Network attack detection method and device, equipment and storage medium

Abstract

The invention provides a network attack detection method and apparatus, a device and a storage medium. The method comprises the steps of obtaining a reconstruction error of input network traffic data; when the reconstruction error is greater than a preset threshold value, marking the network traffic data as attack traffic; and classifying the attack traffic, and outputting a network attack type corresponding to the attack traffic. According to the method, firstly, the selected threshold value and the calculated reconstruction error are compared, whether the flow is the attack flow or the normal flow is judged, then the attack flow is classified, and finally the specific type of the attack flow is obtained. According to the two-stage detection of the network attack traffic, the detection accuracy is improved, the unknown type of network attack traffic can be detected, different processing can be performed on normal traffic and abnormal traffic, the system resource consumption can be greatly reduced, and the detection efficiency of the network attack is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a network attack detection method, device, equipment and storage medium. Background Art

[0002] In the past few decades, the use of the Internet has become more and more popular. In addition to people's daily needs for the Internet, enterprises and political departments also need to use the Internet. The huge scale of the Internet has brought many negative things. Many people use various technologies in the open Internet to carry out different types of network attacks, including viruses, Trojans, worms, SQL injection attacks, and phishing attacks.

[0003] DDos attacks take advantage of the openness and distributed nature of the Internet. Attackers use botnets or distributed attack tools to send a large amount of traffic to the target system in a short period of time, paralyzing the system and making it unable to provide services normally. This type of attack poses a great danger to cyberspace.

[0004] Traditional methods use machine learning methods to detect DDos attacks, including support vector machines, decision trees, and K Nearest Neighbors. However, such shallow machine learning methods are difficult to detect attacks in large data sets and still cannot detect unknown attack types. Summary of the invention

[0005] Embodiments of the present application provide a network attack detection method, apparatus, device, and storage medium.

[0006] In a first aspect, an embodiment of the present application provides a network attack detection method, the method comprising:

[0007] Obtaining the reconstruction error of input network traffic data;

[0008] When the reconstruction error is greater than the preset threshold, marking the network traffic data as attack traffic;

[0009] The attack traffic is classified, and the network attack type corresponding to the attack traffic is output.

[0010] Optionally, after the step of obtaining the reconstruction error of the input network traffic data, the method includes:

[0011] When the reconstruction error is smaller than a preset threshold, the network traffic data is marked as normal traffic.

[0012] Optionally, before the step of obtaining a reconstruction error of the input network traffic data, the method includes:

[0013] Preprocessing the pre-acquired training data set to obtain target training data;

[0014] Construct the reconstruction error formula corresponding to the target training data;

[0015] Calculate the maximum reconstruction error and the minimum reconstruction error in the target training data by using the reconstruction error formula;

[0016] Set the preset threshold to the maximum reconstruction error;

[0017] When the preset threshold is greater than the minimum reconstruction error, calculating a target accuracy rate according to target verification data corresponding to the target training data acquired in advance and the target training data;

[0018] When the target accuracy is greater than the preset accuracy, the preset threshold is output.

[0019] Optionally, after the step of calculating the target accuracy rate according to the target verification data corresponding to the target training data acquired in advance and the target training data when the preset threshold is greater than the minimum reconstruction error, the method includes:

[0020] When the target accuracy is less than or equal to the preset accuracy, the preset threshold is subtracted from a preset value.

[0021] Optionally, the obtaining of the reconstruction error of the input network detection data includes:

[0022] The reconstruction error corresponding to the network detection data is calculated using the reconstruction error formula.

[0023] Optionally, the preprocessing of the pre-acquired training data set to obtain target training data includes:

[0024] Get the total training data set;

[0025] Repetitive training data in the total training data set are eliminated, and sampling is performed in the total training data set to obtain a training data set and a verification data set;

[0026] The training data set is normalized to obtain target training data.

[0027] Optionally, the classifying the attack traffic and outputting the network attack type corresponding to the attack traffic includes:

[0028] The attack traffic is input into a pre-trained deep neural network model, and the network attack type corresponding to the attack traffic is output.

[0029] In a second aspect, an embodiment of the present application provides a network attack detection device, the device comprising:

[0030] An acquisition module, used for acquiring a reconstruction error of input network traffic data;

[0031] A marking module, used for marking the network traffic data as attack traffic when the reconstruction error is greater than the preset threshold;

[0032] The output module is used to classify the attack traffic and output the network attack type corresponding to the attack traffic.

