Network data processing method, device, equipment, medium and product

Abstract

The invention provides a network data processing method and device, equipment, a medium and a product, which can be applied to the technical field of big data. The method comprises the following steps: screening attack traffic data in an initial traffic data packet based on a traffic time sequence, a traffic change rate and a traffic access frequency; performing de-falsification processing on the attack traffic data to obtain de-falsified attack traffic data; feature extraction is carried out on the attack traffic data after pseudo removal, target features are obtained, the target features comprise traffic change information of a target object and data communication relation information between the target object and a related object, the target object is an object accessed by the attack traffic data, and the related object is an object communicating with the target object; and processing the target feature by using a type identification model to obtain an attack type corresponding to the attack traffic data after the de-counterfeiting, so as to execute a security policy corresponding to the attack type.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology, and in particular to a network data processing method, device, equipment, medium and product. Background Art

[0002] As digital transformation accelerates, online business transactions face cybersecurity threats. Cyberattacks are becoming increasingly sophisticated, including phishing and ransomware. The frequency and intensity of cyberattacks on financial institutions are increasing year by year, and data security risks are also increasing.

[0003] In the process of implementing the present disclosure, the inventors found that the related technologies mainly rely on rule-based or feature-based traffic data detection methods, which are difficult to adapt to complex and changeable attack patterns, resulting in low recognition accuracy and high network security risks. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a network data processing method, apparatus, device, medium and product.

[0005] According to the first aspect of the present disclosure, a network data processing method is provided, including: filtering attack traffic data in an initial traffic data packet based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packet includes traffic data within a preset data range captured in response to a detection moment; performing de-aliasing on the attack traffic data to obtain de-aliased attack traffic data; performing feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and related objects, the target object being an object accessed by the attack traffic data, and the related objects being objects communicating with the target object; processing the target features using a type recognition model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type.

[0006] According to an embodiment of the present disclosure, attack traffic data is de-authenticated to obtain the de-authenticated attack traffic data, including: detecting the attack traffic data to determine false information, wherein the false information includes false source information and false protocol information; processing the false source information using a blockchain algorithm to obtain true source information; processing the false protocol information using a blockchain algorithm to obtain true protocol information; and obtaining the de-authenticated attack traffic data based on the true source information and the true protocol information.

[0007] According to an embodiment of the present disclosure, a type identification model includes an encryption module and an identification module. The type identification model is used to process target features to obtain attack types corresponding to the attack traffic data after de-authentication, including: encrypting the target features using the encryption module to obtain encrypted features; and performing type identification on the encrypted features using the identification module to obtain attack types corresponding to the attack traffic data after de-authentication.

[0008] According to an embodiment of the present disclosure, the recognition module includes a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer; wherein, the recognition module is used to perform type recognition on the encrypted features to obtain the attack types corresponding to the de-authenticated attack traffic data, including: using the convolutional neural sublayer to process the encrypted features to obtain deep convolutional features; using the graph neural sublayer to process the deep convolutional features to obtain graph convolutional features; using the fully connected sublayer to process the graph convolutional features to obtain the attack types corresponding to the de-authenticated attack traffic data.

[0009] According to an embodiment of the present disclosure, feature extraction is performed on the de-authenticated attack traffic data to obtain target features, including: using a self-supervised learning algorithm to process the de-authenticated attack traffic data to obtain traffic features, wherein the traffic features characterize traffic change information of the target object; using a graph neural network model to process the de-authenticated attack traffic data to obtain graph features, wherein the graph features characterize data communication relationship information between the target object and related objects; and fusing the traffic features and the graph features to obtain the target features.

[0010] According to an embodiment of the present disclosure, a graph neural network model is used to process the attack traffic data after de-authentication to obtain graph features, including: sampling the attack traffic data after de-authentication to obtain sampled data; processing the sampled data using a classification graph composition algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent target objects or related objects, and the edges represent the communication relationship between nodes; and processing the graph data using a graph neural network model to obtain graph features.

[0011] According to an embodiment of the present disclosure, the network data processing method further includes: enhancing the type recognition model based on a preset reinforcement learning method to obtain an enhanced type recognition model.

