Network data processing method, apparatus, device, medium, and product

Abstract

The present disclosure provides a network data processing method, device, equipment, medium and product, which can be applied to the technical field of big data. The method comprises the following steps: filtering attack traffic data in initial traffic data packets based on traffic timing, traffic change rate and traffic access frequency; performing de-aliasing processing on the attack traffic data to obtain de-aliased attack traffic data; performing feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features comprise traffic change information of a target object and data communication relationship information between the target object and related objects, the target object is an object accessed by the attack traffic data, and the related objects are objects in communication with the target object; processing the target features by using a type identification model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of big data, and in particular to a network data processing method, device, equipment, medium and product. BACKGROUND

[0002] With the acceleration of digital transformation, network business transactions are facing network security threats. Network attack means is becoming increasingly complex, including phishing, ransomware, etc. The frequency and intensity of network attacks on financial institutions are increasing year by year, and data security risks are also increasing.

[0003] In the process of implementing the present disclosure, the inventors found that the related art mainly relies on rule or feature-based traffic data detection methods, which are difficult to adapt to complex and variable attack patterns, resulting in low recognition accuracy and high network security risks. SUMMARY

[0004] In view of the above problems, the present disclosure provides a network data processing method, device, equipment, medium and product.

[0005] According to a first aspect of the present disclosure, a network data processing method is provided, comprising: filtering attack traffic data in initial traffic data packets based on traffic timing, traffic change rate and traffic access frequency, wherein the initial traffic data packets include traffic data within a predetermined data range captured in response to a detection time; performing de-encryption processing on the attack traffic data to obtain de-encrypted attack traffic data; performing feature extraction on the de-encrypted attack traffic data to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and related objects, the target object is an object accessed by the attack traffic data, and the related objects are objects communicating with the target object; processing the target features using a type recognition model to obtain an attack type corresponding to the de-encrypted attack traffic data, so as to execute a security policy corresponding to the attack type.

[0006] According to an embodiment of the present disclosure, the de-encryption processing on the attack traffic data to obtain the de-encrypted attack traffic data comprises: detecting the attack traffic data to determine pseudo-information, wherein the pseudo-information includes pseudo-source information and pseudo-protocol information; processing the pseudo-source information using a blockchain algorithm to obtain true source information; processing the pseudo-protocol information using a blockchain algorithm to obtain true protocol information; and obtaining the de-encrypted attack traffic data based on the true source information and the true protocol information.

[0007] According to an embodiment of the present disclosure, the type identification model comprises an encryption module and an identification module, the target feature is processed by using the type identification model, and the attack type corresponding to the de-pseudo attack traffic data is obtained, which comprises: the target feature is encrypted by using the encryption module to obtain an encrypted feature; the encrypted feature is identified by using the identification module to obtain the attack type corresponding to the de-pseudo attack traffic data.

[0008] According to an embodiment of the present disclosure, the identification module comprises a convolutional neural sublayer, a graph neural sublayer and a fully connected sublayer; wherein the encrypted feature is identified by using the identification module to obtain the attack type corresponding to the de-pseudo attack traffic data, which comprises: the encrypted feature is processed by using the convolutional neural sublayer to obtain deep convolutional features; the deep convolutional features are processed by using the graph neural sublayer to obtain graph convolutional features; the graph convolutional features are processed by using the fully connected sublayer to obtain the attack type corresponding to the de-pseudo attack traffic data.

[0009] According to an embodiment of the present disclosure, the target feature is obtained by performing feature extraction on the de-pseudo attack traffic data, which comprises: the de-pseudo attack traffic data is processed by using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent the traffic change information of the target object; the de-pseudo attack traffic data is processed by using a graph neural network model to obtain graph features, wherein the graph features represent the data communication relationship information between the target object and the related object; the traffic features and the graph features are fused to obtain the target feature.

[0010] According to an embodiment of the present disclosure, the graph features are obtained by processing the de-pseudo attack traffic data by using the graph neural network model, which comprises: the de-pseudo attack traffic data is sampled to obtain sampling data; the sampling data is processed by using a classification mapping algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent the target object or the related object, and the edges represent the communication relationship between the nodes; the graph data is processed by using the graph neural network model to obtain the graph features.

[0011] According to an embodiment of the present disclosure, the network data processing method further comprises: enhancing the type identification model based on a preset reinforcement learning manner to obtain an enhanced type identification model.

[0012] The second aspect of the present disclosure provides a network data processing apparatus, comprising: an extraction module configured to filter attack traffic data in initial traffic data packets based on traffic timing, traffic change rate and traffic access frequency, wherein the initial traffic data packets comprise traffic data within a preset data range captured in response to a detection time; a de-aliasing module configured to perform de-aliasing processing on the attack traffic data to obtain de-aliased attack traffic data; a processing module configured to perform feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features comprise traffic change information of a target object and data communication relationship information between the target object and related objects, the target object being an object accessed by the attack traffic data, and the related objects being objects in communication with the target object; and an identification module configured to process the target features using a type identification model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type.

