7 are implemented.

Images