Network security situation prediction system and method

Abstract

The invention relates to the field of network security, and provides a network security situation prediction system and method, and the method comprises the steps: carrying out the semantic analysis of network traffic data obtained by a traffic mirroring system and a honeypot log obtained by a honeypot system, so as to obtain a network traffic semantic feature and a honeypot log related semantic feature; and the two characteristics are combined and considered to realize the potential safety hazard judgment of the network. In this way, the security risk hidden behind the complex network behavior can be captured more accurately, and the network security monitoring capability can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a network security situation prediction system and method. Background Art

[0002] With the continuous development of the Internet. While the network facilitates users' lives, it also brings many security problems to users. Various means of attack continue to threaten users' information security. In recent years, network security incidents have become more and more complex and diverse, and the threats are getting bigger and bigger. In the face of unpredictable network attacks, although traditional network security protection can detect and defend against virus or Trojan attacks, it is difficult to achieve real-time monitoring of network conditions. Network security situation prediction can detect network security status in a timely manner and analyze security threats based on known data to prevent serious consequences. However, in the past, when using network traffic and other data to predict network security situation, we often only do some conventional statistical analysis, lacking in-depth mining of its semantic level, which makes the system's recognition ability need to be improved when facing complex network behaviors and attack patterns.

[0003] Therefore, an optimized network security situation prediction solution is needed. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present application provides a network security situation prediction system and method.

[0005] According to one aspect of the present application, a network security situation prediction method is provided, which includes:

[0006] Obtain network traffic data and honeypot logs from the traffic mirror system and honeypot system respectively;

[0007] Performing data processing on the network traffic data and the honeypot log to obtain a network traffic semantic feature vector and a honeypot log associated semantic feature vector;

[0008] Performing feature deviation compensation based on the target domain requirement fit on the network traffic semantic feature vector and the honeypot log associated semantic feature vector to obtain a network security monitoring feature vector;

[0009] Based on the network security monitoring feature vector, a network security monitoring result is obtained.

[0010] According to another aspect of the present application, a network security situation prediction system is provided, which includes:

[0011] A network security related data collection module, used to obtain network traffic data and honeypot logs from the traffic mirror system and the honeypot system respectively;

[0012] A network security related data processing module, used for performing data processing on the network flow data and the honeypot log to obtain a network flow semantic feature vector and a honeypot log associated semantic feature vector;

[0013] A network security related feature fusion module is used to compensate for feature deviations of the network traffic semantic feature vector and the honeypot log associated semantic feature vector based on the target domain requirements to obtain a network security monitoring feature vector;

[0014] The network security monitoring result generating module is used to obtain the network security monitoring result based on the network security monitoring feature vector.

[0015] This application has significant technical effects due to the adoption of the above technical solutions:

[0016] The network security situation prediction system and method provided by the present application performs semantic analysis on the network traffic data obtained by the traffic mirroring system and the honeypot logs obtained by the honeypot system to obtain the network traffic semantic features and the honeypot log associated semantic features, and combines these two features to realize the judgment of the network security risk hidden dangers. In this way, the security risks hidden behind the complex network behavior can be captured more accurately, which is conducive to improving the network security monitoring capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 Flow chart of a network security situation prediction method according to an embodiment of the present application.

[0019] Figure 2 Schematic diagram of data flow of a network security situation prediction method according to an embodiment of the present application.

[0020] Figure 3 This is a flowchart of step S120 in the network security situation prediction method according to an embodiment of the present application.

[0021] Figure 4 This is a flowchart of step S121 in the network security situation prediction method according to an embodiment of the present application.

[0022] Figure 5 This is a flowchart of step S122 in the network security situation prediction method according to an embodiment of the present application.

[0023] Figure 6 4 is a system block diagram of a network security situation prediction system according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0025] With the continuous leap forward of Internet technology, cyberspace has become an indispensable part of modern society, greatly facilitating users' daily lives and work. However, this process is also accompanied by increasingly severe security challenges. There are various threats lurking in the network environment, constantly invading users' information security and privacy. From simple virus propagation to complex ransomware attacks to advanced persistent threats (APT), cybersecurity incidents have not only increased in number, but their complexity and potential harm have also shown an exponential growth trend.