[0013] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory configured to store one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having stored thereon a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0015] The fifth aspect of the present disclosure further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the steps of the method.

[0016] According to the network data processing method, apparatus, device, medium and product provided by the present disclosure, attack traffic data in initial traffic data packets is filtered based on traffic timing, traffic change rate and traffic access frequency; the attack traffic data is then de-aliased to obtain de-aliased attack traffic data; the de-aliased attack traffic data is then subjected to feature extraction to obtain target features; and the target features are processed using a type identification model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type. Since the attack traffic data in the initial traffic data packets is more accurately filtered based on features with high correlation, the de-aliased attack traffic data is subjected to feature extraction to obtain target features with deep expression, and the attack type is identified based on the type identification model, thereby effectively improving the identification efficiency and accuracy of attack traffic data after various types of disguising, and enhancing the network security protection capability. BRIEF DESCRIPTION OF DRAWINGS

[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0018] Figure 1 A diagram illustrating an application scenario of a network data processing method according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart illustrating a network data processing method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart illustrating determining de-attacked attack traffic data according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A diagram illustrating a recognition module according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 A block diagram illustrating a network data processing apparatus according to an embodiment of the present disclosure is schematically shown; and

[0023] Figure 6 A block diagram illustrating an electronic device suitable for implementing a network data processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary of the present disclosure, and is intended to provide a thorough description for those skilled in the art to understand the present disclosure. Therefore, the description is not intended to limit the scope of the present disclosure. In the following detailed description of the embodiments, numerous specific details are set forth in order to provide a thorough understanding of the present disclosure. However, it will be apparent to one skilled in the art that the present disclosure can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present disclosure.

[0025] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the present disclosure. As used herein, the term "includes" and "comprising" and the like are meant to be inclusive in a manner that there are no other non-mentioned items.

[0026] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings that are consistent with the context of the present description, and should not be interpreted in an idealized or excessively formal manner.

[0027] In the case of using expressions similar to "at least one of A, B, and C, etc.", it is generally to be interpreted that the meaning of the expression is the same as that of "one or more of A, B, and C" (for example, "a system having at least one of A, B, and C" should include but not be limited to a system having A alone, a system having B alone, a system having C alone, a system having both A and B, a system having both A and C, a system having both B and C, and / or a system having A, B, and C, etc.).

[0028] It is found in the process of implementing the present disclosure that, with the acceleration of digital transformation, network business transactions are facing network security threats. Network attack means is becoming increasingly complex, including phishing, ransomware, etc., the frequency and intensity of network attacks suffered by financial institutions are increasing year by year, and the risk of data security is also increasing. In the related art, the detection method of traffic data mainly relies on rules or features, which is difficult to adapt to complex and variable attack patterns, resulting in low recognition accuracy and high network security risk.

[0029] Therefore, the embodiments of the present disclosure provide a network data processing method, which screens attack traffic data in initial traffic data packets based on traffic timing, traffic change rate, and traffic access frequency; performs anti-fraud processing on the attack traffic data to obtain anti-fraud attack traffic data; performs feature extraction on the anti-fraud attack traffic data to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and a related object, the target object is an object accessed by the attack traffic data, and the related object is an object in communication with the target object; and processes the target features by using a type identification model to obtain an attack type corresponding to the anti-fraud attack traffic data, so as to execute a security policy corresponding to the attack type.

[0030] It should be noted that the network data processing method and the network data processing apparatus provided by the present disclosure can be used in the field of financial technology, such as financial institutions, and can also be used in any field other than the field of financial technology, such as e-commerce platforms such as shopping websites, and therefore the application field of the network data processing method and the network data processing apparatus provided by the present disclosure is not limited.

[0031] In the technical solutions of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary security measures are taken, do not violate public order and good customs, and appropriate operation portals are provided for users to choose authorization or refusal.

[0032] In a scenario of making an automated decision by using personal information, the method, device and system provided by the embodiments of the present disclosure provide a corresponding operation entry for a user to select to agree or reject the automated decision result; if the user selects to reject, an expert decision process is entered. The expression "automated decision" herein refers to an activity of automatically analyzing and evaluating, by a computer program, a person's behavior habit, interest and hobby, or economic, health and credit status, and making a decision. The expression "expert decision" herein refers to an activity of making a decision by a person who is specialized in a certain field, has certain professional experience, knowledge and skills, and reaches a certain professional level.

[0033] Figure 1 An application scenario diagram of a network data processing method according to an embodiment of the present disclosure is schematically shown.

