Network threat adaptive fuzzy detection method and system and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a network threat adaptive fuzzy detection method and system and electronic equipment, and the method comprises the steps: collecting a structured weblog of an enterprise internal network; processing non-numerical type data in the structured weblog, and standardizing the data to obtain standardized weblog data; performing PCA principal component data dimension reduction on the standardized weblog data to obtain two input data sets, namely an input data set x and an input data set y; and inputting the two input data sets into the improved ANFIS model to obtain a network threat detection result of the enterprise internal network. According to the method provided by the invention, the structured weblog of the enterprise internal network is collected and processed, the data volume can be reduced after data standardization and PCA principal component data dimension reduction, and the data features of the structured weblog are also maintained. Moreover, an improved ANFIS model is adopted, and real-time threat detection is carried out in combination with an adaptive fuzzy rule, so that a detection result is obtained.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network threat adaptive fuzzy detection method, system and electronic equipment. Background Art

[0002] With the development of network technology, the types and complexity of network threats continue to increase, and many enterprises need to entrust network security operators to perform security operations and maintenance of their internal networks. Traditional internal network security threat detection requires uploading network data such as security logs to the operator's network security operation center, which helps the enterprise analyze network data to achieve network threat detection. This traditional method has the following disadvantages: First, the implementation of network threat detection requires relying on the internal network of the enterprise to transmit data to the network security operation center, consuming network traffic; second, network security operators usually provide network security threat detection services to multiple enterprises, and the operator's network security operation center will bear greater computing power and network bandwidth pressure.

[0003] In view of this, it is necessary to study a network threat adaptive fuzzy detection method, system and electronic equipment deployed in the enterprise internal network. Summary of the invention

[0004] In view of the problems in the prior art, the present invention provides a network threat adaptive fuzzy detection method, system and electronic device. The specific technical solution is as follows:

[0005] A network threat adaptive fuzzy detection method comprises the following steps:

[0006] Step S1, collecting structured network logs of the enterprise internal network;

[0007] Step S2, processing and standardizing the non-numeric data in the structured network log to obtain standardized network log data;

[0008] Step S3, performing PCA principal component data dimensionality reduction on the standardized network log data to obtain two input data sets, namely input data set x and input data set y;

[0009] Step S4, inputting the two input data sets into the improved ANFIS model to obtain the network threat detection results of the enterprise internal network.

[0010] Preferably, the improved ANFIS model comprises a fuzzification layer, a rule layer, an inference layer, a TSK output layer, an aggregation layer, and a defuzzification layer connected in sequence;

[0011] The fuzzification layer is used to calculate the membership degree of the input data set x and the input data set y;

[0012] The rule layer is used to set a number of fuzzy rules and calculate the applicability wi of each set fuzzy rule according to the membership of the input data set x and the input data set y calculated by the fuzzification layer, where wi represents the applicability of the i-th set fuzzy rule; the reasoning layer is used to normalize the applicability of each set fuzzy rule using the Sugeno model to obtain the normalized applicability of each set fuzzy rule The TSK output layer is used to calculate the normalized applicability of each set fuzzy rule. Calculate the output result Zi of each set fuzzy rule;

[0013] The aggregation layer is used to aggregate the output result Zi of each set fuzzy rule into a single fuzzy output value φ;

[0014] The defuzzification layer is used to convert a single fuzzy output value φ into a crisp value Z, which is used to evaluate the network threat detection results of the enterprise internal network.

[0015] Preferably, the fuzzification layer specifically sets two fuzzy sets, namely, fuzzy set A = (A1, A2) and fuzzy set B = (B1, B2); the input data set x belongs to fuzzy set A i Membership degree μA i (x) is calculated as follows:

[0016]

[0017] The input data set y belongs to the fuzzy set B i The membership degree μB i (y) is calculated as follows:

[0018]

[0019] Among them, c i represents the center of the Gaussian function; a i Represents the width of the Gaussian function; i=1,2.

[0020] Preferably, the following two rules are set in the rule layer:

[0021] Rule 1: If x is A1 and y is B1, then the applicability of Rule 1 is w1 = f1(x, y) = μA1(x)gμB1(y);

[0022] Rule 2: If x is A2 and y is B2, then the applicability of Rule 2 is w2 = f2(x, y) = μA2(x)gμB2(y).

[0023] Preferably, the normalized applicability of each fuzzy rule set in the reasoning layer is The calculation method is as follows:

[0024]

[0025] Preferably, the TSK output layer calculates the output result Zi of each set fuzzy rule as follows:

[0026]

[0027] Among them, f i (x,y) is the applicability function of the i-th fuzzy rule.