[0026] Traditional network security protection measures, such as firewalls, intrusion detection systems (IDS) and anti-virus software, play an important role in resisting known viruses and Trojans, but they are powerless in the face of new attack methods. What is particularly critical is that these traditional methods often focus on post-event response and defense, making it difficult to achieve real-time and comprehensive monitoring of the network environment, and difficult to capture and respond to emerging security threats in a timely manner.

[0027] In this context, network security situation prediction technology came into being. It can detect network security status in a timely manner and analyze security threats based on known data to prevent serious consequences. However, in the past, when using network traffic and other data to predict network security situation, we often only do some routine statistical analysis and lack in-depth mining of its semantic level, which makes the system's recognition ability in the face of complex network behaviors and attack patterns need to be improved. Therefore, we look forward to an optimized network security situation prediction solution.

[0028] Figure 1 Flow chart of a network security situation prediction method according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of the network security situation prediction method according to the embodiment of the present application. Figure 1 and Figure 2As shown, according to the network security situation prediction method of the embodiment of the present application, it includes: S110, obtaining network traffic data and honeypot logs from the traffic mirror system and the honeypot system respectively; S120, performing data processing on the network traffic data and the honeypot log to obtain a network traffic semantic feature vector and a honeypot log-related semantic feature vector; S130, performing feature deviation compensation on the network traffic semantic feature vector and the honeypot log-related semantic feature vector based on the fit to the target domain requirements to obtain a network security monitoring feature vector; S140, obtaining a network security monitoring result based on the network security monitoring feature vector.

[0029] In step S110, network traffic data and honeypot logs are obtained from the traffic mirroring system and the honeypot system, respectively. It should be understood that the network traffic data obtained from the traffic mirroring system records the source IP address and destination IP address information, source port and destination port information, protocol type information, data packet size and quantity information, and transmission time and frequency information of the data packet. By analyzing this information in the network traffic data, a baseline model of network behavior can be constructed. Normal network operations will have a relatively stable traffic pattern, including IP address access range, port usage, protocol ratio, etc. Once traffic with a large deviation from the baseline model is found, such as abnormal IP address access, unauthorized port access, or unusual protocol traffic, it can be preliminarily determined that the network may have security risks. For example, when an external IP address that has never appeared attempts to access sensitive areas within the enterprise and uses an abnormal combination of ports and protocols, this is likely to be an external attacker attempting to invade. The honeypot is a security resource whose value lies in being detected, attacked, or exploited. The honeypot log is a log that records various access and attack behaviors suffered by the honeypot system. It contains the IP addresses that access the honeypot, which are likely to be the source of the attacker. For example, a honeypot system can simulate a vulnerable web server. When an attacker tries to access and exploit this fake server, the honeypot log will record the attacker's IP address. The honeypot log also contains access time and request content information, such as the URL path the attacker tried to access and the HTTP method used (GET, POST, etc.). If the attacker keeps trying to access some hidden paths that may contain system vulnerabilities (such as / admin / setup, etc.), this information can be reflected in the honeypot log. In addition, the honeypot log also contains information about the type of attack behavior, such as whether it is an SQL injection attack (judged by finding SQL statement fragments in the request parameters), brute force cracking attempts (recording multiple failed login attempts), etc. In other words, the honeypot log provides first-hand information about the attacker's behavior. By analyzing the honeypot log, you can understand key information such as the attacker's attack methods, targets, and sources. In general, combining the information in the honeypot log with network traffic data can more comprehensively determine whether there are security risks in the network. For example, when the honeypot log shows a brute force attack attempt from a certain IP address, and at the same time the network traffic data shows that the IP address is making a large number of connection requests to the authentication server in the real network, then it can be highly suspected that the network is under a brute force attack, that is, there are obvious security risks in the network.

[0030] In step S120, the network traffic data and the honeypot log are processed to obtain a network traffic semantic feature vector and a honeypot log associated semantic feature vector. Specifically, Figure 3FIG. 1 is a flowchart of step S120 in the network security situation prediction method according to an embodiment of the present application. Figure 3 As shown, the step S120 includes: S121, performing semantic analysis on the network traffic data to obtain the network traffic semantic feature vector; S122, performing semantic analysis on the honeypot log to obtain the honeypot log associated semantic feature vector.

[0031] In step S121, semantic analysis is performed on the network traffic data to obtain the network traffic semantic feature vector. Specifically, Figure 4 FIG. 1 is a flowchart of step S121 in the network security situation prediction method according to an embodiment of the present application. Figure 4 As shown, the step S121 includes: S1211, segmenting the network traffic data and passing it through a network traffic semantic encoder to obtain multiple network traffic context semantic feature vectors; S1212, cascading the multiple network traffic context semantic feature vectors to obtain the network traffic semantic feature vector.