[0034] As shown in Figure 1 The application scenario 100 according to the embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104 and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0035] A user can use the first terminal device 101, the second terminal device 102 and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102 and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0036] The first terminal device 101, the second terminal device 102 and the third terminal device 103 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers and desktop computers, etc.

[0037] The server 105 can be a server providing various services, such as a background management server supporting a website browsed by a user using the first terminal device 101, the second terminal device 102 and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and other data, and feed back the processing result (such as a webpage, information or data generated or obtained according to a user request) to the terminal device.

[0038] It should be noted that the network data processing method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the network data processing device provided in the embodiments of the present disclosure can generally be set in the server 105. The network data processing method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the network data processing device provided in the embodiments of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0039] It should be understood that Figure 1 The number of the first terminal device, the second terminal device, the third terminal device, the network and the server is only illustrative. According to implementation requirements, there can be any number of the first terminal device, the second terminal device, the third terminal device, the network and the server.

[0040] The following will be based on Figure 1 The scene described by Figures 2-4 The network data processing method of the disclosed embodiment is described in detail.

[0041] Figure 2 The flowchart of the network data processing method according to the embodiment of the present disclosure is schematically shown.

[0042] like Figure 2 As shown, the network data processing method 200 of this embodiment includes operations S210 to S240.

[0043] In operation S210 , attack traffic data in the initial traffic data packet is filtered based on traffic time sequence, traffic change rate, and traffic access frequency.

[0044] In operation S220 , the attack traffic data is subjected to de-authentication processing to obtain the de-authenticated attack traffic data.

[0045] In operation S230 , feature extraction is performed on the attack traffic data after de-authentication to obtain target features.

[0046] In operation S240 , the target feature is processed using the type recognition model to obtain an attack type corresponding to the attack traffic data after de-authentication, so as to execute a security policy corresponding to the attack type.

[0047] According to an embodiment of the present disclosure, in the environment of cloud computing and large websites, a server receives a large number of data access requests and monitors and collects traffic data in real time. The server obtains a plurality of initial traffic data packets captured at a detection time in response to receiving a detection request.

[0048] According to an embodiment of the present disclosure, the initial traffic data packets include traffic data in a preset data range captured at the detection time. The preset data range is a preset upper limit of the size of the initial traffic data packets, and the size of each initial traffic data packet can be different, and each initial traffic data packet records information such as protocol type, source and destination address.

[0049] According to an embodiment of the present disclosure, the network traffic data in the initial traffic data packets can include normal traffic data and attack traffic data. The attack traffic data is obtained by screening based on the characteristics of the traffic data in the initial traffic data packets. The attack traffic data is the traffic data generated when an attacker simulates a normal access server request.

[0050] According to an embodiment of the present disclosure, the initial traffic data packets are subjected to data cleaning before being screened. The data cleaning can include removing duplicate records and missing values, unifying data formats, standardizing processing, and the like.

[0051] According to an embodiment of the present disclosure, the traffic time sequence is the time sequence between the generation of a plurality of traffic data, the traffic change rate is the change speed of the size of the traffic data, and the traffic access frequency is the frequency of traffic data access in a certain time period.

[0052] According to an embodiment of the present disclosure, the attack traffic data generally has the characteristics of a frequent attack time period, a large traffic change rate, and a large traffic access frequency. Therefore, the initial traffic data packets are analyzed based on the characteristics of the traffic time sequence, the traffic change rate, and the traffic access frequency, which have high relevance, to screen the attack traffic data in the initial traffic data packets.

[0053] According to an embodiment of the present disclosure, the address and access protocol information in the attack traffic data can be disguised. The attack traffic data can be subjected to a de-disguising algorithm to obtain de-disguised attack traffic data. The information in the de-disguised attack traffic data is real information.

[0054] According to an embodiment of the present disclosure, the de-disguised attack traffic data can be subjected to feature extraction by a feature extraction network to obtain target features.

[0055] According to an embodiment of the present disclosure, the target features include traffic change information of a target object and data communication relationship information between the target object and a related object. The target object is an object accessed by the attack traffic data, and the related object is an object that communicates with the target object.

[0056] According to an embodiment of the present disclosure, the type of attack traffic data includes a distributed denial of service type (DDoS), a webpage attack type, a protocol attack type, and the like.

[0057] According to an embodiment of the present disclosure, the type identification model can be a model integrated with multiple networks, such as an integrated model of a convolutional neural network (CNN) and a graph neural network (GNN). The target feature is processed by using the type identification model to obtain an attack type corresponding to the attack traffic data after de-aliasing.

[0058] According to an embodiment of the present disclosure, the security policy is dynamically adjusted according to the identified attack type, and the pre-set response mechanism is automatically triggered to quickly respond to potential attack threats.