[0033] Optionally, the device comprises:

[0034] The second marking module is used to mark the network traffic data as normal traffic when the reconstruction error is less than a preset threshold.

[0035] Optionally, the device comprises:

[0036] The first module is used to preprocess the pre-acquired training data set to obtain target training data;

[0037] The second module is used to construct the reconstruction error formula corresponding to the target training data;

[0038] A third module is used to calculate the maximum reconstruction error and the minimum reconstruction error in the target training data by using the reconstruction error formula;

[0039] The fourth module is used to set the preset threshold as the maximum reconstruction error;

[0040] A fifth module, configured to calculate a target accuracy rate according to target verification data corresponding to the target training data acquired in advance and the target training data when the preset threshold is greater than the minimum reconstruction error;

[0041] The sixth module is used to output the preset threshold when the target accuracy is greater than the preset accuracy.

[0042] Optionally, the device comprises:

[0043] The seventh module is used to subtract a preset value from the preset threshold when the target accuracy is less than or equal to the preset accuracy.

[0044] Optionally, the acquisition module includes:

[0045] The acquisition submodule is used to calculate the reconstruction error corresponding to the network detection data through the reconstruction error formula.

[0046] Optionally, the first module includes:

[0047] The first submodule is used to obtain the total training data set;

[0048] The second submodule is used to remove duplicate training data in the total training data set and perform sampling in the total training data set to obtain a training data set and a verification data set;

[0049] The third submodule is used to normalize the training data set to obtain target training data.

[0050] Optionally, the output module includes:

[0051] The output submodule is used to input the attack traffic into a pre-trained deep neural network model and output the network attack type corresponding to the attack traffic.

[0052] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the network attack detection methods described above.

[0053] In a fourth aspect, an embodiment of the present application further provides a storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute any of the network attack detection methods described above.

[0054] In an embodiment of the present application, the reconstruction error of the input network traffic data is obtained; when the reconstruction error is greater than the preset threshold, the network traffic data is marked as attack traffic; the attack traffic is classified, and the network attack type corresponding to the attack traffic is output. That is, in an embodiment of the present application, firstly, based on the selected threshold and the calculated reconstruction error comparison, the traffic is judged to be attack traffic or normal traffic, and then the attack traffic is classified, and finally the specific type of attack traffic is obtained. This two-stage detection of network attack traffic not only improves the detection accuracy, but also can detect unknown types of network attack traffic. Different treatments are performed on normal traffic and abnormal traffic, which can greatly reduce system resource consumption and improve the detection efficiency of network attacks.

[0055] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0057] Figure 1 It is a flowchart of the steps of a network attack detection method provided by an embodiment of the present application;

[0058] Figure 2 is a device block diagram of a network attack detection device provided in an embodiment of the present application;

[0059] Figure 3 is a structural diagram of an electronic device provided in an embodiment of the present application;

[0060] Figure 4 is a schematic diagram of an exemplary data set attack type provided in an embodiment of the present application;

[0061] Figure 5 is a schematic diagram of an exemplary deep autoencoder structure provided in an embodiment of the present application;

[0062] Figure 6 is a schematic diagram of an exemplary deep neural network model structure provided in an embodiment of the present application;

[0063] Figure 7 It is a schematic diagram of an exemplary network attack detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0065] Figure 1 is a flowchart of a network attack detection method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0066] It should be noted that before step 101, the DAE model needs to be trained first, a preset threshold corresponding to the reconstruction error is obtained, and how to calculate the reconstruction error is constructed.

[0067] That is, before the step of obtaining the reconstruction error of the input network traffic data, the method includes:

[0068] Preprocessing the pre-acquired training data set to obtain target training data;

[0069] Construct the reconstruction error formula corresponding to the target training data;

[0070] Calculate the maximum reconstruction error and the minimum reconstruction error in the target training data by using the reconstruction error formula;

[0071] Set the preset threshold to the maximum reconstruction error;

[0072] When the preset threshold is greater than the minimum reconstruction error, calculating a target accuracy rate according to target verification data corresponding to the target training data acquired in advance and the target training data;

[0073] When the target accuracy is greater than the preset accuracy, the preset threshold is output.

[0074] Further, after the step of calculating the target accuracy rate according to the target verification data corresponding to the target training data acquired in advance and the target training data when the preset threshold is greater than the minimum reconstruction error, the method includes:

[0075] When the target accuracy is less than or equal to the preset accuracy, the preset threshold is subtracted from a preset value.