[0032] In step S1211, the network traffic data is segmented and then passed through a network traffic semantic encoder to obtain multiple network traffic context semantic feature vectors. It should be understood that network traffic data is complex sequence information. It contains various elements such as various protocol headers and data content, which exist in the form of byte streams or character streams. In order to separate the meaningful units in the network traffic data and facilitate subsequent semantic understanding, the network traffic data needs to be segmented first. Through word segmentation, complex network traffic data can be decomposed into relatively simple units, so that in the subsequent processing process, these units can be operated more targeted. That is, when performing feature extraction later, the characteristics of each word can be considered separately, rather than processing the entire complex data packet, which is conducive to improving the efficiency of data processing. Next, the network traffic data after word segmentation needs to be input into the network traffic semantic encoder for semantic encoding processing. In this application, the network traffic semantic encoder is a converter-based semantic encoder including a word embedding layer. It should be explained that the word embedding layer can map discrete words to a continuous vector space, which helps to understand the semantic information in the network traffic. The transformer model can capture the dependencies between data at different positions in the word embedding vector sequence obtained through the word embedding layer mapping through its core self-attention mechanism, thereby more effectively capturing the contextual semantics in network traffic data. For example, in the process of analyzing network attacks, it can be associated with attack keywords that appear in succession over a period of time, such as the appearance of words related to "scanning ports" first, and then words related to "exploiting vulnerabilities", so that the entire process of network attacks can be better understood and more accurate semantic features can be extracted.

[0033] In step S1212, the multiple network traffic context semantic feature vectors are cascaded to obtain the network traffic semantic feature vector. It should be understood that each of the multiple network traffic context semantic feature vectors represents the semantic features of the network traffic data in a certain local context environment. In order to integrate these scattered local semantic information into a complete feature vector that can represent the semantics of the entire network traffic, the technical solution of the present application needs to cascade the multiple network traffic context semantic feature vectors to obtain the network traffic semantic feature vector. The network traffic semantic feature vector obtained after cascading contains richer semantic information, and based on this vector, it can be more effectively inferred that the network is facing a security threat.

[0034] In step S122, semantic analysis is performed on the honeypot log to obtain a semantic feature vector associated with the honeypot log. Specifically, Figure 5 FIG. 1 is a flowchart of step S122 in the network security situation prediction method according to an embodiment of the present application. Figure 5 As shown, the step S122 includes: S1221, preprocessing the honeypot log to obtain a preprocessed honeypot log; S1222, segmenting the preprocessed honeypot log and passing it through a log semantic encoder to obtain a plurality of honeypot log context semantic feature vectors; S1223, arranging the plurality of honeypot log context semantic feature vectors in two dimensions to obtain a honeypot log context semantic feature matrix; S1224, passing the honeypot log context semantic feature matrix through a honeypot log associated semantic feature capturer to obtain the honeypot log associated semantic feature vector.

[0035] In step S1221, the honeypot log is preprocessed to obtain a preprocessed honeypot log. Accordingly, considering that the honeypot log is usually raw, unprocessed record data, it may contain various complex formats, noise information and non-standard content, which will affect the subsequent semantic analysis and feature extraction process. Therefore, the honeypot log needs to be preprocessed in the technical solution of the present application. In detail, the honeypot system may generate logs in various formats due to different configurations and simulation environments. For example, some honeypot logs may be in text format, containing information such as timestamps, IP addresses, event types, etc., but the arrangement and separators of this information may be different; some honeypots may generate logs with a low degree of structure, such as containing a large amount of text description information, which is interspersed with code snippets, error messages, etc. This diversity of formats makes it difficult to perform semantic analysis directly. In addition, the honeypot log will contain some information that is not related to security analysis, and this noise information will interfere with the extraction of truly valuable attack information. For example, some maintenance records of the honeypot system itself, normal system messages (such as service start and stop records), etc. may be mixed with attack-related logs. In addition, some attackers may deliberately send a large amount of irrelevant information to confuse the view and increase the difficulty of analysis. By preprocessing the honeypot log to obtain the preprocessed honeypot log, the honeypot logs in different formats can be converted into a standard format suitable for subsequent analysis, and the information irrelevant to the security analysis in the original honeypot log can be removed, so that the log content is mainly focused on the records related to the attack behavior. In this way, semantic analysis and feature extraction can be more convenient, and it is helpful to improve the accuracy of subsequent semantic analysis and reduce misjudgments caused by poor data quality.