[0059] According to an embodiment of the present disclosure, since the attack traffic data in the initial traffic data packet is more accurately screened based on the high-relevance features, the target feature with deep expression is obtained by performing feature extraction on the attack traffic data after de-aliasing, and the attack type is identified based on the type identification model, thereby effectively improving the identification efficiency and accuracy of each type of disguised attack traffic data and improving the network security protection capability.

[0060] Figure 3 A flowchart for determining attack traffic data after de-aliasing according to an embodiment of the present disclosure is schematically shown.

[0061] As shown in Figure 3 , the attack traffic data is de-aliased to obtain attack traffic data after de-aliasing, including operations S310-S340.

[0062] In operation S310, the attack traffic data is detected to determine the pseudo information.

[0063] In operation S320, the pseudo source information is processed by using a blockchain algorithm to obtain true source information.

[0064] In operation S330, the pseudo protocol information is processed by using a blockchain algorithm to obtain true protocol information.

[0065] In operation S340, the attack traffic data after de-aliasing is obtained based on the true source information and the true protocol information.

[0066] According to an embodiment of the present disclosure, the pseudo information includes pseudo source information and pseudo protocol information.

[0067] According to an embodiment of the present disclosure, the attack traffic data is subjected to trace detection and data tampering detection according to a pseudo-information monitoring algorithm, such as detection of protocol type and source address, to identify pseudo-information. The pseudo-source information is packaged source address information, and the pseudo-protocol information is packaged protocol information. The source address is an address from which an attacker initiates access, and the target address is an address accessed by the attacker.

[0068] According to an embodiment of the present disclosure, the pseudo-source information is processed by using a blockchain algorithm to obtain true source information, which is real source address information.

[0069] According to an embodiment of the present disclosure, the pseudo-protocol information is processed by using a blockchain algorithm to obtain true protocol information, which is real protocol information.

[0070] According to an embodiment of the present disclosure, the pseudo-source information and the pseudo-protocol information in the attack traffic data are replaced by using the true source information and the true protocol information to obtain attack traffic data after pseudo-information removal.

[0071] According to an embodiment of the present disclosure, the attack traffic data after pseudo-information removal helps to extract features expressed in a deep level, thereby improving the accuracy of type identification model identification.

[0072] According to an embodiment of the present disclosure, the type identification model includes an encryption module and an identification module, and the target feature is processed by using the type identification model to obtain an attack type corresponding to the attack traffic data after pseudo-information removal, including: the target feature is encrypted by using the encryption module to obtain encrypted features; and the encrypted features are subjected to type identification by using the identification module to obtain the attack type corresponding to the attack traffic data after pseudo-information removal.

[0073] According to an embodiment of the present disclosure, an encryption algorithm such as a differential privacy algorithm is involved according to a data security compliance rule, and the encryption module is constructed based on the encryption algorithm.

[0074] According to an embodiment of the present disclosure, the target feature is encrypted by using the encryption module to obtain encrypted features.

[0075] According to an embodiment of the present disclosure, the encrypted features are subjected to type identification by using the identification module to obtain probabilities belonging to each type, thereby determining the attack type corresponding to the attack traffic data after pseudo-information removal, and the output attack type is also encrypted data, and the encrypted attack type needs to be decrypted.

[0076] According to an embodiment of the present disclosure, the data in the process of identification of the type identification model is encrypted by using the encryption module, thereby improving data privacy protection.

[0077] According to an embodiment of the present disclosure, compliance and data security are focused on when detecting traffic, thereby improving data privacy protection.

[0078] According to an embodiment of the present disclosure, the identification module comprises a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer; wherein the identification module is used to identify the type of the encrypted feature, and the attack type corresponding to the attack traffic data after the pseudo feature is removed is obtained by: using the convolutional neural sublayer to process the encrypted feature to obtain deep convolutional features; using the graph neural sublayer to process the deep convolutional features to obtain graph convolutional features; and using the fully connected sublayer to process the graph convolutional features to obtain the attack type corresponding to the attack traffic data after the pseudo feature is removed.

[0079] Figure 4 An illustrative diagram of the identification module according to an embodiment of the present disclosure is shown.

[0080] As shown in Figure 4 , the identification module is configured with a suitable network structure, and the identification module comprises a convolutional neural sublayer 410, a graph neural sublayer 420, and a fully connected sublayer 430. The encrypted feature is input into the convolutional neural sublayer 410 to output deep convolutional features; the deep convolutional features are input into the graph neural sublayer 420 to output graph convolutional features; and the graph convolutional features are input into the fully connected sublayer 430 to output the attack type corresponding to the attack traffic data after the pseudo feature is removed.

