Abnormal network access monitoring method and device based on extreme learning and storage medium

Abstract

The invention discloses an abnormal network access monitoring method and device based on extreme learning and a storage medium. The invention provides an abnormal network access monitoring method based on extreme learning. In a current rapid and changeable network activity environment, an abnormal network behavior monitoring model with an excellent fitting effect is trained at an extremely high speed through over-limit learning, and an abnormal network access behavior can be rapidly responded and timely and effectively monitored. According to the method, the monitoring efficiency and accuracy are effectively improved, and powerful support and guarantee are provided for guaranteeing the safety and stability of a network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method, a device and a storage medium for monitoring abnormal network access based on over-limit learning. Background Art

[0002] Providing feedback on abnormal network access quickly and accurately is the key to network security access monitoring. Most of the existing network access behavior analysis is based on deep learning, which has a long training cycle, huge resource consumption, and slow response time. It is not well adapted to the rapidly changing network activities. Therefore, how to quickly and accurately implement effective monitoring of abnormal network access has become an urgent problem that needs to be solved. Summary of the invention

[0003] The present invention provides an abnormal network access monitoring method, device and storage medium based on over-limit learning, so as to solve the problem that the existing abnormal network access cannot be effectively and accurately monitored.

[0004] In the first aspect, the present invention provides a method for monitoring abnormal network access based on over-limit learning, the method comprising: extracting features of network access to obtain the source address, destination address, protocol, port, time and packet length of the network access; using a min-max normalization method to perform feature extraction on the extracted features;

[0005] x ` = x-X min

[0006] The min-max normalization method is X max -X min , where x is the original feature, X max is the maximum value that the feature can have, X min is the minimum value that the feature can appear, x ` is the converted feature; the converted features are fused to obtain fused features, and the fused features are used to train the ELM, so as to monitor network access in real time through the trained ELM.

[0007] Optionally, the use of a min-max normalization method to perform feature conversion on the extracted features includes: The extracted features are transformed.

[0008] Optionally, the source address and the destination address are both composed of four bytes, and the maximum value of each byte is set to 255;

[0009] The protocol occupies one byte, and the maximum value is set to 255;

[0010] The port occupies two bytes, and the maximum value is set to 65535;

[0011] The maximum value of the month is set to 12, the maximum value of the day is set to 31, the maximum value of the hour is set to 24, the maximum value of the minute is set to 60, and the maximum value of the second is set to 60;

[0012] The maximum value of the packet length is set to the network MTU value of 65535.

[0013] Optionally, the excessive learning model includes a single hidden layer feedforward network and a multi-hidden layer feedforward network, and the excessive learning model is obtained by layer-by-layer training.

[0014] Optionally, training the extreme learning model ELM includes:

[0015] The hidden nodes and neurons of the ELM adopt Bartlett theory to ensure generalization performance, wherein the overall structure of ELM is: G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples ELM contains n input attributes x i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m , x j is the input feature, j = 1, 2, ..., N, and the output is O j , the objective function is

[0016] Among them, a i =[a i1 ,a i2 ,...,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,βim ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, G(·) is the activation function;

[0017] The sigmoid function is used as the activation function: Abbreviated as Hβ=Y; where,

[0018] Matrix H is the hidden layer output matrix, and Y is the target output matrix;

[0019] The output weights β are calculated by solving a linear least squares problem: in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

[0020] In a second aspect, the present invention provides an abnormal network access monitoring device based on over-limit learning, the device comprising: a feature extraction module for extracting features of network access to obtain the source address, destination address, protocol, port, time and packet length of the network access; a data processing module for converting the extracted features using a min-max normalization method, the min-max normalization method being Among them, x is the original feature, X max is the maximum value that the feature can have, X min

[0021] is the minimum value of the feature, x is the converted feature; the data fusion module is used to fuse the converted features to obtain fused features; the data monitoring module is used to train the ELM using the fused features, so as to monitor network access in real time through the trained ELM.

[0022] Optionally, the data processing module is further configured to: The extracted features are transformed.

[0023] Optionally, the excessive learning model includes a single hidden layer feedforward network and a multi-hidden layer feedforward network, and the excessive learning model is obtained by layer-by-layer training.

[0024] Optionally, the data monitoring module is further used to train the ELM, wherein both the hidden nodes and neurons of the ELM adopt Bartlett theory to ensure generalization performance, wherein the overall structure of the ELM is: G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples ELM contains n input attributes x i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m , x j is the input feature, j = 1, 2, ..., N, and the output is O j , the objective function is Among them, a i =[a i1 ,a i2 ,...,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,β im ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, G(·) is the activation function; the sigmoid function is used as the activation function: Abbreviated as Hβ=Y; where,

[0025] The matrix H is the hidden layer output matrix, and Y is the target output matrix. The output weight β is calculated by solving the linear least squares problem: in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

[0026] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, the program implements any of the above-mentioned abnormal network access monitoring methods based on over-limit learning.