[0036] In step S1222, the preprocessed honeypot log is segmented and then passed through a log semantic encoder to obtain multiple honeypot log context semantic feature vectors. It should be understood that although the preprocessed honeypot log has been sorted to a certain extent, it is still continuous text information. In order to disassemble the continuous text information so as to understand the semantics of the honeypot log more carefully, it is first necessary to segment the preprocessed honeypot log. Considering that only segmenting the honeypot log is not enough to fully understand the security-related semantics contained therein. In order to deeply explore the deep semantic information of the honeypot log data after segmentation, it is necessary to use a log semantic encoder to perform semantic encoding processing on the honeypot log data after segmentation. In this application, the log semantic encoder is a converter-based semantic encoder including a word embedding layer. Specifically, the word embedding layer can map the honeypot log vocabulary after segmentation to a low-dimensional vector space, and the converter-based semantic encoder can effectively capture the long sequence semantic dependency between the embedded vectors after mapping, and thus can well characterize the complex semantic information such as attack patterns and attacker behaviors in the honeypot log.

[0037] In step S1223, the multiple honeypot log context semantic feature vectors are arranged in two dimensions to obtain a honeypot log context semantic feature matrix. It should be understood that the multiple honeypot log context semantic feature vectors are extracted from different parts or different records of the honeypot log, and each vector carries specific local semantic feature information. In order to integrate these scattered, multi-dimensional semantic features into a unified structure to better grasp the overall semantic information of the honeypot log, it is necessary to arrange the multiple honeypot log context semantic feature vectors in two dimensions to obtain a honeypot log context semantic feature matrix in the technical solution of the present application. Compared with a single vector, the honeypot log context semantic feature matrix can express the semantic features of the honeypot log more richly and comprehensively. It not only contains the local semantic information carried by each vector itself, but also reflects the mutual relationship and combination of these information through the two-dimensional arrangement structure, which improves the overall description ability of the honeypot log semantics.

[0038] In step S1224, the honeypot log context semantic feature matrix is ​​passed through a honeypot log associated semantic feature capturer to obtain the honeypot log associated semantic feature vector. It should be understood that although the honeypot log context semantic feature matrix has integrated semantic features of multiple dimensions, the potential associations and deep semantic information between these features have not been fully explored. For example, each element in the matrix may represent the semantic features of attack behaviors, different attack sources or different attack types at different times, but the behavior pattern of the attacker is often complex, and there may be associations across time and attack methods, such as the association pattern of first performing a port scan and then performing an SQL injection attack. In order to mine these deep-level associated semantic features hidden in the matrix, so as to more accurately judge the network security situation, in the technical solution of the present application, it is necessary to pass the honeypot log context semantic feature matrix through a honeypot log associated semantic feature capturer to obtain the honeypot log associated semantic feature vector. In the present application, the honeypot log associated semantic feature capturer is a convolutional neural network model including a bidirectional attention mechanism. The bidirectional attention mechanism is a mechanism that can simultaneously consider the two-directional information of the input sequence (in this case, the row or column direction of the honeypot log context semantic feature matrix). It can calculate attention weights from both the forward and reverse directions, so that the model can focus on the information before and after the current element when processing information, thereby more comprehensively capturing the relationship between semantic features. Through the bidirectional attention mechanism, the correlation between different elements (i.e., different semantic features) in the honeypot log context semantic feature matrix can be extracted, which helps the final extracted vector to more effectively reflect the network security status.

[0039] In step S130, the network traffic semantic feature vector and the honeypot log associated semantic feature vector are compensated for feature deviations based on the fit of the target domain requirements to obtain a network security monitoring feature vector. It should be understood that the network traffic semantic feature vector and the honeypot log associated semantic feature vector reflect the network security status from different angles. Network traffic data can provide information on normal network operation and abnormal activities, such as communication mode, data transmission, etc.; the honeypot log associated semantic feature vector focuses on the attacker's behavior information, including attack type, attack source, etc. These two sources of information complement each other. In order to have a more comprehensive understanding of the network security situation, it is necessary to fuse the network traffic semantic feature vector and the honeypot log associated semantic feature vector in this application to obtain a network security monitoring feature vector. Through fusion, the network behavior reflected in the network traffic can be associated with the attack behavior recorded in the honeypot log, which is conducive to more accurately judging whether there are security risks in the network.