[0081] According to an embodiment of the present disclosure, the identification module is trained, and attack traffic data containing multiple attack type labels is obtained from a database. After the attack traffic data is processed to remove the pseudo feature, target features are extracted.

[0082] According to an embodiment of the present disclosure, the identification module is trained using an optimizer (Adaptive moment estimation, Adam) and a cross-entropy loss function, a learning rate is set, and an early stopping strategy is used to prevent overfitting.

[0083] According to an embodiment of the present disclosure, the training set, the validation set, and the test set are used, and the K-fold cross-validation method is used to improve the generalization ability of the model. Multiple evaluation indicators are used to comprehensively evaluate the type identification model, such as accuracy, precision, recall, Receiver Operating Characteristic (ROC) curve, and Area Under Curve (AUC) value.

[0084] Table 1 shows the performance table of the type identification model according to an embodiment of the present disclosure.

[0085]

[0086] According to an embodiment of the present disclosure, Table 1 records the detection results of different attack types under the type identification model, and the accuracy, precision, and recall rate of the type identification model in different attack types are judged. It can be found that the performance of the type identification model is high.

[0087] According to an embodiment of the present disclosure, the identification module integrates convolutional neural sublayers, graph neural sublayers, fully connected sublayers, etc., and performs deep analysis on the features through the connection of multiple layers of networks to extract complex attack features, thereby enhancing the robustness and classification accuracy of the identification module.

[0088] According to an embodiment of the present disclosure, the feature extraction on the de-pseudo attack traffic data includes: processing the de-pseudo attack traffic data by using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of the target object; processing the de-pseudo attack traffic data by using a graph neural network model to obtain graph features, wherein the graph features represent data communication relationship information between the target object and related objects; and fusing the traffic features and the graph features to obtain target features.

[0089] According to an embodiment of the present disclosure, the self-supervised learning algorithm can be an enhanced algorithm (Simple Framework for Contrastive Learning, SimCLR) or a self-supervised algorithm (Bootstrap Your Own Lat, BYOL).

[0090] According to an embodiment of the present disclosure, the de-pseudo attack traffic data contains real traffic information, and the self-supervised learning algorithm is used to learn features from the de-pseudo attack traffic data to obtain traffic features, which have strong discriminative ability. The traffic change information can be traffic size change rate and the like.

[0091] According to an embodiment of the present disclosure, the graph neural network model can be constructed based on a graph neural network (Graph Neural Network, GNN), and the de-pseudo attack traffic data is abstracted into a graph data structure by using the graph neural network model, and then the relationship between nodes in the graph data structure is captured to obtain graph features.

[0092] According to an embodiment of the present disclosure, the target object and the related object communicate with each other, and the graph features represent data communication relationship information between the target object and the related objects.

[0093] According to an embodiment of the present disclosure, the traffic features and the graph features are spliced to obtain target features.

[0094] According to an embodiment of the present disclosure, the self-supervised learning is performed on the de-pseudo attack traffic data without labels to automatically learn deep features of the traffic data, thereby reducing the dependence on manually labeled data and improving the data utilization rate.

[0095] According to an embodiment of the present disclosure, the graph feature is obtained by processing the de-pseudo attack traffic data by using a graph neural network model, including: performing sampling processing on the de-pseudo attack traffic data to obtain sampling data; processing the sampling data by using a classification graph construction algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent target objects or related objects, and the edges represent communication relationships between the nodes; and processing the graph data by using a graph neural network model to obtain the graph feature.

[0096] According to an embodiment of the present disclosure, the de-pseudo attack traffic data is sampled by using a nonlinear function to obtain sampling data, and the sampling data is window data with time sequence characteristics.

[0097] According to an embodiment of the present disclosure, the sampling data is encoded into low-dimensional space features, the low-dimensional space features are processed by using a classification graph construction algorithm to generate node data and edge data, and the graph data includes the node data and the edge data.

[0098] According to an embodiment of the present disclosure, the node data records attribute data of the target objects or the related objects, and the edge data records communication relationship data between the target objects and the related objects.

[0099] According to an embodiment of the present disclosure, the graph neural network model is constructed according to a graph convolutional network (GCN) or a graph attention network (GAT).

[0100] According to an embodiment of the present disclosure, the graph data is input into the graph neural network model for learning to capture complex relationships and context information between data packets, and the graph feature is obtained.

[0101] According to an embodiment of the present disclosure, the graph neural network can effectively capture complex relationships between nodes, extract high-level features, and further identify the correlation and dynamic changes between different attack traffic data, thereby enhancing the accuracy of type recognition.

[0102] According to an embodiment of the present disclosure, the network data processing method further includes: enhancing the type recognition model based on a preset reinforcement learning manner to obtain an enhanced type recognition model.

[0103] According to an embodiment of the present disclosure, the preset reinforcement learning manner can be a reinforcement learning algorithm (Q-Learning) or a proximal policy optimization algorithm (PPO).