[0012] The second aspect of the present disclosure provides a network data processing device, including: an extraction module, which is used to filter attack traffic data in an initial traffic data packet based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packet includes traffic data within a preset data range captured in response to a detection moment; a de-aliasing module, which is used to perform de-aliasing on the attack traffic data to obtain the de-aliased attack traffic data; a processing module, which is used to perform feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and related objects, the target object being an object accessed by the attack traffic data, and the related object being an object communicating with the target object; an identification module, which is used to process the target features using a type identification model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to facilitate the execution of a security policy corresponding to the attack type.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] According to the network data processing method, device, equipment, medium and product provided by the present disclosure, the attack traffic data in the initial traffic data packet is filtered through the traffic timing, traffic change rate and traffic access frequency; the attack traffic data is then de-authenticated to obtain the de-authenticated attack traffic data; the de-authenticated attack traffic data is feature extracted to obtain the target feature; the target feature is processed using a type recognition model to obtain the attack type corresponding to the de-authenticated attack traffic data, so as to facilitate the execution of the security policy corresponding to the attack type. Since the attack traffic data in the initial traffic data packet is more accurately filtered out based on the highly relevant features, the de-authenticated attack traffic data is feature extracted to obtain the target feature expressed in depth, and the attack type is then identified based on the type recognition model, thereby effectively improving the recognition efficiency and accuracy of various types of disguised attack traffic data and enhancing network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the network data processing method according to the embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a network data processing method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart of determining attack traffic data after de-forgery according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A schematic diagram of an identification module according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 A schematic diagram showing a structural block diagram of a network data processing device according to an embodiment of the present disclosure; and

[0023] Figure 6 A block diagram of an electronic device suitable for implementing a network data processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the process of implementing the present disclosure, it was found that with the acceleration of digital transformation, network business transactions are facing network security threats. Network attack methods are becoming increasingly complex, including phishing, ransomware, etc. The frequency and intensity of network attacks on financial institutions are increasing year by year, and data security risks are also increasing. The relevant technologies mainly rely on traffic data detection methods based on rules or features, which are difficult to adapt to complex and changeable attack patterns, resulting in low recognition accuracy and high network security risks.

[0029] In view of this, an embodiment of the present disclosure provides a network data processing method, which filters attack traffic data in initial traffic data packets based on traffic timing, traffic change rate, and traffic access frequency; performs de-aliasing on the attack traffic data to obtain de-aliased attack traffic data; performs feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features include traffic change information of the target object and data communication relationship information between the target object and related objects, the target object is the object accessed by the attack traffic data, and the related object is the object communicating with the target object; uses a type recognition model to process the target features to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type.

[0030] It should be noted that the network data processing method and network data processing device provided by the present disclosure can be used in the field of financial technology, such as financial institutions, and can also be used in any field other than the field of financial technology, such as e-commerce platforms such as shopping websites. Therefore, the application field of the network data processing method and network data processing device provided by the present disclosure is not limited.

[0031] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0032] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0033] Figure 1 The application scenario diagram of the network data processing method according to the embodiment of the present disclosure is schematically shown.

[0034] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0036] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0037] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0038] It should be noted that the network data processing method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the network data processing device provided in the embodiment of the present disclosure can generally be set in the server 105. The network data processing method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the network data processing device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0039] It should be understood that Figure 1 The number of the first terminal device, the second terminal device, the third terminal device, the network and the server in the embodiment is only for illustration. According to the implementation requirements, there may be any number of the first terminal device, the second terminal device, the third terminal device, the network and the server.

[0040] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The network data processing method of the disclosed embodiment is described in detail.

[0041] Figure 2 The flowchart of the network data processing method according to the embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the network data processing method 200 of this embodiment includes operations S210 to S240.

[0043] In operation S210, attack traffic data in the initial traffic data packet is filtered based on traffic timing, traffic change rate, and traffic access frequency.

[0044] In operation S220, the attack traffic data is de-authenticated to obtain the de-authenticated attack traffic data.

[0045] In operation S230, feature extraction is performed on the attack traffic data after the de-authentication to obtain target features.

[0046] In operation S240, the target feature is processed using the type recognition model to obtain the attack type corresponding to the attack traffic data after de-authentication, so as to execute the security policy corresponding to the attack type.

[0047] According to the embodiments of the present disclosure, in the environment of cloud computing and large websites, the server will receive a large number of data access requests and monitor and collect traffic data in real time. In response to receiving the detection request, the server obtains multiple initial traffic data packets captured based on the detection time.