[0040] In particular, considering that network traffic data and honeypot logs come from different systems, they record different information and focus. Network traffic data mainly focuses on data transmission in the network, including the size of the data packet, transmission time, source and destination addresses, etc., while honeypot logs focus on attack behaviors and abnormal activities against the honeypot system. Because they record different types of data, the extracted feature vectors will be distributed in different feature spaces. If the traditional feature fusion method of splicing or weighted fusion is directly applied to feature vectors from different feature spaces, the complex interactions and dependencies between network traffic and honeypot logs will not be captured, thereby ignoring the semantic association between them. If the complex semantic association between network traffic and honeypot logs is ignored, the accuracy of network security monitoring results may be reduced. Because network attacks often involve the synergy of traffic anomalies and attack behaviors, only by fully understanding the association between these two features can security threats be more accurately identified and warned. Therefore, in the technical solution of the present application, it is necessary to compensate for the feature deviation of the network traffic semantic feature vector and the honeypot log associated semantic feature vector based on the target domain requirements to obtain a network security monitoring feature vector.

[0041] Specifically, in an embodiment of the present application, the network traffic semantic feature vector and the honeypot log associated semantic feature vector are subjected to feature deviation compensation based on target domain demand alignment to obtain a network security monitoring feature vector, including: mapping the network traffic semantic feature vector and the honeypot log associated semantic feature vector to an intrinsic decomposition space to obtain a network traffic semantic intrinsic feature vector and a honeypot log associated semantic intrinsic feature vector; performing target domain driven feature amplitude tuning on the network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector to obtain a network traffic semantic modulated intrinsic feature vector and a honeypot log associated semantic modulated intrinsic feature vector; constructing a network security monitoring fine-grained interactive semantic matrix between the network traffic semantic modulated intrinsic feature vector and the honeypot log associated semantic modulated intrinsic feature vector; and fusing the network traffic semantic modulated intrinsic feature vector and the honeypot log associated semantic modulated intrinsic feature vector based on the network security monitoring fine-grained interactive semantic matrix to obtain the network security monitoring feature vector.

[0042] More specifically, in an embodiment of the present application, a fine-grained interaction semantic matrix for network security monitoring between the network traffic semantically modulated intrinsic feature vector and the honeypot log associated semantically modulated intrinsic feature vector is constructed, including: multiplying the transposed vectors of the network traffic semantically modulated intrinsic feature vector and the honeypot log associated semantically modulated intrinsic feature vector and then dividing the result by the scale of the honeypot log associated semantically modulated intrinsic feature vector to obtain a fine-grained interaction matrix for network security monitoring; performing a convolution coding operation based on a convolution kernel of 3×3 on the network security monitoring fine-grained interaction matrix to obtain the network security monitoring fine-grained interaction semantic matrix.

[0043] More specifically, in an embodiment of the present application, the network traffic semantics modulated intrinsic feature vector and the honeypot log associated semantics modulated intrinsic feature vector are fused based on the network security monitoring fine-grained interactive semantic matrix to obtain a network security monitoring feature vector, including: multiplying the network security monitoring fine-grained interactive semantic matrix by the network traffic semantics modulated intrinsic feature vector to obtain the network traffic semantic feature vector after information field mapping; multiplying the network security monitoring fine-grained interactive semantic matrix by the honeypot log associated semantics modulated intrinsic feature vector to obtain the honeypot log associated semantic feature vector after information field mapping; and weightedly fusing the network traffic semantic feature vector after information field mapping and the honeypot log associated semantic feature vector after information field mapping to obtain the network security monitoring feature vector.

[0044] In the embodiment of the present application, specifically, the network traffic semantic feature vector and the honeypot log associated semantic feature vector are subjected to feature deviation compensation based on the target domain demand fit to obtain a network security monitoring feature vector, including: processing the network traffic semantic feature vector and the honeypot log associated semantic feature vector according to the following formula to obtain the network security monitoring feature vector; wherein the formula is:

[0045]