[0104] According to an embodiment of the present disclosure, after pre-training the type identification model, state data is collected according to a performance state of the type identification model, and a preset reinforcement learning manner is used to learn the state data to obtain a feedback result, and the feedback result is used to adjust training parameters of a next round of the type identification model to obtain an enhanced type identification model.

[0105] According to an embodiment of the present disclosure, the type identification model is enhanced based on the preset reinforcement learning manner, and the type identification model can be more effectively learned and adjusted in real time when facing new attacks.

[0106] Based on the network data processing method, the present disclosure further provides a network data processing device. The network data processing device will be described in detail below. Figure 5 The device will be described in detail.

[0107] Figure 5 A structural block diagram of the network data processing device according to an embodiment of the present disclosure is schematically shown.

[0108] As shown in Figure 5 , the network data processing device 500 of the embodiment includes an extraction module 510, a de-aliasing module 520, a processing module 530, and an identification module 540.

[0109] The extraction module 510 is configured to filter attack traffic data in initial traffic data packets based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packets include traffic data within a preset data range captured in response to a detection time. In an embodiment, the extraction module 510 can be configured to perform the operation S210 described above, and details are not repeated here.

[0110] The de-aliasing module 520 is configured to perform de-aliasing processing on the attack traffic data to obtain de-aliased attack traffic data. In an embodiment, the de-aliasing module 520 can be configured to perform the operation S220 described above, and details are not repeated here.

[0111] The processing module 530 is configured to perform feature extraction on the de-aliased attack traffic data to obtain target features, wherein the target features include traffic change information of a target object and data communication relationship information between the target object and a related object, the target object is an object accessed by the attack traffic data, and the related object is an object in communication with the target object. In an embodiment, the processing module 530 can be configured to perform the operation S230 described above, and details are not repeated here.

[0112] The identification module 540 is configured to process the target features by using a type identification model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type. In an embodiment, the identification module 540 can be configured to perform the operation S240 described above, and details are not repeated here.

[0113] According to an embodiment of the present disclosure, the de-pseudo module 520 comprises a first de-pseudo sub-module, a second de-pseudo sub-module, a third de-pseudo sub-module and a fourth de-pseudo sub-module.

[0114] The first de-pseudo sub-module is configured to detect the attack traffic data and determine pseudo information, wherein the pseudo information comprises pseudo source information and pseudo protocol information.

[0115] The second de-pseudo sub-module is configured to process the pseudo source information by using a blockchain algorithm to obtain true source information.

[0116] The third de-pseudo sub-module is configured to process the pseudo protocol information by using a blockchain algorithm to obtain true protocol information.

[0117] The fourth de-pseudo sub-module is configured to obtain de-pseudo attack traffic data based on the true source information and the true protocol information.

[0118] According to an embodiment of the present disclosure, the identification module 540 comprises a first identification sub-module and a second identification sub-module.

[0119] The first identification sub-module is configured to encrypt the target feature by using an encryption module to obtain an encrypted feature.

[0120] The second identification sub-module is configured to perform type identification on the encrypted feature by using an identification module to obtain an attack type corresponding to the de-pseudo attack traffic data.

[0121] According to an embodiment of the present disclosure, the second identification sub-module comprises a first identification unit, a second identification unit and a third identification unit.

[0122] The first identification unit is configured to process the encrypted feature by using a convolutional neural sub-layer to obtain a deep convolutional feature.

[0123] The second identification unit is configured to process the deep convolutional feature by using a graph neural sub-layer to obtain a graph convolutional feature.

[0124] The third identification unit is configured to process the graph convolutional feature by using a fully connected sub-layer to obtain the attack type corresponding to the de-pseudo attack traffic data.

[0125] According to an embodiment of the present disclosure, the processing module 530 comprises a first processing sub-module, a second processing sub-module and a third processing sub-module.

[0126] The first processing sub-module is configured to process the de-pseudo attack traffic data by using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of the target object.

[0127] The second processing sub-module is configured to process the de-pseudonymized attack traffic data by using a graph neural network model to obtain graph features, wherein the graph features represent data communication relationship information between the target object and the related objects.

[0128] The third processing sub-module is configured to fuse the traffic features and the graph features to obtain target features.

[0129] According to an embodiment of the present disclosure, the second processing sub-module includes a first processing unit, a second processing unit, and a third processing unit.

[0130] The first processing unit is configured to perform sampling processing on the de-pseudonymized attack traffic data to obtain sampling data.

[0131] The second processing unit is configured to process the sampling data by using a classification graphing algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent the target object or the related objects, and the edges represent the communication relationship between the nodes.

[0132] The third processing unit is configured to process the graph data by using a graph neural network model to obtain graph features.