[0027] The beneficial effects of the present invention are as follows:

[0028] The present invention provides an abnormal network access monitoring method based on super-limited learning. In the current rapidly changing network activity environment, super-limited learning can train an abnormal network behavior monitoring model with excellent fitting effect at a very fast speed, and can also respond quickly to abnormal network access behavior and provide timely and effective monitoring. This method effectively improves the efficiency and accuracy of monitoring, and provides strong support and guarantee for ensuring the security and stability of the network environment.

[0029] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0031] Figure 1 It is a flow chart of an abnormal network access monitoring method based on over-limit learning provided by an embodiment of the present invention;

[0032] Figure 2 It is a flowchart of another abnormal network access monitoring method based on over-limit learning provided by an embodiment of the present invention;

[0033] Figure 3 It is a flow chart of an abnormal network access monitoring device based on over-limit learning provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and do not limit the present invention.

[0035] Existing abnormal network access monitoring methods include: based on behavioral analysis, traffic monitoring and log analysis, but most of the existing network access behavior analysis is based on deep learning, and its training cycle is long, resource consumption is huge, and response time is slow. Therefore, it is not well adapted to rapidly changing network activities. Traffic monitoring and log analysis lack the assistance of artificial intelligence methods. It often requires a lot of manpower, material resources and energy. To this end, the present invention focuses on solving the problems of slow response time and low precision in abnormal network behavior monitoring. A method for monitoring abnormal network access based on super-limit learning is proposed. Through super-limit learning, an abnormal network behavior monitoring model with excellent fitting effect can be trained at an extremely fast speed, and abnormal network access behavior can be quickly responded to and monitored in a timely and effective manner. This method effectively improves the efficiency and accuracy of monitoring, and provides strong support and guarantee for ensuring the security and stability of the network environment. The method described in the present invention will be explained and illustrated in detail below:

[0036] The embodiment of the present invention provides a method for monitoring abnormal network access based on over-limit learning. Figure 1 and Figure 2 , the method comprising:

[0037] First, feature extraction is performed on network access to obtain the source address, destination address, protocol, port, time and packet length of network access; wherein, the source address and the destination address are both composed of four bytes, and the maximum value of each byte is set to 255; the protocol occupies one byte, and the maximum value is set to 255; the port occupies two bytes, and the maximum value is set to 65535; the maximum value of the month in the time is set to 12, the maximum value of the day is set to 31, the maximum value of the hour is set to 24, the maximum value of the minute is set to 60, and the maximum value of the second is set to 60; the maximum value of the packet length is set to the network MTU value of 65535. Of course, the above is only an example of the present invention. In specific implementation, those skilled in the art can arbitrarily set the source address, destination address, protocol, port, time and packet length according to specific needs, and the present invention does not make specific limitations on this.

[0038] Secondly, the min-max normalization method is used to transform the extracted features. The min-max normalization method is: Among them, x is the original feature, X max is the maximum value that the feature can have, X min is the minimum value that the feature can appear, and x` is the transformed feature;

[0039] For convenience, the method described in the embodiment of the present invention is based on The extracted features are transformed.

[0040] Then, the converted features are fused to obtain fused features, and the fused features are used to train the ELM, so as to monitor network access in real time through the trained ELM.

[0041] The fusion feature described in the embodiment of the present invention is to directly merge the feature set of each feature into one set, that is, to convert and calculate each feature and then put it into a vector.

[0042] In general, the method described in the embodiment of the present invention is aimed at the existing identification of network access behavior. Even if abnormal access is monitored, the abnormal access has already continued for a period of time. That is, in the existing rapidly changing network environment, it is impossible to respond quickly. The present invention proposes a method based on ultra-limited learning to supervise network access behavior. Since ultra-limited learning uses the least squares method for fitting, there is only a single-layer neural network with fewer parameters and less calculation. Therefore, the method described in the embodiment of the present invention can identify network behavior before the network connection is established. Not only can abnormal access be completely avoided, but also the delay of normal access will not be increased.

[0043] The method described in the embodiment of the present invention will be explained and illustrated in detail below through a specific example:

[0044] In view of the problems of slow response time and low precision in the existing monitoring of abnormal network behavior. The embodiment of the present invention provides an abnormal network access monitoring method based on super-limited learning. In the current rapidly changing network activity environment, super-limited learning has shown significant advantages. It can not only train an abnormal network behavior monitoring model with excellent fitting effect at a very fast speed, but also respond quickly to abnormal network access behavior and provide timely and effective monitoring. This method effectively improves the efficiency and accuracy of monitoring, and provides strong support and guarantee for ensuring the security and stability of the network environment.