[0046] v c =av kt +βv st

[0047] Among them, V1 represents the semantic feature vector of network traffic, V2 represents the semantic feature vector associated with honeypot logs, PCA(·) represents principal component analysis, U1 represents the sequence of network traffic semantic eigendecomposition vectors, Λ1 represents the network traffic semantic diagonal matrix, λ 11 and λ 1m denote the eigenvalues ​​of the first and mth positions of the network traffic semantic diagonal matrix, respectively. T denotes the transpose of the vector. concat{·;·} denotes vector concatenation. v 11 、v 12 、v 1m They represent the first, second and mth eigenvectors of the sequence of network traffic semantic eigendecomposition vectors, V k represents the semantic intrinsic feature vector of network traffic, U2 represents the sequence of semantic intrinsic decomposition vectors associated with honeypot logs, Λ2 represents the semantic diagonal matrix of network traffic, and λ 21 and λ 2m They represent the eigenvalues ​​of the first and mth positions of the honeypot log association semantic diagonal matrix, respectively, and v 21 、v 22 、v 2m They represent the first, second and mth eigenvectors of the sequence of honeypot log associated semantic eigendecomposition vectors, V s represents the semantic intrinsic feature vector associated with the honeypot log, v i represents the ith eigenvalue of the semantic eigenvector of network traffic, v j represents the jth eigenvalue of the honeypot log associated semantic eigenvector, represents the square of the vector norm, exp represents the natural exponential function, V' k Represents the intrinsic feature vector of network traffic after semantic modulation, V' s represents the intrinsic feature vector after the honeypot log association semantic modulation, represents matrix multiplication, S represents the scale of the vector, M xrepresents the fine-grained interaction matrix for network security monitoring, Conv 3×3 (M x ) indicates that M x Perform convolutional coding based on a 3×3 convolution kernel, Ω represents the fine-grained interaction semantic matrix for network security monitoring, and v kt represents the semantic feature vector of network traffic after information field mapping, v st represents the semantic feature vector associated with honeypot logs after information field mapping, α and β represent weighted hyperparameters, and v c Represents the network security monitoring feature vector.

[0048] That is, in the technical solution of the present application, in the technical solution of the present application, the network traffic semantic feature vector and the honeypot log associated semantic feature vector are compensated for feature deviations based on the fit with the target domain requirements. The process first maps the network traffic semantic feature vector and the honeypot log associated semantic feature vector to the intrinsic decomposition space to obtain the network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector. A person of ordinary skill in the art should know that the process of mapping to the intrinsic decomposition space is a combination of dimensionality reduction and feature extraction. In a specific example, the eigenvalue decomposition technique of principal component analysis (PCA) is used to find the intrinsic decomposition space, and the intrinsic decomposition space mapping is performed. The mapped network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector not only represent the projection of the original feature vector in the new coordinate system, but also reflect the main direction of change of the data, which helps to avoid the "dimensionality disaster", that is, the problem that the sample density drops sharply as the number of features increases.

[0049] Next, after mapping the feature vector to the intrinsic decomposition space, it is necessary to perform target domain driven feature amplitude tuning on the network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector to adjust the source domain feature vector to better match the data distribution of the target domain. This operation aims to capture and compensate for the systematic deviation between the two domains to reduce the hidden disturbance of the class expression of the local feature distribution of the network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector to the overall class expression. After modulation, the network traffic semantic modulated intrinsic feature vector and the honeypot log associated semantic modulated intrinsic feature vector can retain the source domain characteristics while being more in line with the actual needs of the target domain, enhancing the model's understanding and application of target domain data.

[0050] After completing the scale modulation of the feature vector, a fine-grained interactive semantic matrix of network security monitoring is constructed between the intrinsic feature vector after the network traffic semantic modulation and the intrinsic feature vector after the honeypot log associated semantic modulation. The fine-grained interactive semantic matrix of network security monitoring is used to describe a more detailed relationship between feature vectors. The introduction of the fine-grained interactive semantic matrix of network security monitoring enables the model to go beyond simple point-to-point comparison and consider more complex patterns and contextual information, thereby enhancing the model's sensitivity to subtle differences and improving the quality of feature representation. Finally, the network traffic semantically modulated intrinsic feature vector and the honeypot log associated semantic modulated intrinsic feature vector are fused based on the fine-grained interactive semantic matrix of network security monitoring to obtain a network security monitoring feature vector.