[0133] According to an embodiment of the present disclosure, the network data processing apparatus 500 further includes an enhancement module.

[0134] The enhancement module is configured to enhance the type recognition model based on a preset reinforcement learning manner to obtain an enhanced type recognition model.

[0135] According to an embodiment of the present disclosure, any one or more of the extraction module 510, the de-pseudonymization module 520, the processing module 530, and the recognition module 540 can be combined in one module, or any one of the modules can be split into multiple modules. Alternatively, at least part of the function of one or more of the modules can be combined with at least part of the function of the other modules, and implemented in one module. According to an embodiment of the present disclosure, at least one of the extraction module 510, the de-pseudonymization module 520, the processing module 530, and the recognition module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system in package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. hardware or firmware, or in any one of software, hardware, and firmware or in an appropriate combination of any one or more of them. Alternatively, at least one of the extraction module 510, the de-pseudonymization module 520, the processing module 530, and the recognition module 540 can be at least partially implemented as a computer program module that can perform corresponding functions when the computer program module is run.

[0136] Figure 6 A block diagram schematically illustrating an electronic device according to an embodiment of the present disclosure is shown.

[0137] As shown in Figure 6 The electronic device 600 according to an embodiment of the present disclosure includes a processor 601 that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or loaded from a storage section 608 into a random access memory (RAM) 603. The processor 601 can include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor, and / or a related chipset, and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), and / or the like. The processor 601 can also include an on-board memory for cache use. The processor 601 can include a single processing unit or a plurality of processing units for performing different actions of the method processes according to embodiments of the present disclosure.

[0138] In the RAM 603, various programs and data required for the operation of the electronic device 600 are stored. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method processes according to embodiments of the present disclosure by executing programs in the ROM 602 and / or the RAM 603. Note that the programs can also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 can also perform various operations of the method processes according to embodiments of the present disclosure by executing programs stored in the one or more memories.

[0139] According to embodiments of the present disclosure, the electronic device 600 can further include an input / output (I / O) interface 605 that is also connected to the bus 604. The electronic device 600 can further include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, a mouse, and the like; an output section 607 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage section 608 including a hard disk, and the like; and a communication section 609 including a network interface card such as a LAN card, a modem, and the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as necessary. A removable medium 611 such as a magnetic disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 610 as necessary, so that a computer program read therefrom is installed into the storage section 608 as necessary.

[0140] The present disclosure also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments, or exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of the present disclosure.

[0141] According to an embodiment of the present disclosure, the computer readable storage medium can be a non-volatile computer readable storage medium, which can include, but is not limited to, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination thereof. In the present disclosure, the computer readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in connection with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, the computer readable storage medium can include one or more memories, such as the ROM 602 and / or the RAM 603 described above, and / or one or more memory units other than the ROM 602 and the RAM 603.

[0142] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program codes for executing the methods shown in the flowcharts. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the network data processing method provided by the embodiments of the present disclosure.

[0143] The above functions defined in the system / apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 601. According to an embodiment of the present disclosure, the system, apparatus, module, unit, etc. described above can be implemented by computer program modules.

[0144] In one embodiment, the computer program can rely on a tangible storage medium, such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program can also be transmitted, distributed, and downloaded in the form of a signal via a network medium, and be downloaded and installed via the communication part 609 and / or installed from the detachable medium 611. The program codes contained in the computer program can be transmitted via any appropriate network medium, including but not limited to wireless, wired, etc., or any appropriate combination thereof.

[0145] In such embodiments, the computer program can be downloaded and installed from the network via the communication section 609, and / or installed from the removable media 611. When the computer program is executed by the processor 601, the above-described functions defined in the system of the embodiments of the present disclosure are executed. According to the embodiments of the present disclosure, the system, device, apparatus, module, unit, and the like described above can be implemented by the computer program modules.

[0146] According to the embodiments of the present disclosure, the program code for executing the computer program provided by the embodiments of the present disclosure can be written in any combination of one or more programming languages, and specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming language, and / or assembly / machine language. The programming language includes, but is not limited to, such as Java, C++, python, “C” language or similar programming language. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case involving a remote computing device, the remote computing device can be connected to the user computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, connected to the Internet through an Internet service provider).

[0147] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams can represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than those noted in the drawings. For example, two blocks that are shown in succession can actually be executed substantially concurrently, or they can sometimes be executed in reverse order, depending on the involved functions. It should also be noted that each block in the block diagrams or flowcharts, and the combination of blocks in the block diagrams or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0148] Those skilled in the art can understand that the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations, even if such combinations are not explicitly described in the present disclosure. In particular, the features described in various embodiments of the present disclosure can be combined and / or integrated in various combinations without departing from the spirit and teachings of the present disclosure. All such combinations and / or integrations fall within the scope of the present disclosure.