[0076] Furthermore, the preprocessing of the pre-acquired training data set to obtain target training data includes:

[0077] Get the total training data set;

[0078] Repetitive training data in the total training data set are eliminated, and sampling is performed in the total training data set to obtain a training data set and a verification data set;

[0079] The training data set is normalized to obtain target training data.

[0080] It should be noted that in the embodiments of the present application, the present invention uses the CIC-DDoS2019 dataset as the total training dataset to illustrate the technical solution. This dataset has 66 feature datasets and is one of the main public datasets for verifying DDos attack detection. The dataset contains the following Figure 4 In order to verify the feasibility of the proposed method, 13 types of DDos attack data in the dataset can be used to train the proposed deep autoencoder and deep neural network.

[0081] The present invention uses a two-stage DDos attack detection framework based on deep autoencoder and deep neural network to detect DDos attacks. The specific method is as follows: Figure 7As shown in the figure, taking the CIC-DDoS2019 dataset as an example, the data must be preprocessed first. The first stage of the two-stage DDos attack detection first uses the trained DAE model to judge the traffic. If it is judged as normal traffic, it is released. If it is judged as abnormal traffic, the traffic is intercepted and further classified. The training process of the DAE model will be given below. In the second stage of the two-stage DDos attack detection, the abnormal traffic obtained is specifically classified using the trained DNN model to obtain the specific DDos attack type.

[0082] First, we preprocess the data in the CIC-DDoS2019 dataset. After removing duplicate data, we divide the dataset into three parts. We randomly sample 80% of the total dataset as the training set for training, 10% of the total dataset as the validation set for selecting the threshold, and 10% of the total dataset as the test set to measure the training effect of the trained model. The purpose of doing so is to increase the generalization ability of the trained model. Secondly, we use the normalization strategy to process the original data, normalize the data of different dimensions to between [0,1], eliminate the impact of different dimensions of data of different dimensions and accelerate the convergence of the model. The calculation formula is shown in Formula 1.

[0083]

[0084] After obtaining the data, the present invention trains the DAE model required for the first stage. The deep autoencoder in the present invention uses a combination of two encoders and two decoders. Figure 5 As shown in the figure, the hidden layers of the two encoders use the fully connected layer activation function using the sigmoid function, the number of neurons is 32 and 16, and the decoder is completely symmetrical with the encoder. The deep autoencoder inputs the feature vector x with 66 features, which is encoded by the two encoders and then decoded by two symmetrical decoders.

[0085] In the encoding phase, the encoding function f is used to transform the initial input x into a hidden representation h, which is calculated using Formula 2, where the nonlinear activation function σ is chosen as sigmoid, W represents the weight, and b represents the bias. The randomly initialized autoencoder iteratively updates the parameters through back propagation.

[0086] h=f(x)=σ(Wx+b) (Formula 2)

[0087] In the decoding stage, the function g is used to reconstruct the hidden representation h into x'. Here, a nonlinear activation function σ' is also selected for reconstruction. W' represents the weight and b' represents the bias. The reconstruction process is shown in Formula 3:

[0088] x'=g(h)=σ'(W'h+b) (Formula 3)

[0089] The training of the autoencoder is to find the parameter θ = {W, b, b'} through the back propagation algorithm to minimize the sum of the reconstruction errors in the training set D, that is, the objective function. The calculation formula of the objective function J(θ) is shown in Formula 4:

[0090]

[0091] L is the reconstruction error. The reconstruction error of the autoencoder generally uses the square of the error to measure the similarity between the input information and the reconstructed information. In the deep autoencoder, since the data has been normalized, the cross entropy loss is used to represent the reconstruction error. The calculation formula is shown in Formula 5:

[0092]

[0093] The attack detection method of the deep autoencoder is trained with normal data. When the input is normal data, a lower reconstruction error will be obtained, while a higher reconstruction error means that the input data is abnormal and is attack traffic. The threshold of this reconstruction error needs to be selected carefully. A higher or lower reconstruction error will cause misjudgment of the data. For example, a lower threshold will cause a large amount of attack traffic to be judged as normal traffic, which will indirectly cause the system to crash in serious cases.

[0094] Therefore, in the embodiment of the present application, it is necessary to select a threshold value of the reconstruction error.