[0051] In step S140, based on the network security monitoring feature vector, a network security monitoring result is obtained. Specifically, in the embodiment of the present application, the step S140 includes: passing the network security monitoring feature vector through a network security status classifier to obtain the network security monitoring result, and the network security monitoring result is used to indicate whether there are security risks in the network. It should be understood that although the network security monitoring feature vector integrates multiple information such as network traffic semantic features and honeypot log associated semantic features, it is still only a comprehensive representation of data features, and it cannot directly indicate whether there are security risks in the network. In order to achieve the conversion from feature data to clear security conclusions, in the technical solution of the present application, it is necessary to pass the network security monitoring feature vector through a network security status classifier for classification processing. The network security status classifier is a model built based on a machine learning algorithm, and its main function is to classify the input network security related feature data (i.e., the network security monitoring feature vector in this method) and determine whether the network is safe or unsafe (there are security risks). The network security monitoring result obtained by the network security status classifier directly indicates whether there are security risks in the network, and network security managers can quickly know the security status of the current network based on this. For example, if the monitoring results show that there are security risks, it means that the network may be under attack or there are potential security vulnerabilities. Relevant personnel can immediately activate the corresponding emergency response mechanism and take measures such as blocking suspicious connections and repairing vulnerabilities to avoid further deterioration of security issues and minimize losses.

[0052] In summary, the network security situation prediction method based on the embodiment of the present application is explained, which performs semantic analysis on the network traffic data obtained by the traffic mirroring system and the honeypot log obtained by the honeypot system to obtain the network traffic semantic features and the honeypot log associated semantic features, and combines these two features to realize the judgment of the network security risk hidden dangers. In this way, the security risks hidden behind the complex network behavior can be captured more accurately, which is conducive to improving the network security monitoring capabilities.

[0053] Figure 6 : is a system block diagram of a network security situation prediction system according to an embodiment of the present application. Figure 6 As shown, according to the network security situation prediction system 100 of the embodiment of the present application, it includes: a network security related data acquisition module 110, which is used to obtain network traffic data and honeypot logs from the traffic mirror system and the honeypot system respectively; a network security related data processing module 120, which is used to process the network traffic data and the honeypot log to obtain a network traffic semantic feature vector and a honeypot log associated semantic feature vector; a network security related feature fusion module 130, which is used to compensate for the feature deviation of the network traffic semantic feature vector and the honeypot log associated semantic feature vector based on the target domain demand fit to obtain a network security monitoring feature vector; a network security monitoring result generation module 140, which is used to obtain a network security monitoring result based on the network security monitoring feature vector.

[0054] Here, those skilled in the art will appreciate that the specific functions and operations of the various units and modules in the network security situation prediction system 100 have been described in detail above. Figures 1 to 5 The network security situation prediction method has been introduced in detail in the description of the network security situation prediction method, and therefore, its repeated description will be omitted.

[0055] In summary, the network security situation prediction system 100 based on the embodiment of the present application is explained, which performs semantic analysis on the network traffic data obtained by the traffic mirroring system and the honeypot log obtained by the honeypot system to obtain the network traffic semantic features and the honeypot log associated semantic features, and combines these two features to realize the judgment of the network security risk hidden dangers. In this way, the security risks hidden behind the complex network behavior can be captured more accurately, which is conducive to improving the network security monitoring capabilities.

Claims

1. A network security situation prediction method, characterized in that: include: Obtain network traffic data and honeypot logs from the traffic mirror system and honeypot system respectively; Performing data processing on the network traffic data and the honeypot log to obtain a network traffic semantic feature vector and a honeypot log associated semantic feature vector; Performing feature deviation compensation based on the target domain requirement fit on the network traffic semantic feature vector and the honeypot log associated semantic feature vector to obtain a network security monitoring feature vector; Based on the network security monitoring feature vector, a network security monitoring result is obtained.

2. The network security situation prediction method according to claim 1, characterized in that: Processing the network traffic data and the honeypot log to obtain a network traffic semantic feature vector and a honeypot log associated semantic feature vector includes: Performing semantic analysis on the network traffic data to obtain the network traffic semantic feature vector; The honeypot log is semantically analyzed to obtain a semantic feature vector associated with the honeypot log.

3. The network security situation prediction method according to claim 2, characterized in that: Performing semantic analysis on the network traffic data to obtain the network traffic semantic feature vector includes: After the network traffic data is segmented, it is passed through a network traffic semantic encoder to obtain a plurality of network traffic context semantic feature vectors; The multiple network traffic context semantic feature vectors are cascaded to obtain the network traffic semantic feature vector.