[0028] Preferably, the fuzzy output value φ used by the aggregation layer is calculated as follows:

[0029] φ=∑Zi.

[0030] Preferably, the calculation method of the clarity value Z of the deblurred layer is as follows:

[0031]

[0032] A network threat adaptive fuzzy detection system is deployed in an enterprise internal network and applied to the method described above, comprising:

[0033] Data collection module, used to collect structured network logs of the enterprise internal network;

[0034] A data processing module is used to process and standardize non-numeric data in structured network logs to obtain standardized network log data;

[0035] The data dimension reduction module is used to perform PCA principal component data dimension reduction on the standardized network log data to obtain two input data sets, namely input data set x and input data set y;

[0036] The detection module is used to input two input data sets into the improved ANFIS model to obtain the network threat detection results of the enterprise internal network.

[0037] An electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network threat adaptive fuzzy detection method.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The method provided by the present invention can reduce the amount of data by collecting structured network logs of the internal network of the enterprise and performing processing, data standardization, and PCA principal component data dimension reduction, while retaining the data characteristics of the structured network logs.

[0040] Moreover, the present invention adopts an improved ANFIS model and combines adaptive fuzzy rules to perform real-time threat detection and obtain detection results. The ANFIS model belongs to a fuzzy neural network and can process uncertain data. The adaptive performance of the fuzzy neural network maintains high performance in a complex and changeable network environment, provides high operating performance and real-time detection capabilities, and has high prediction accuracy.

[0041] The present invention is deployed in the internal network of an enterprise and can be applied to the preliminary screening of the internal network of the enterprise. The screening results are then submitted to the network security operation center for confirmation detection, forming a multi-level detection mechanism and reducing false positives and missed reports. The preliminary screening of the enterprise network can quickly filter most of the normal data, reduce the burden of subsequent processing, reduce the pressure of network threat detection on the traditional centralized network security operation center, avoid excessive transmission of internal enterprise network data, improve data privacy and security, and improve the overall efficiency of network threat detection. It also reduces the risk of consuming traffic when transmitting data from the internal network of the enterprise to the network security operation center, and also reduces the computing power requirements and network bandwidth pressure borne by the operator's network security operation center. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0043] Figure 1 The figure is a flow chart of the method of the present invention.

[0044] Figure 2 It is a structural schematic diagram of the improved ANFIS model of the present invention.

[0045] Figure 3 It is a system principle diagram of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0048] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0049] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0050] Embodiment 1:

[0051] like Figure 1 As shown, this embodiment provides a network threat adaptive fuzzy detection method, including the following steps:

[0052] Step S1, collecting structured network logs of the enterprise internal network. The structured network logs include data on dimensions such as source IP address, source port number, destination IP address, destination port number, protocol type, flow duration, total number of packets from source to destination, number of packets from destination to source, total length of total packets from source to destination, total length of total packets from destination to source, maximum length of a single packet from source to destination, and minimum idle value.

[0053] Step S2, processing and standardizing the non-numeric data in the structured network log to obtain standardized network log data.

[0054] Among them, the processing of non-numeric data in structured network logs specifically includes digitizing non-numeric data. The specific method is: classify non-numeric data by the same name, and assign a unique integer to each category. For example, the source IP address data "172.16.0.1" is assigned the number "1495", and "192.168.10.5" is assigned the number "2145". In the engineering environment using Python, the LabelEncoder() function can be referenced from the preprocessing module of the Scikit-Learn library to realize the digitization of non-numeric data.

[0055] The method for data standardization of the processed network log data is: convert the data into standard normal distribution data. In the engineering environment using Python, the StandardScaler() function can be referenced from the preprocessing module of the Scikit-Learn library to achieve data standardization.

[0056] Step S3, PCA principal component data dimensionality reduction is performed on the standardized network log data to obtain a data table containing two columns of data, and the two columns of data are extracted as data sets x and y input to the improved ANFIS model. In an engineering environment using Python, the PCA() function can be referenced from the decomposition module of the Scikit-Learn library to reduce the dimension of the standardized network log data into a data table with only two columns, and the two columns of data are extracted as input data sets x and input data sets y of the improved ANFIS model.

[0057] Step S4, input the two input data sets into the improved ANFIS model to obtain a clarity value Z, which is used to evaluate the network threat detection results of the enterprise's internal network. When the clarity value Z is less than 0.5, it means that the enterprise's internal network is normal. When the clarity value Z is greater than or equal to 0.5, it means that there is a threat in the enterprise's internal network.