[0048] According to an embodiment of the present disclosure, the initial traffic data packet includes traffic data within a preset data range captured in response to the detection moment. The preset data range is a preset upper limit value of the size of the initial traffic data packet, and the size of each initial traffic data packet may be different. Each initial traffic data packet records information such as the protocol type, source and destination addresses, etc.

[0049] According to an embodiment of the present disclosure, the network traffic data in the initial traffic data packet may include normal traffic data and attack traffic data. The attack traffic data is obtained by screening based on the characteristics of the traffic data in the initial traffic data packet. The attack traffic data is the traffic data generated when the attacker simulates a normal access request to the server.

[0050] According to an embodiment of the present disclosure, the initial traffic data packets are first cleaned and then screened. Data cleaning may include: removing duplicate records and missing values, unifying data formats, and standardizing processing.

[0051] According to the embodiments of the present disclosure, the traffic time series is the time series between the generation of multiple traffic data, the traffic change rate is the speed of change of the size of the traffic data, and the traffic access frequency is the frequency of traffic data access within a certain time period.

[0052] According to the embodiments of the present disclosure, attack traffic data generally has the characteristics of frequent attack time periods, large traffic change rate, and large traffic access frequency. Therefore, the initial traffic data packet is analyzed based on highly correlated features such as traffic timing, traffic change rate, and traffic access frequency to filter out the attack traffic data in the initial traffic data packet.

[0053] According to the embodiments of the present disclosure, the information such as addresses and access protocols in the attack traffic data may be disguised, and the attack traffic data can be de-authenticated according to the de-authentication algorithm to obtain the de-authenticated attack traffic data. The information in the de-authenticated attack traffic data is real information.

[0054] According to the embodiments of the present disclosure, a feature extraction network may be used to extract features from the attack traffic data after de-authentication to obtain target features.

[0055] According to an embodiment of the present disclosure, the target features include traffic change information of the target object and data communication relationship information between the target object and related objects. The target object is the object accessed by the attack traffic data, and the related object is the object communicating with the target object.

[0056] According to an embodiment of the present disclosure, the types of attack traffic data include distributed denial of service (DDoS), web page attack, protocol attack, and the like.

[0057] According to an embodiment of the present disclosure, the type recognition model may be a model integrating multiple networks, such as an integrated model of convolutional neural networks (CNN) and graph neural networks (GNN). The type recognition model is used to process target features to obtain attack types corresponding to the de-authenticated attack traffic data.

[0058] According to the embodiments of the present disclosure, the security policy is dynamically adjusted according to the identified attack type, and the pre-set response mechanism is automatically triggered to quickly respond to potential attack threats.

[0059] According to the embodiments of the present disclosure, since the attack traffic data in the initial traffic data packet is more accurately screened out based on the features with high correlation, the features are extracted from the attack traffic data after de-authentication to obtain the target features expressed in depth, and then the attack type is identified based on the type recognition model, thereby effectively improving the recognition efficiency and accuracy of various types of disguised attack traffic data and enhancing the network security protection capability.

[0060] Figure 3 A flowchart for determining the de-forged attack traffic data according to an embodiment of the present disclosure is schematically shown.

[0061] like Figure 3 As shown, performing anti-counterfeiting processing on the attack traffic data to obtain the anti-counterfeiting attack traffic data includes operations S310 to S340.

[0062] In operation S310, the attack traffic data is detected to determine false information.

[0063] In operation S320, the pseudo-source information is processed using a blockchain algorithm to obtain the true source information.

[0064] In operation S330, the pseudo-agreement information is processed using a blockchain algorithm to obtain true agreement information.

[0065] In operation S340, based on the true source information and the true protocol information, the attack traffic data after being de-authenticated is obtained.

[0066] According to an embodiment of the present disclosure, the pseudo information includes pseudo source information and pseudo protocol information.

[0067] According to the embodiments of the present disclosure, the attack traffic data is traced and data tampering is detected according to the pseudo information monitoring algorithm, such as detecting the protocol type and source address to identify pseudo information. Pseudo source information is the packaged source address information, and pseudo protocol information is the packaged protocol information. The source address is the address that the attacker initiates access to, and the target address is the address that the attacker accesses.