[0095] Specifically, for the threshold selection method, the optimal threshold selection algorithm can be used:

[0096] Input: training set X_Train, validation set X_Val

[0097] Output: optimal threshold best_threshold

[0098] Use the training set X_Train to train the DAE model

[0099] Calculate the maximum reconstruction error Max_RE and the minimum reconstruction error Min_RE in the training data

[0100] Initialize the optimal threshold and threshold: best_threshold = threshold = Max_RE

[0101] whilethreshold>Min_RE

[0102] do uses the validation set to calculate the accuracy

[0103] ifaccuracy>best_accuracy;

[0104] best_accuracy = accuracy

[0105] best_threshold = threshold

[0106] else;

[0107] threshold=threshold-0.001

[0108] endwhile;

[0109] As can be seen from the above, the pre-acquired training data set is preprocessed to obtain the target training data; a reconstruction error formula corresponding to the target training data is constructed; the maximum reconstruction error and the minimum reconstruction error in the target training data are calculated by the reconstruction error formula; a preset threshold is set as the maximum reconstruction error; when the preset threshold is greater than the minimum reconstruction error, the target accuracy is calculated based on the target verification data corresponding to the pre-acquired target training data and the target training data; when the target accuracy is greater than the preset accuracy, the preset threshold is output.

[0110] In addition, accuracy is the accuracy rate, which is used as an evaluation criterion for the quality of model training. The same evaluation criteria include precision, recall, and F1 indicators.

[0111] The calculation formulas are shown in 6, 7, and 8:

[0112]

[0113]

[0114]

[0115] Among them, in the above formula 6, TP is a true positive example that is predicted to be correct and the actual situation is also correct, TN is a true negative example that is predicted to be wrong and the actual situation is also wrong, FP is a false positive example that is predicted to be wrong but the actual situation is correct, and FN is a false negative example that is predicted to be correct but the actual situation is wrong. The present invention can use the above indicators in the test set to measure the training effect.

[0116] The threshold selection method in the present invention starts with the highest RE of the training data as the abnormal threshold, uses the validation set to calculate the accuracy of the model, and caches the accuracy and threshold if the accuracy obtained in this iteration is better than the previous accuracy. The limit value of the threshold is set as the lowest reconstruction error, and the optimal threshold and the highest accuracy are found through continuous iteration. If the calculated accuracy is not the highest accuracy round during the iteration, the threshold is subtracted by 0.001 to avoid the iteration falling into an infinite loop.

[0117] Step 101, obtaining a reconstruction error of input network traffic data;

[0118] Furthermore, the reconstruction error of the obtained input network detection data includes:

[0119] The reconstruction error corresponding to the network detection data is calculated using the reconstruction error formula.

[0120] It should be noted that the reconstruction error formula refers to the above formula 5.

[0121] Specifically, the network traffic data can be input into the trained DAE model to judge the traffic, that is, the network traffic data can be input into the trained DAE model to calculate the reconstruction error of the network detection data.

[0122] Step 102, when the reconstruction error is greater than a preset threshold, marking the network traffic data as attack traffic;

[0123] Further, after step 101, after the step of obtaining the reconstruction error of the input network traffic data, the method includes:

[0124] When the reconstruction error is smaller than a preset threshold, the network traffic data is marked as normal traffic.

[0125] It should be noted that in the embodiment of the present application, the attack detection method of the deep autoencoder is trained using normal data. When the input is normal data, a lower reconstruction error will be obtained, while a higher reconstruction error indicates that the input data is abnormal and is attack traffic.

[0126] Therefore, the trained DAE model is used to reconstruct the input data. When the calculated reconstruction error is less than the threshold, the data is marked as normal traffic. If the calculated reconstruction error is greater than the threshold, the data is marked as attack traffic. The threshold-based method does not rely on the judgment of the type of DDos attack to determine whether the input feature is DDos attack data, but judges it through the calculated reconstruction error. In other words, the proposed method can detect both known and unknown types of DDos attack traffic at the same time, which can greatly improve the robustness and security of the network.

[0127] Step 103: classify the attack traffic and output the network attack type corresponding to the attack traffic.

[0128] Furthermore, the classifying the attack traffic and outputting the network attack type corresponding to the attack traffic includes:

[0129] The attack traffic is input into a pre-trained deep neural network model, and the network attack type corresponding to the attack traffic is output.