[0058] Among them, ANFIS (Adaptive-Network-based Fuzzy Inference Systems) is referred to as adaptive fuzzy neural network. ANFIS is a neural network based on fuzzy reasoning. This model combines the characteristics of fuzzy logic and neural networks and is used to deal with complex nonlinear problems, especially in the fields of security threat detection.

[0059] The improved ANFIS based on the grid adds a sixth defuzzification layer to the original ANFIS model, converting the fuzzy set into an accurate value, which can control the false alarm rate while maintaining a high detection rate, which is particularly important for security threat detection.

[0060] like Figure 2 As shown in the figure, the network is divided into 6 layers. The improved ANFIS model includes the fuzzification layer, rule layer, reasoning layer, TSK output layer, aggregation layer, and defuzzification layer connected in sequence. In the figure, the box node indicates that the node parameter is adjustable, and the circular node indicates that the node has no parameters or the parameters cannot be adjusted. The adjustable parameters in the improved ANFIS are mainly concentrated in the 1st and 4th layers. The parameters of the first layer are the membership function parameters, and the 4th layer is the rule parameters, that is, p, q, and r in the rule function.

[0061] The fuzzification layer is used to calculate the membership of the input data set x and the input data set y. The fuzzification layer is a key component in the model architecture, which is responsible for converting the precise input values ​​into fuzzy values ​​for fuzzy reasoning. In the fuzzification layer, each input variable (such as x and y) is assigned one or more membership functions. These membership functions usually take shapes such as Gaussian functions, triangular functions, or trapezoidal functions, which define the degree to which the input value belongs to a fuzzy set. For example, for the input variable x (or y), if there is a fuzzy set A, then the membership function will calculate the degree to which x (or y) belongs to A. The output of the fuzzification layer is a set of membership values, each of which corresponds to a fuzzy set. This model uses the Gaussian function as the membership function, and the calculation formula is:

[0062] The first layer: fuzzification layer. The fuzzification layer specifically sets two fuzzy sets, and each fuzzy set sets two subsets, specifically fuzzy set A = (A1, A2), fuzzy set B = (B1, B2); the input data set x belongs to fuzzy set A i Membership degree μA i (x) is calculated as follows:

[0063]

[0064] The input data set y belongs to the fuzzy set B i The membership degree μB i (y) is calculated as follows:

[0065]

[0066] Among them, c i represents the center of the Gaussian function; a i Represents the width of the Gaussian function; i=1,2.

[0067] The second layer: rule layer. The rule layer is used to set a number of fuzzy rules and calculate the applicability wi of each set fuzzy rule based on the membership of the input data set x and the input data set y calculated by the fuzzification layer, where wi represents the applicability of the i-th set fuzzy rule.

[0068] The output of each node is the product of the input signals, and the output result of this layer is the applicability of this rule. The rule layer contains a set of fuzzy logic rules, which are defined based on the fuzzy sets of input variables. The rule layer performs the fuzzy reasoning process, that is, combining the fuzzy sets of input variables according to fuzzy logic operations (such as "and", "or", etc.) and generates the activation degree of each rule. In the rule layer, the output of each rule is calculated based on the membership value of the input variables.

[0069] Multiple fuzzy rules can be set, but the more fuzzy rules there are, the slower the improved ANFIS model runs. In this embodiment, the number of fuzzy rules set is 2. The following two rules are set in the rule layer:

[0070] Rule 1: If x is A1 and y is B1, then Z1 is equal to p1 times x plus q1 times y plus r1, and the output variable Z1 is a data set representing the network threat detection results based on rule function 1. Here, A1 and B1 are fuzzy sets corresponding to x and y respectively, and p1, q1, and r1 are constant coefficients. The mathematical formula can be expressed as:

[0071] If x=A1∩y=B1, then Z1=p1·x+q1·y+r1.

[0072] Rule 2: If x is A2 and y is B2, then Z2 equals p2 times x plus q2 times y plus r2, and Z2 is the output of Rule 2. A2 and B2 are the fuzzy sets corresponding to x and y, respectively. 2、 q2 and r2 are determined constant coefficients. The output variable Z2 is a data set representing the network threat detection results based on rule function 2. The mathematical formula can be expressed as:

[0073] If x=A2∩y=B2, then Z2=p2·x+q2·y+r2.

[0074] In this embodiment, the applicability of rule 1 is w1=f1(x, y)=μA1(x)gμB1(y); the applicability of rule 2 is w2=f2(x, y)=μA2(x)gμB2(y).

[0075] Among them, f1(x,y) is the applicability function of the first set fuzzy rule, and f2(x,y) is the applicability function of the second set fuzzy rule.