[0149] The above describes embodiments of the present disclosure. However, these embodiments are merely for illustrative purposes, and are not intended to limit the scope of the present disclosure. Although each embodiment is described above separately, this does not mean that the measures in each embodiment cannot be used advantageously in combination. Those skilled in the art can make various substitutions and modifications without departing from the scope of the present disclosure, and these substitutions and modifications should all fall within the scope of the present disclosure.

Claims

1. A network data processing method, characterized by, The method comprises: Filtering attack traffic data in initial traffic data packets based on traffic timing, traffic change rate, and traffic access frequency, wherein the initial traffic data packets comprise traffic data within a preset data range captured in response to a detection time; Performing anti-fake processing on the attack traffic data to obtain anti-fake attack traffic data; Performing feature extraction on the anti-fake attack traffic data to obtain target features, comprising: Processing the anti-fake attack traffic data using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of a target object; Processing the anti-fake attack traffic data using a graph neural network model to obtain graph features, wherein the graph features represent data communication relationship information between the target object and related objects; Fusing the traffic features and the graph features to obtain the target features, wherein the target object is an object accessed by the attack traffic data, and the related objects are objects that communicate with the target object; Processing the target features using a type identification model to obtain an attack type corresponding to the anti-fake attack traffic data, so as to execute a security policy corresponding to the attack type, wherein the type identification model comprises an identification module, and the identification module comprises a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer.

2. The method of claim 1, wherein, Performing anti-fake processing on the attack traffic data to obtain anti-fake attack traffic data, comprising: Detecting the attack traffic data to determine pseudo-information, wherein the pseudo-information comprises pseudo-source information and pseudo-protocol information; Processing the pseudo-source information using a blockchain algorithm to obtain true-source information; Processing the pseudo-protocol information using a blockchain algorithm to obtain true-protocol information; Obtaining the anti-fake attack traffic data based on the true-source information and the true-protocol information.

3. The method of claim 1, wherein, The type identification model comprises an encryption module, and processing the target features using the type identification model to obtain an attack type corresponding to the anti-fake attack traffic data comprises: Encrypting the target features using the encryption module to obtain encrypted features; Using the identification module to identify the type of the encrypted features to obtain an attack type corresponding to the anti-fake attack traffic data.

4. The method of claim 3, wherein, Using the identification module to identify the type of the encrypted features to obtain an attack type corresponding to the anti-fake attack traffic data comprises: Processing the encrypted features using the convolutional neural sublayer to obtain deep convolutional features; Processing the deep convolutional features using the graph neural sublayer to obtain graph convolutional features; Processing the graph convolutional features using the fully connected sublayer to obtain an attack type corresponding to the anti-fake attack traffic data.

5. The method of claim 1, wherein, Processing the anti-fake attack traffic data using a graph neural network model to obtain graph features comprises: Performing sampling processing on the anti-fake attack traffic data to obtain sampling data; Processing the sampling data using a classification graphing algorithm to obtain graph data, wherein the graph data is composed of nodes and edges, the nodes represent the target object or the related objects, and the edges represent communication relationships between the nodes; The graph data is processed by using a graph neural network model to obtain graph features.

6. The method of claim 1, wherein, The method further includes: The type recognition model is enhanced based on a preset reinforcement learning manner to obtain an enhanced type recognition model.

7. A network data processing device, characterized by The device includes: An extraction module is configured to filter attack traffic data in initial traffic data packets based on traffic time series, traffic change rates, and traffic access frequencies, wherein the initial traffic data packets include traffic data within a preset data range captured at a detection time; A de-aliasing module is configured to perform de-aliasing processing on the attack traffic data to obtain de-aliased attack traffic data; A processing module is configured to perform feature extraction on the de-aliased attack traffic data to obtain target features, and the processing module includes a first processing submodule, a second processing submodule, and a third processing submodule; The first processing submodule is configured to process the de-aliased attack traffic data by using a self-supervised learning algorithm to obtain traffic features, wherein the traffic features represent traffic change information of a target object; The second processing submodule is configured to process the de-aliased attack traffic data by using a graph neural network model to obtain graph features, wherein the graph features represent data communication relationship information between the target object and related objects; The third processing submodule is configured to fuse the traffic features and the graph features to obtain the target features, wherein the target object is an object accessed by the attack traffic data, and the related objects are objects that communicate with the target object; A first recognition module is configured to process the target features by using a type recognition model to obtain an attack type corresponding to the de-aliased attack traffic data, so as to execute a security policy corresponding to the attack type, wherein the type recognition model includes a second recognition module, and the second recognition module includes a convolutional neural sublayer, a graph neural sublayer, and a fully connected sublayer.

8. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-6.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-6.

Images