[0068] According to an embodiment of the present disclosure, a blockchain algorithm is used to process pseudo-source information to obtain true source information, where the true source information is the real source address information.

[0069] According to an embodiment of the present disclosure, the pseudo-protocol information is processed using a blockchain algorithm to obtain true protocol information, and the true protocol information is real protocol information.

[0070] According to an embodiment of the present disclosure, the false source information and the false protocol information in the attack traffic data are replaced with the true source information and the true protocol information to obtain the attack traffic data after the false information is removed.

[0071] According to the embodiments of the present disclosure, the attack traffic data after de-authentication is helpful to extract the features of deep-level expression, thereby improving the accuracy of the type recognition model.

[0072] According to an embodiment of the present disclosure, a type identification model includes an encryption module and an identification module. The type identification model is used to process target features to obtain attack types corresponding to the attack traffic data after de-authentication, including: encrypting the target features using the encryption module to obtain encrypted features; and performing type identification on the encrypted features using the identification module to obtain attack types corresponding to the attack traffic data after de-authentication.

[0073] According to an embodiment of the present disclosure, an encryption algorithm, such as a differential privacy algorithm, is involved according to data security compliance rules, and an encryption module is constructed based on the encryption algorithm.

[0074] According to an embodiment of the present disclosure, an encryption module is used to encrypt target features to obtain encrypted features.

[0075] According to an embodiment of the present disclosure, an identification module is used to perform type identification on encrypted features to obtain the probability of belonging to each type, thereby determining the attack type corresponding to the attack traffic data after decryption. The output attack type is also encrypted data, and the encrypted attack type needs to be decrypted.

[0076] According to an embodiment of the present disclosure, an encryption module is used to encrypt the entire data in the type recognition model recognition process, thereby improving data privacy protection.

[0077] According to the embodiments of the present disclosure, compliance and data security are emphasized when traffic is detected, thereby improving data privacy protection.

[0078] According to an embodiment of the present disclosure, the recognition module includes a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer; wherein, the recognition module is used to perform type recognition on the encrypted features to obtain the attack types corresponding to the de-authenticated attack traffic data, including: using the convolutional neural sublayer to process the encrypted features to obtain deep convolutional features; using the graph neural sublayer to process the deep convolutional features to obtain graph convolutional features; using the fully connected sublayer to process the graph convolutional features to obtain the attack types corresponding to the de-authenticated attack traffic data.

[0079] Figure 4 The figure schematically shows a schematic diagram of an identification module according to an embodiment of the present disclosure.

[0080] like Figure 4 As shown, a suitable network structure is configured for the recognition module, and the recognition module includes a convolutional neural sublayer 410, a graph neural sublayer 420, and a fully connected sublayer 430. The encrypted features are input into the convolutional neural sublayer 410, and the deep convolutional features are output; the deep convolutional features are input into the graph neural sublayer 420, and the graph convolutional features are output; the graph convolutional features are input into the fully connected sublayer 430, and the attack type corresponding to the attack traffic data after de-authentication is output.

[0081] According to an embodiment of the present disclosure, the recognition module is trained, attack traffic data containing multiple attack type labels are obtained from a database, and feature extraction is performed on the attack traffic data after de-authentication processing to obtain target features.

[0082] According to an embodiment of the present disclosure, an optimizer (Adaptive moment estimation, Adam) and a cross entropy loss function are used to train the recognition module, a learning rate is set, and an early stopping strategy is used to prevent overfitting.

[0083] According to the embodiments of the present disclosure, the training set, validation set and test set are used to improve the generalization ability of the model using the K-fold cross-validation method. The type recognition model is comprehensively evaluated using multiple evaluation indicators, such as accuracy, precision, recall, Receiver Operating Characteristic (ROC) curve and Area Under Curve (AUC) value.

[0084] Table 1 shows a performance table of a type recognition model according to an embodiment of the present disclosure.

[0085]

[0086] According to the embodiments of the present disclosure, Table 1 records the detection results of different attack types under the type recognition model, and judges the accuracy, precision and recall rate of the type recognition model in different attack types. It can be found that the performance of the type recognition model is relatively high.