[0076] The third layer: the reasoning layer. The reasoning layer is used to normalize the applicability of each set fuzzy rule using the Sugeno model to obtain the normalized applicability of each set fuzzy rule. The normalized applicability of each fuzzy rule in the reasoning layer The calculation method is as follows:

[0077]

[0078] The fourth layer: TSK output layer. The TSK output layer is used to calculate the normalized applicability of each set fuzzy rule. Calculate the output result Zi of each set fuzzy rule.

[0079] The TSK output layer calculates the output result Zi of each set fuzzy rule as follows:

[0080]

[0081] ; Among them, f i (x,y) is the applicability function of the i-th fuzzy rule.

[0082] The fifth layer: aggregation layer. The aggregation layer is used to aggregate the output results Zi of each set fuzzy rule into a single fuzzy output value φ. The calculation method of the fuzzy output value φ used in the aggregation layer is as follows:

[0083] φ=∑Zi.

[0084] The sixth layer: Defuzzification layer. The defuzzification layer is used to convert a single fuzzy output value φ into a clear value Z, which is used to evaluate the network threat detection results of the enterprise's internal network. When the clear value Z is less than 0.5, it means that the enterprise's internal network is normal. When the clear value Z is greater than or equal to 0.5, it means that there is a threat in the enterprise's internal network.

[0085] The calculation method of the sharpness value Z of the defuzzified layer is as follows:

[0086]

[0087] According to the above six-layer model architecture, the final output clarity value Z of the model based on input x and y is:

[0088]

[0089] The clarity value Z represents the result of network security threat detection, that is: according to the two data sets x and y output after PCA dimensionality reduction, based on the above-mentioned improved six-layer model architecture, after membership function calculation, rule function application, fuzzy reasoning, aggregation, and finally defuzzification using the centroid method, the calculation result Z data set is obtained. This data set contains the judgment results of each piece of information in the two input data sets x and y, that is, whether the information poses a threat to network security.

[0090] By utilizing the sample data set of network security threat detection and using the algorithm of the above model, the detection results can be quickly obtained with high accuracy. The fuzzy rules established based on the data do not require the basis of expert knowledge, are universal, and can be continuously adjusted to achieve adaptivity.

[0091] This embodiment uses the following examples to verify the effectiveness of the present invention, which are as follows:

[0092] (I) Test hardware environment

[0093] Computer model: ThinkPad X260;

[0094] Processor: Intel(R) Core(TM) i5-6300U CPU@2.40GHz 2.50GHZ 16.0 GB (15.9 GB available); Installed Memory (RAM): 16 GB.

[0095] 2. Experimental Dataset

[0096] This detection method and system use the CIC-IDS2017 dataset Tuesday-WorkingHours.pcap_ISCX.csv for experimental testing. The data format of some fields is shown in Table 1 below.

[0097] Table 1 Structured web log data

[0098]

[0099] Note: The "Sample Result" column refers to the actual result of historical sampling data, BENIGN means "normal", and non-BENIGN means "threat". The LabelEncoding non-numeric type numbering process of the above structured data is shown in Table 2.

[0100] Table 2 Non-numeric type number processing data

[0101]

[0102] The data in Table 2 are normalized as shown in Table 3.

[0103] Table 3 Data standardization data

[0104]

[0105] The results of dimensionality reduction and sample detection on the standardized data are shown in Table 4.

[0106] Table 4 Sample test results

[0107]

[0108]

[0109] This embodiment uses the total number of records in the CIC-IDS2017 data set: 445909, of which the test set: 88982, and the correct samples detected are 82380, and the overall accuracy = 82380 / 88982 = 0.925805219033063. Among them, the proportion of the true result 0 (normal) judged as 1 (threat): 3895 / 88982 = 0.043772897889461. The proportion of the true result 1 (threat) judged as 0: 2707 / 88982 = 0.030421883077476. The test set has 88982 records, and the running time is about 20 seconds. The average processing time for each data is 0.000224764559124 seconds / item (0.225 milliseconds / item).

[0110] It can be seen from the above experimental data that the present invention has a higher accuracy rate and a shorter running time.

[0111] Embodiment 2:

[0112] like Figure 3 As shown, based on the same inventive concept as that of Example 1, this embodiment provides a network threat adaptive fuzzy detection system, which is deployed in an enterprise internal network and applied to the method described, including:

[0113] Data collection module, used to collect structured network logs of the enterprise internal network;

[0114] A data processing module is used to process and standardize non-numeric data in structured network logs to obtain standardized network log data;

[0115] The data dimension reduction module is used to perform PCA principal component data dimension reduction on the standardized network log data to obtain two input data sets, namely input data set x and input data set y;

[0116] The detection module is used to input two input data sets into the improved ANFIS model to obtain the network threat detection results of the enterprise internal network.