[0130] It should be noted that in the embodiment of the present application, after the first stage, normal traffic is released, and abnormal traffic is specifically classified in the second stage. For the detection of DDos attacks, the second stage uses the trained DNN to specifically classify the types of attacks. Taking the CIC-DDoS2019 dataset as an example, there are 13 different types of attacks. The structure diagram of the designed DNN is shown in the figure. Figure 6 shown.

[0131] The DNN used in the present invention has 4 hidden layers, and the number of neurons in the input layer is consistent with the number of dimensions of the feature vector, which is set to 66 for the CIC-DDoS2019 dataset. The output layer has 13 neurons, and the output of each neuron represents a type of DDos attack in the CIC-DDoS2019 dataset. The number of neurons in the hidden layer is designed to be 80, 128, 64, and 32 respectively. The activation function uses softmax, the optimizer uses adam, and the back propagation algorithm is used to train the DNN. Such a design can well extract the abnormal traffic features and improve the accuracy of abnormal traffic classification.

[0132] The accuracy, precision, and recall rates corresponding to formulas 6, 7, and 8 are also used to measure the quality of DNN training results. The trained DNN model performs specific classification of abnormal traffic in the second stage.

[0133] Using the test set data, first input it into the trained DAE model, and judge whether the traffic is attack traffic or normal traffic based on the selected threshold and the calculated reconstruction error comparison. Then input the attack traffic into the trained DNN model, and finally get the specific type of attack traffic. This two-stage detection of DDos attack traffic not only improves the detection accuracy, but also can detect unknown types of DDos attack traffic. Different processing of normal traffic and abnormal traffic can greatly reduce system resource consumption and improve the detection efficiency of DDos attacks.

[0134] In an embodiment of the present application, the reconstruction error of the input network traffic data is obtained; when the reconstruction error is greater than the preset threshold, the network traffic data is marked as attack traffic; the attack traffic is classified, and the network attack type corresponding to the attack traffic is output. That is, in an embodiment of the present application, firstly, based on the selected threshold and the calculated reconstruction error comparison, the traffic is judged to be attack traffic or normal traffic, and then the attack traffic is classified, and finally the specific type of attack traffic is obtained. This two-stage detection of network attack traffic not only improves the detection accuracy, but also can detect unknown types of network attack traffic. Different treatments are performed on normal traffic and abnormal traffic, which can greatly reduce system resource consumption and improve the detection efficiency of network attacks.

[0135] Figure 2 is a device block diagram of a network attack detection device provided in an embodiment of the present application, such as Figure 2 As shown, the device comprises:

[0136] An acquisition module 201 is used to acquire a reconstruction error of input network traffic data;

[0137] A marking module 202, configured to mark the network traffic data as attack traffic when the reconstruction error is greater than the preset threshold;

[0138] The output module 203 is used to classify the attack traffic and output the network attack type corresponding to the attack traffic.

[0139] Optionally, the device comprises:

[0140] The second marking module is used to mark the network traffic data as normal traffic when the reconstruction error is less than a preset threshold.

[0141] Optionally, the device comprises:

[0142] The first module is used to preprocess the pre-acquired training data set to obtain target training data;

[0143] The second module is used to construct the reconstruction error formula corresponding to the target training data;

[0144] A third module is used to calculate the maximum reconstruction error and the minimum reconstruction error in the target training data by using the reconstruction error formula;

[0145] The fourth module is used to set the preset threshold as the maximum reconstruction error;

[0146] A fifth module, configured to calculate a target accuracy rate according to target verification data corresponding to the target training data acquired in advance and the target training data when the preset threshold is greater than the minimum reconstruction error;

[0147] The sixth module is used to output the preset threshold when the target accuracy is greater than the preset accuracy.

[0148] Optionally, the device comprises:

[0149] The seventh module is used to subtract a preset value from the preset threshold when the target accuracy is less than or equal to the preset accuracy.

[0150] Optionally, the acquisition module includes:

[0151] The acquisition submodule is used to calculate the reconstruction error corresponding to the network detection data through the reconstruction error formula.

[0152] Optionally, the first module includes:

[0153] The first submodule is used to obtain the total training data set;

[0154] The second submodule is used to remove duplicate training data in the total training data set and perform sampling in the total training data set to obtain a training data set and a verification data set;

[0155] The third submodule is used to normalize the training data set to obtain target training data.

[0156] Optionally, the output module includes:

[0157] The output submodule is used to input the attack traffic into a pre-trained deep neural network model and output the network attack type corresponding to the attack traffic.