[0087] According to the embodiments of the present disclosure, the recognition module integrates a convolutional neural sublayer, a graph neural sublayer, a fully connected sublayer, etc., performs in-depth analysis of features through the connection of multi-layer networks, and extracts complex attack features, thereby enhancing the robustness and classification accuracy of the recognition module.

[0088] According to an embodiment of the present disclosure, feature extraction is performed on the de-authenticated attack traffic data to obtain target features, including: using a self-supervised learning algorithm to process the de-authenticated attack traffic data to obtain traffic features, wherein the traffic features characterize traffic change information of the target object; using a graph neural network model to process the de-authenticated attack traffic data to obtain graph features, wherein the graph features characterize data communication relationship information between the target object and related objects; and fusing the traffic features and the graph features to obtain the target features.

[0089] According to an embodiment of the present disclosure, the self-supervised learning algorithm may be a reinforcement algorithm (Simple Framework for Contrastive Learning, SimCLR) or a self-supervised algorithm (Bootstrap Your Own Lat, BYOL).

[0090] According to the embodiments of the present disclosure, the attack traffic data after de-authentication contains real traffic information, and the self-supervised learning algorithm is used to perform feature learning on the attack traffic data after de-authentication to obtain traffic features, which have strong discrimination capabilities. The traffic change information can be information such as the traffic size change rate.

[0091] According to an embodiment of the present disclosure, a graph neural network model can be constructed based on a graph neural network (GNN), and the graph neural network model is used to abstract the de-authenticated attack traffic data into a graph data structure, and then the relationship between nodes in the graph data structure is captured to obtain graph features.

[0092] According to an embodiment of the present disclosure, the target object communicates with the related objects, and the graph feature represents the data communication relationship information between the target object and the related objects.

[0093] According to an embodiment of the present disclosure, the flow features and the graph features are spliced ​​to obtain the target features.

[0094] According to the embodiments of the present disclosure, by performing self-supervised learning on unlabeled, de-authenticated attack traffic data, deep-level features of the traffic data are automatically learned, reducing dependence on manually labeled data, thereby improving data utilization.

[0095] According to an embodiment of the present disclosure, a graph neural network model is used to process the attack traffic data after de-authentication to obtain graph features, including: sampling the attack traffic data after de-authentication to obtain sampled data; processing the sampled data using a classification graph composition algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent target objects or related objects, and the edges represent the communication relationship between nodes; and processing the graph data using a graph neural network model to obtain graph features.

[0096] According to an embodiment of the present disclosure, a nonlinear function is used to perform sampling processing on the attack traffic data after de-authentication to obtain sampling data, and the sampling data is window data with time series characteristics.

[0097] According to an embodiment of the present disclosure, the sampled data is encoded into low-dimensional space features, and the low-dimensional space features are processed using a classification graphing algorithm to generate node data and edge data, and the graph data includes the node data and the edge data.

[0098] According to an embodiment of the present disclosure, the node data records the attribute data of the target object or the related object, and the edge data records the communication relationship data between the target object and the related object.

[0099] According to an embodiment of the present disclosure, the graph neural network model is constructed based on a graph convolutional network (GCN) or a graph attention network (GAT).

[0100] According to an embodiment of the present disclosure, graph data is input into a graph neural network model for learning to capture complex relationships and contextual information between data packets and obtain graph features.

[0101] According to the embodiments of the present disclosure, the graph neural network can effectively capture the complex relationships between nodes, extract high-level features, and further identify the correlation and dynamic changes between different attack traffic data, thereby enhancing the accuracy of type recognition.

[0102] According to an embodiment of the present disclosure, the network data processing method further includes: enhancing the type recognition model based on a preset reinforcement learning method to obtain an enhanced type recognition model.

[0103] According to an embodiment of the present disclosure, the preset reinforcement learning method may be a reinforcement learning algorithm (Reinforcement Learning, Q-Learning) or a proximal policy optimization algorithm (Proximal Policy Optimization, PPO).

[0104] According to an embodiment of the present disclosure, after pre-training the type recognition model, status data is collected according to the performance status of the type recognition model, and then a reinforcement learning method is preset to learn the status data to obtain feedback results, and the next round of training parameters of the type recognition model are adjusted based on the feedback results to obtain an enhanced type recognition model.