[0045] The abnormal network behavior monitoring framework based on over-limit learning proposed in the present invention is as follows Figure 1 The detailed introduction is as follows:

[0046] 1) Feature transformation

[0047] The feature transformation also uses the min-max normalization method, that is,

[0048] Among them, x is the original feature, X max is the maximum value that the feature can have, X min This feature can

[0049] `

[0050] The minimum value that appears, x is the converted feature. In the present invention, the minimum value of all features is assumed to be 0, that is, for each feature group, only the maximum value is different. Formula (1) can be rewritten as:

[0051] Source address and destination address: IPv4 network addresses are composed of four bytes, and the maximum value of each byte is set to 255;

[0052] Protocol: The network protocol occupies one byte, and the maximum value is set to 255;

[0053] Port: The port number occupies two bytes, and the maximum value is set to 65535;

[0054] Time: Check the year feature, set the maximum value for month to 12, the maximum value for day to 31, the maximum value for hour to 24, the maximum value for minute to 60, and the maximum value for second to 60;

[0055] Packet length: The maximum value is set to the network MTU value of 65535.

[0056] The structure of the extreme learning model in the embodiment of the present invention, that is, the extreme learning machine (ELM), can be summarized as a single hidden layer feedforward network and a multi-hidden layer feedforward network, both of which are white box models and trained layer by layer. The hidden nodes and neurons of ELM do not require iterative tuning, and the Bartlett theory is used to ensure generalization performance. The overall structure of ELM is as follows:

[0057] Among them, G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples x contains n input attributes i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m .x j is the input of formula (1), j = 1, 2, ..., N, and the output is O j , the objective function is therefore:

[0058] Among them, a i =[ai1 ,a i2 ,...,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,β im ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, and G(·) is the activation function. The sigmoid function is usually used as the activation function:

[0059] Formulas (3), (4), and (5) can be abbreviated as:

[0060] Hβ=Y (6)

[0061] in,

[0062] The matrix H is the hidden layer output matrix, and Y is the target output matrix. The output weight β is calculated by solving the linear least squares problem:

[0063] in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

[0064] In general, the present invention mainly solves the problem that when monitoring network access behavior, the monitoring behavior cannot be completed before the network connection is established. A method for monitoring abnormal network behavior based on super-limit learning is proposed. Since super-limit learning uses the least squares method for fitting, there is only a single-layer neural network with fewer parameters and less calculation. It can identify network behavior before the network connection is established. It can not only completely avoid abnormal access, but also will not increase the delay of normal access.

[0065] Accordingly, the embodiment of the present invention also provides an abnormal network access monitoring device based on over-limit learning, see Figure 3, the device comprises:

[0066] The feature extraction module is used to extract the features of network access and obtain the source address, destination address, protocol, port, time and packet length of the network access;

[0067] The data processing module is used to perform feature conversion on the extracted features using the min-max normalization method. The min-max normalization method is Among them, x is the original feature, X max is the maximum value that the feature can have, X min is the minimum value that the feature can appear, x ` is the transformed feature;

[0068] A data fusion module is used to fuse the converted features to obtain fused features;

[0069] The data monitoring module is used to train the ELM by using the fusion features, so as to monitor the network access in real time through the trained ELM.

[0070] In the specific implementation, in order to simplify the calculation, the data processing module in the embodiment of the present invention is based on The extracted features are transformed.

[0071] In addition, in a specific implementation, the data monitoring module in the embodiment of the present invention is also used to train the ELM;

[0072] The hidden nodes and neurons of the ELM of the embodiment of the present invention all adopt Bartlett theory to ensure generalization performance, wherein the overall structure of ELM is: G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples ELM contains n input attributes x i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m , x j is the input feature, j = 1, 2, ..., N, and the output is O j , the objective function is Among them, a i =[a i1 ,a i2 ,...,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,β im ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, G(·) is the activation function; the sigmoid function is used as the activation function: Abbreviated as Hβ=Y; where, The matrix H is the hidden layer output matrix, and Y is the target output matrix. The output weight β is calculated by solving the linear least squares problem: in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

[0073] The relevant contents of the embodiments of the device of the present invention can be understood by referring to the embodiments of the method of the present invention, and will not be discussed in detail here.

[0074] In addition, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the abnormal network access monitoring method based on over-limit learning described in any one of the method embodiments of the present invention is implemented. For details, please refer to the method embodiments of the present invention for understanding, and no detailed discussion is given here.