[0117] The invention has low hardware requirements and does not rely on GPU or NPU, and can achieve excellent performance in an ordinary PC environment. The system can implement model iteration through data update and continuously optimize the detection effect.

[0118] Embodiment 3:

[0119] Based on the same inventive concept as Example 1, this embodiment provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network threat adaptive fuzzy detection method.

[0120] Those of ordinary skill in the art will appreciate that the modules of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition of each example has been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0121] In the embodiments provided by the present invention, it should be understood that the division of modules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple modules can be combined into one module, one module can be split into multiple modules, or some features can be ignored, etc.

[0122] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of software functional modules.

[0123] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-0nlyMemory), random access memory (RAM, RandomAccessMemory), mobile hard disk, magnetic disk or optical disk, etc., various media that can store program codes.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A network threat adaptive fuzzy detection method, characterized in that: The following steps are involved: Step S1, collecting structured network logs of the enterprise internal network; Step S2, processing and standardizing the non-numeric data in the structured network log to obtain standardized network log data; Step S3, performing PCA principal component data dimensionality reduction on the standardized network log data to obtain two input data sets, namely input data set x and input data set y; Step S4, inputting the two input data sets into the improved ANFIS model to obtain the network threat detection result of the enterprise internal network.

2. A network threat adaptive fuzzy detection method according to claim 1, characterized in that: The improved ANFIS model includes a fuzzification layer, a rule layer, an inference layer, a TSK output layer, an aggregation layer, and a defuzzification layer which are connected in sequence; the fuzzification layer is used to calculate the membership degree of the input data set x and the input data set y; The rule layer is used to set a number of fuzzy rules and calculate the applicability wi of each set fuzzy rule according to the membership of the input data set x and the input data set y calculated by the fuzzification layer, where wi represents the applicability of the i-th set fuzzy rule; the reasoning layer is used to normalize the applicability of each set fuzzy rule using the Sugeno model to obtain the normalized applicability of each set fuzzy rule The TSK output layer is used to calculate the normalized applicability of each set fuzzy rule. Calculate the output result zi of each set fuzzy rule; The aggregation layer is used to aggregate the output result zi of each set fuzzy rule into a single fuzzy output value φ; The defuzzification layer is used to convert a single fuzzy output value φ into a crisp value Z, which is used to evaluate the network threat detection results of the enterprise internal network.

3. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The fuzzification layer specifically sets two fuzzy sets, namely fuzzy set A = (A1, A2) and fuzzy set B = (B1, B2); the input data set x belongs to fuzzy set A i Membership degree μA i (x) is calculated as follows: The input data set y belongs to the fuzzy set B i The membership degree μB i (y) is calculated as follows: Among them, c i represents the center of the Gaussian function; a i Represents the width of the Gaussian function; i=1,2.

4. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The following two rules are set in the rule layer: Rule 1: If x is A1 and y is B1, then the applicability of Rule 1 is w1 = f1(x, y) = μA1(x)gμB1(y); Rule 2: If x is A2 and y is B2, then the applicability of Rule 2 is w2 = f2(x, y) = μA2(x)gμB2(y).

5. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The normalized applicability of each fuzzy rule in the reasoning layer The calculation method is as follows:

6. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The TSK output layer calculates the output result zi of each set fuzzy rule as follows: Among them, f i (x,y) is the applicability function of the i-th fuzzy rule.

7. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The fuzzy output value φ used by the aggregation layer is calculated as follows: φ=Σzi.

8. A network threat adaptive fuzzy detection method according to claim 2, characterized in that: The calculation method of the sharpness value Z of the deblurred layer is as follows:

9. A network threat adaptive fuzzy detection system, characterized in that: Deployed in an internal network of an enterprise, and applied to the method described in any one of claims 1 to 8, comprising: Data collection module, used to collect structured network logs of the enterprise internal network; A data processing module is used to process and standardize non-numeric data in structured network logs to obtain standardized network log data; The data dimension reduction module is used to perform PCA principal component data dimension reduction on the standardized network log data to obtain two input data sets, namely input data set x and input data set y; The detection module is used to input two input data sets into the improved ANFIS model to obtain the network threat detection results of the enterprise internal network.

10. An electronic device, characterized in that: It comprises a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the network threat adaptive fuzzy detection method according to any one of claims 1 to 8.

Images