[0105] According to the embodiments of the present disclosure, the type recognition model is enhanced based on a preset reinforcement learning method, and the type recognition model can be more effectively learned and adjusted in real time when facing new types of attacks.

[0106] Based on the above network data processing method, the present disclosure also provides a network data processing device. Figure 5 The device is described in detail.

[0107] Figure 5 The structure block diagram of the network data processing device according to the embodiment of the present disclosure is schematically shown.

[0108] like Figure 5 As shown, the network data processing device 500 of this embodiment includes an extraction module 510 , a de-counterfeiting module 520 , a processing module 530 and an identification module 540 .

[0109] The extraction module 510 is used to filter the attack traffic data in the initial traffic data packet based on the traffic time sequence, traffic change rate, and traffic access frequency, wherein the initial traffic data packet includes traffic data within a preset data range captured in response to the detection moment. In one embodiment, the extraction module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0110] The anti-counterfeiting module 520 is used to perform anti-counterfeiting processing on the attack traffic data to obtain the anti-counterfeiting attack traffic data. In one embodiment, the anti-counterfeiting module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0111] The processing module 530 is used to extract features from the attack traffic data after de-authentication to obtain target features, wherein the target features include traffic change information of the target object and data communication relationship information between the target object and related objects, the target object is the object accessed by the attack traffic data, and the related object is the object communicating with the target object. In one embodiment, the processing module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0112] The identification module 540 is used to process the target features using the type identification model to obtain the attack type corresponding to the attack traffic data after de-authentication, so as to execute the security policy corresponding to the attack type. In one embodiment, the identification module 540 can be used to execute the operation S240 described above, which will not be repeated here.

[0113] According to an embodiment of the present disclosure, the anti-counterfeiting module 520 includes a first anti-counterfeiting sub-module, a second anti-counterfeiting sub-module, a third anti-counterfeiting sub-module and a fourth anti-counterfeiting sub-module.

[0114] The first anti-counterfeiting submodule is used to detect the attack traffic data and determine the false information, wherein the false information includes false source information and false protocol information.

[0115] The second anti-counterfeiting sub-module is used to use the blockchain algorithm to process the pseudo-source information and obtain the true source information.

[0116] The third anti-counterfeiting sub-module is used to use the blockchain algorithm to process the pseudo-protocol information and obtain the true protocol information.

[0117] The fourth anti-counterfeiting submodule is used to obtain anti-counterfeiting attack traffic data based on the true source information and the true protocol information.

[0118] According to an embodiment of the present disclosure, the identification module 540 includes a first identification submodule and a second identification submodule.

[0119] The first identification submodule is used to encrypt the target feature by using the encryption module to obtain the encrypted feature.

[0120] The second identification submodule is used to use the identification module to perform type identification on the encryption feature to obtain the attack type corresponding to the attack traffic data after de-authentication.

[0121] According to an embodiment of the present disclosure, the second identification submodule includes a first identification unit, a second identification unit and a third identification unit.

[0122] The first recognition unit is used to process the encrypted features using a convolutional neural sublayer to obtain deep convolutional features.

[0123] The second recognition unit is used to process the deep convolutional features using the graph neural sublayer to obtain graph convolutional features.

[0124] The third identification unit is used to process the graph convolution features using the fully connected sublayer to obtain the attack type corresponding to the attack traffic data after de-authentication.

[0125] According to an embodiment of the present disclosure, the processing module 530 includes a first processing submodule, a second processing submodule and a third processing submodule.

[0126] The first processing submodule is used to process the attack traffic data after de-authentication by using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of the target object.

[0127] The second processing submodule is used to use the graph neural network model to process the attack traffic data after de-authentication to obtain graph features, wherein the graph features represent the data communication relationship information between the target object and related objects.

[0128] The third processing submodule is used to fuse the traffic features and the graph features to obtain the target features.

[0129] According to an embodiment of the present disclosure, the second processing submodule includes a first processing unit, a second processing unit and a third processing unit.

[0130] The first processing unit is used to perform sampling processing on the attack traffic data after de-authentication to obtain sampling data.

[0131] The second processing unit is used to process the sampled data using a classification graph composition algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent target objects or related objects, and the edges represent communication relationships between nodes.

[0132] The third processing unit is used to process the graph data using the graph neural network model to obtain graph features.

[0133] According to an embodiment of the present disclosure, the network data processing device 500 further includes an enhancement module.