[0158] In an embodiment of the present application, the reconstruction error of the input network traffic data is obtained; when the reconstruction error is greater than the preset threshold, the network traffic data is marked as attack traffic; the attack traffic is classified, and the network attack type corresponding to the attack traffic is output. That is, in an embodiment of the present application, firstly, based on the selected threshold and the calculated reconstruction error comparison, the traffic is judged to be attack traffic or normal traffic, and then the attack traffic is classified, and finally the specific type of attack traffic is obtained. This two-stage detection of network attack traffic not only improves the detection accuracy, but also can detect unknown types of network attack traffic. Different treatments are performed on normal traffic and abnormal traffic, which can greatly reduce system resource consumption and improve the detection efficiency of network attacks.

[0159] Figure 3This is a structural diagram of an electronic device M00 provided in an embodiment of the present application. In the figure, the electronic device M00 includes a processor M01 and a memory M02. The electronic device includes: a processor; a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any of the network attack detection methods described above, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0160] In an embodiment of the present application, the memory M02 can be used to store software programs and various data. The memory M02 may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory M02 may include a volatile memory or a non-volatile memory, or the memory x09 may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDRSDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM) and a direct memory bus random access memory (DRRAM). The memory M02 in the embodiment of the present application includes but is not limited to these and any other suitable types of memories.

[0161] The processor M01 may include one or more processing units; optionally, the processor M01 integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor M01.

[0162] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned network attack detection method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0163] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0164] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned network attack detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0165] It should be understood that the chip involved in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0166] An embodiment of the present application also provides a storage medium. When instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the network attack detection methods described above.

[0167] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned network attack detection method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0168] An embodiment of the present application also provides a vehicle, which includes the network attack detection device as described above.

[0169] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0170] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the relevant technology, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0171] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A network attack detection method, characterized in that: The method comprises: Obtaining the reconstruction error of input network traffic data; When the reconstruction error is greater than a preset threshold, marking the network traffic data as attack traffic; The attack traffic is classified, and the network attack type corresponding to the attack traffic is output.

2. The method according to claim 1, characterized in that After the step of obtaining the reconstruction error of the input network traffic data, the method comprises: When the reconstruction error is smaller than a preset threshold, the network traffic data is marked as normal traffic.

3. The method according to claim 1, characterized in that Before the step of obtaining the reconstruction error of the input network traffic data, the method includes: Preprocessing the pre-acquired training data set to obtain target training data; Construct the reconstruction error formula corresponding to the target training data; Calculate the maximum reconstruction error and the minimum reconstruction error in the target training data by using the reconstruction error formula; Set the preset threshold to the maximum reconstruction error; When the preset threshold is greater than the minimum reconstruction error, calculating a target accuracy rate according to target verification data corresponding to the target training data acquired in advance and the target training data; When the target accuracy is greater than the preset accuracy, the preset threshold is output.

4. The method according to claim 3, characterized in that After the step of calculating the target accuracy rate according to the target verification data corresponding to the target training data acquired in advance and the target training data when the preset threshold is greater than the minimum reconstruction error, the method includes: When the target accuracy is less than or equal to the preset accuracy, the preset threshold is subtracted from a preset value.

5. The method according to claim 3, characterized in that: The reconstruction error of the obtained input network detection data includes: The reconstruction error corresponding to the network detection data is calculated using the reconstruction error formula.

6. The method according to claim 3, characterized in that The preprocessing of the pre-acquired training data set to obtain target training data includes: Get the total training data set; Repetitive training data in the total training data set are eliminated, and sampling is performed in the total training data set to obtain a training data set and a verification data set; The training data set is normalized to obtain target training data.

7. The method according to claim 1, characterized in that The classifying the attack traffic and outputting the network attack type corresponding to the attack traffic includes: The attack traffic is input into a pre-trained deep neural network model, and the network attack type corresponding to the attack traffic is output.

8. A network attack detection device, characterized in that: The device comprises: An acquisition module, used for acquiring a reconstruction error of input network traffic data; A marking module, used for marking the network traffic data as attack traffic when the reconstruction error is greater than the preset threshold; The output module is used to classify the attack traffic and output the network attack type corresponding to the attack traffic.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the network attack detection method as described in any one of claims 1-7.

10. A computer storage medium, a readable storage medium, for storing a program, characterized in that: When the program is executed by a processor, the network attack detection method as described in any one of claims 1 to 7 is implemented.

Images