[0075] Although the preferred embodiments of the present invention have been disclosed for illustrative purposes, those skilled in the art will appreciate that various modifications, additions and substitutions are possible, and thus, the scope of the present invention should not be limited to the above embodiments.

Claims

1. A method for monitoring abnormal network access based on super-limited learning, characterized in that: include: Extract features of network access to obtain the source address, destination address, protocol, port, time and packet length of network access; The min-max normalization method is used to transform the extracted features. The min-max normalization method is: Among them, x is the original feature, X max is the maximum value that the feature can have, X min is the minimum value that the feature can appear, and x` is the transformed feature; The converted features are fused to obtain fused features, and the fused features are used to train the ELM, so as to monitor network access in real time through the trained ELM.

2. The method according to claim 1, characterized in that The method of using the min-max normalization method to perform feature conversion on the extracted features includes: according to The extracted features are transformed.

3. The method according to claim 1 or 2, characterized in that: The source address and the destination address are both composed of four bytes, and the maximum value of each byte is set to 255; The protocol occupies one byte, and the maximum value is set to 255; The port occupies two bytes, and the maximum value is set to 65535; The maximum value of the month is set to 12, the maximum value of the day is set to 31, the maximum value of the hour is set to 24, the maximum value of the minute is set to 60, and the maximum value of the second is set to 60; The maximum value of the packet length is set to the network MTU value of 65535.

4. The method according to claim 1 or 2, characterized in that: The excessive learning model includes a single hidden layer feedforward network and a multi-hidden layer feedforward network, and the excessive learning model is obtained by layer-by-layer training.

5. The method according to claim 1 or 2, characterized in that: Training the ELM includes: The hidden nodes and neurons of the ELM adopt Bartlett theory to ensure generalization performance, wherein the overall structure of ELM is: G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples ELM contains n input attributes x i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m , x j is the input feature, j = 1, 2, ..., N, and the output is O j , the objective function is Among them, a i =[a i1 ,a i2 ,…,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,β im ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, G(·) is the activation function; The sigmoid function is used as the activation function: Abbreviated as Hβ=Y; where, Matrix H is the hidden layer output matrix, and Y is the target output matrix; The output weights β are calculated by solving a linear least squares problem: in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

6. An abnormal network access monitoring device based on super-limited learning for implementing any of the methods described in claims 1-5, characterized in that: The device comprises: The feature extraction module is used to extract the features of network access and obtain the source address, destination address, protocol, port, time and packet length of the network access; The data processing module is used to perform feature conversion on the extracted features using the min-max normalization method. The min-max normalization method is Among them, x is the original feature, X max is the maximum value that the feature can have, X min is the minimum value that the feature can appear, and x` is the transformed feature; A data fusion module is used to fuse the converted features to obtain fused features; The data monitoring module is used to train the ELM by using the fusion features, so as to monitor the network access in real time through the trained ELM.

7. The device according to claim 6, characterized in that The data processing module is also used to: The extracted features are transformed.

8. The device according to claim 6 or 7, characterized in that The excessive learning model includes a single hidden layer feedforward network and a multi-hidden layer feedforward network, and the excessive learning model is obtained by layer-by-layer training.

9. The device according to claim 6 or 7, characterized in that The data monitoring module is also used to train the ELM, and the hidden nodes and neurons of the ELM adopt Bartlett theory to ensure generalization performance, wherein the overall structure of the ELM is: G(a i ,b i ,x) is the activation function, L is the number of hidden layer neurons, and x is N arbitrarily different samples ELM contains n input attributes x i =[x i1 ,x i2 ,...,x in ] T ∈R n , and contains m output labels y i =[y i1 ,y i2 ,...,y im ] T ∈R m , x j is the input feature, j = 1, 2, ..., N, and the output is O j , the objective function is Among them, a i =[a i1 ,a i2 ,...,a in ] T ∈R n ,i=1,2,...,L is the input weight vector between the input node and the i-th hidden node, b i is the bias of the i-th hidden node, a i and b i is randomly generated, β i =[β i1 ,β i2 ,...,β im ] T ∈R m represents the output weight vector between the i-th hidden node and the output node, o i =[o i1 ,o i2 ,...,o im ] T ∈R m is the output value of the network, G(·) is the activation function; the sigmoid function is used as the activation function: Abbreviated as Hβ=Y; where, The matrix H is the hidden layer output matrix, and Y is the target output matrix. The output weight β is calculated by solving the linear least squares problem: in, is the Moore-Penrose generalized inverse of the hidden layer output matrix H.

10. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the abnormal network access monitoring method based on ultra-limited learning according to any one of claims 1 to 5 is implemented.

Images