4. The network security situation prediction method according to claim 3 is characterized in that: Performing semantic analysis on the honeypot log to obtain a semantic feature vector associated with the honeypot log includes: Preprocessing the honeypot log to obtain a preprocessed honeypot log; The preprocessed honeypot log is segmented and passed through a log semantic encoder to obtain a plurality of honeypot log context semantic feature vectors; Arranging the plurality of honeypot log context semantic feature vectors in two dimensions to obtain a honeypot log context semantic feature matrix; The honeypot log context semantic feature matrix is ​​passed through a honeypot log associated semantic feature capturer to obtain the honeypot log associated semantic feature vector.

5. The network security situation prediction method according to claim 4, characterized in that: The network traffic semantic encoder and the log semantic encoder are converter-based semantic encoders including a word embedding layer, and the honeypot log-associated semantic feature capturer is a convolutional neural network model including a bidirectional attention mechanism.

6. The network security situation prediction method according to claim 5, characterized in that: The network traffic semantic feature vector and the honeypot log associated semantic feature vector are compensated for feature deviations based on the target domain requirements to obtain a network security monitoring feature vector, including: Mapping the network traffic semantic feature vector and the honeypot log associated semantic feature vector to an intrinsic decomposition space to obtain a network traffic semantic intrinsic feature vector and a honeypot log associated semantic intrinsic feature vector; Performing target domain driven feature amplitude tuning on the network traffic semantic intrinsic feature vector and the honeypot log associated semantic intrinsic feature vector to obtain a network traffic semantic modulated intrinsic feature vector and a honeypot log associated semantic modulated intrinsic feature vector; Constructing a fine-grained interactive semantic matrix for network security monitoring between the intrinsic feature vector after semantic modulation of the network traffic and the intrinsic feature vector after semantic modulation of the honeypot log association; The network security monitoring feature vector is obtained by fusing the network traffic semantically modulated intrinsic feature vector and the honeypot log associated semantically modulated intrinsic feature vector based on the network security monitoring fine-grained interactive semantic matrix.

7. The network security situation prediction method according to claim 6, characterized in that: Constructing a fine-grained interactive semantic matrix of network security monitoring between the intrinsic feature vector after the network traffic semantic modulation and the intrinsic feature vector after the honeypot log association semantic modulation, including: The network traffic semantically modulated intrinsic feature vector and the honeypot log associated semantically modulated intrinsic feature vector are multiplied and then divided by the scale of the honeypot log associated semantically modulated intrinsic feature vector to obtain a network security monitoring fine-grained interaction matrix; A convolution encoding operation based on a convolution kernel of 3×3 is performed on the network security monitoring fine-grained interaction matrix to obtain the network security monitoring fine-grained interaction semantic matrix.

8. The network security situation prediction method according to claim 7, characterized in that: Based on the network security monitoring fine-grained interactive semantic matrix, the intrinsic feature vector after the network traffic semantics modulation and the intrinsic feature vector after the honeypot log association semantics modulation are fused to obtain a network security monitoring feature vector, including: Multiplying the fine-grained interactive semantic matrix of network security monitoring by the intrinsic feature vector after the network traffic semantic modulation to obtain the network traffic semantic feature vector after information field mapping; Multiplying the fine-grained interactive semantic matrix of network security monitoring by the intrinsic feature vector after the honeypot log associated semantics modulation to obtain the honeypot log associated semantic feature vector after information field mapping; The network traffic semantic feature vector after the information field mapping and the honeypot log association semantic feature vector after the information field mapping are weightedly fused to obtain the network security monitoring feature vector.

9. The network security situation prediction method according to claim 8, characterized in that: Based on the network security monitoring feature vector, a network security monitoring result is obtained, including: passing the network security monitoring feature vector through a network security status classifier to obtain the network security monitoring result, and the network security monitoring result is used to indicate whether there is a security risk hidden danger in the network.

10. A network security situation prediction system, characterized in that: include: A network security related data collection module, used to obtain network traffic data and honeypot logs from the traffic mirror system and the honeypot system respectively; A network security related data processing module, used for performing data processing on the network flow data and the honeypot log to obtain a network flow semantic feature vector and a honeypot log associated semantic feature vector; A network security related feature fusion module is used to compensate for feature deviations of the network traffic semantic feature vector and the honeypot log associated semantic feature vector based on the target domain requirements to obtain a network security monitoring feature vector; The network security monitoring result generating module is used to obtain the network security monitoring result based on the network security monitoring feature vector.

Images