[0134] The enhancement module is used to enhance the type recognition model based on a preset reinforcement learning method to obtain an enhanced type recognition model.

[0135] According to an embodiment of the present disclosure, any multiple modules of the extraction module 510, the de-fake module 520, the processing module 530 and the identification module 540 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the extraction module 510, the de-fake module 520, the processing module 530 and the identification module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the extraction module 510 , the anti-counterfeiting module 520 , the processing module 530 , and the identification module 540 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0136] Figure 6 A block diagram of an electronic device suitable for implementing a network data processing method according to an embodiment of the present disclosure is schematically shown.

[0137] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0138] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0139] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0140] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0141] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0142] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the network data processing method provided by the embodiment of the present disclosure.

[0143] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0144] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0145] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0146] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0147] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0148] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0149] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A network data processing method, characterized in that: The method comprises: Filtering attack traffic data in an initial traffic data packet based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packet includes traffic data within a preset data range captured in response to a detection moment; Performing anti-counterfeiting processing on the attack traffic data to obtain anti-counterfeiting attack traffic data; Performing feature extraction on the attack traffic data after de-authentication to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and related objects, the target object is an object accessed by the attack traffic data, and the related object is an object communicating with the target object; The target feature is processed using a type recognition model to obtain an attack type corresponding to the attack traffic data after de-authentication, so as to execute a security policy corresponding to the attack type.

2. The method according to claim 1, characterized in that The attack traffic data is subjected to de-authentication processing, and the de-authenticated attack traffic data obtained includes: Detecting the attack traffic data to determine false information, wherein the false information includes false source information and false protocol information; Processing the pseudo-source information using a blockchain algorithm to obtain true source information; Processing the pseudo-agreement information using a blockchain algorithm to obtain true agreement information; Based on the true source information and the true protocol information, the attack traffic data after being de-authenticated is obtained.

3. The method according to claim 1, characterized in that: The type recognition model includes an encryption module and an identification module. The type recognition model is used to process the target feature to obtain the attack type corresponding to the attack traffic data after de-authentication, including: Encrypting the target feature using the encryption module to obtain an encrypted feature; The identification module is used to perform type identification on the encryption feature to obtain the attack type corresponding to the attack traffic data after de-authentication.

4. The method according to claim 3, characterized in that The recognition module includes a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer; The encryption feature is identified by the identification module to obtain the attack type corresponding to the attack traffic data after de-authentication, including: Processing the encrypted features using the convolutional neural sublayer to obtain deep convolutional features; Processing the deep convolutional features using the graph neural sublayer to obtain graph convolutional features; The graph convolution feature is processed by using the fully connected sublayer to obtain an attack type corresponding to the de-forged attack traffic data.

5. The method according to claim 1, characterized in that Feature extraction is performed on the attack traffic data after de-authentication, and target features obtained include: Processing the anti-counterfeiting attack traffic data using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of the target object; Processing the de-authenticated attack traffic data using a graph neural network model to obtain graph features, wherein the graph features represent data communication relationship information between the target object and the related objects; The flow feature and the graph feature are fused to obtain the target feature.

6. The method according to claim 5, characterized in that The de-authenticated attack traffic data is processed using a graph neural network model to obtain graph features including: Sampling the attack traffic data after de-authentication to obtain sampled data; Processing the sampled data using a classification graphing algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent the target object or the related object, and the edges represent the communication relationship between the nodes; The graph data is processed using a graph neural network model to obtain graph features.

7. The method according to claim 1, characterized in that The method further comprises: The type recognition model is enhanced based on a preset reinforcement learning method to obtain an enhanced type recognition model.

8. A network data processing device, characterized in that: The device comprises: An extraction module, for filtering attack traffic data in an initial traffic data packet based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packet includes traffic data within a preset data range captured in response to a detection moment; A de-falsification module, used for performing de-falsification processing on the attack traffic data to obtain the de-falsified attack traffic data; A processing module is used to extract features from the attack traffic data after de-authentication to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and related objects, the target object is an object accessed by the attack traffic data, and the related object is an object communicating with the target object; The identification module is used to process the target features using a type identification model to obtain an attack type corresponding to the attack traffic data after de-authentication, so as to execute a security policy corresponding to the attack type.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images