Method and device for predicting network intrusion

Abstract

The invention relates to the technical field of network security, and discloses a network intrusion prediction method and device, and the method comprises the steps: obtaining a first feature matrix sequence of a to-be-detected network, the first feature matrix sequence comprising a first feature matrix of a plurality of time snapshots of the to-be-detected network in a target historical time period; according to the first feature matrix sequence, determining mapping information of spatial features of each to-be-tested node in the to-be-tested network in a target space; determining a target spatial feature of each to-be-detected node based on the query value, the key value and the mapping value of the spatial feature of each to-be-detected node; determining a second feature matrix sequence of the to-be-detected network based on the target spatial feature of each to-be-detected node; and determining a network intrusion prediction result of the to-be-detected network in the prediction time period based on the second feature matrix sequence. Therefore, the technical effect of predicting the possible network intrusion of the to-be-tested network is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for predicting network intrusion. Background Art

[0002] At present, in the cloud computing environment, user information and data may face the risk of being stolen. At present, the solutions for cloud computing network intrusion are mostly focused on detection technology. Such technology can detect the occurrence of network intrusion events, but it is limited to post-incident identification and cannot prevent them before the incident occurs. Even if the intrusion behavior can be detected in time, it often has already caused losses. Therefore, how to accurately predict network intrusion has become an urgent problem to be solved. Summary of the invention

[0003] In view of this, the present invention provides a network intrusion prediction method, device, and computer equipment to solve the problem of how to predict network intrusion.

[0004] In a first aspect, the present invention provides a method for predicting network intrusion, the method comprising:

[0005] Acquire a first feature matrix sequence of the network to be tested, the first feature matrix sequence comprising first feature matrices of multiple time snapshots of the network to be tested in a target historical time period, the first feature matrix comprising: feature representation of a data attribute dimension and feature representation of a time step dimension;

[0006] Determine mapping information of spatial features of each node to be tested in the network to be tested in the target space according to the first feature matrix sequence, wherein the mapping information includes a query value, a key value, and a mapping value of the spatial features, and the spatial features include a feature representation of a data attribute dimension and a feature representation of a time step dimension;

[0007] Determine the target spatial feature of each node to be tested based on the query value, key value and mapping value of the spatial feature of each node to be tested;

[0008] Based on the target space characteristics of each node to be tested, a second characteristic matrix sequence of the network to be tested is determined, where the second characteristic matrix is ​​a characteristic matrix of multiple time snapshots of the network to be tested in a prediction time period;

[0009] Based on the second characteristic matrix sequence, a network intrusion prediction result of the network to be tested in the prediction time period is determined.

[0010] The network intrusion prediction method provided by the present invention has the following advantages:

[0011] By obtaining the first feature matrix sequence of the network to be tested, combining the feature representation of the data attribute dimension and the feature representation of the time step dimension, the spatial features are mapped to the target space to obtain the mapping values ​​of the query value, key value, and spatial features, thereby effectively simulating the dynamic spatial dependency between nodes. According to the target spatial features of each node to be tested, the feature matrix of multiple time snapshots of the network to be tested in the prediction time period is determined, and the technical effect of predicting the network intrusion that the network to be tested may face based on the first feature matrix sequence is achieved. Since the dynamic spatial dependency between nodes is simulated when the target spatial features of each node to be tested are determined in the prediction process, the accuracy of the network intrusion prediction results determined based on the target spatial features of each node to be tested is improved in the space-time dimension.

[0012] In an optional implementation, the network to be tested includes: a plurality of nodes to be tested; the first feature matrix includes: a first feature representation of the attribute dimension of the node to be tested; the first feature representation of the attribute dimension of the node to be tested indicates the neighbor node feature of each node to be tested;

[0013] Based on the target space characteristics of each node to be tested, a second characteristic matrix sequence of the network to be tested is determined, including:

[0014] A second feature matrix sequence of the network to be tested is generated according to the target space feature of each node to be tested and the first feature representation of the attribute dimension of the node to be tested.

[0015] In an optional implementation, obtaining a first characteristic matrix sequence of the network to be tested includes:

[0016] Acquire a third feature matrix sequence and a fourth feature matrix sequence of the network to be tested, wherein the feature matrix of the third feature matrix sequence is an initial feature matrix generated according to multiple time snapshots of the network to be tested in a target historical time period, and the feature matrix of the third feature matrix sequence includes: a feature representation of a data attribute dimension, a feature representation of a time step dimension, and an initial feature representation of an attribute dimension of a node to be tested, and the feature matrix in the fourth feature matrix sequence includes a feature representation of a node attribute dimension of multiple nodes to be tested in the network to be tested, a feature identifier of a time step dimension, and a feature representation of a pairwise network distance dimension between different nodes to be tested;

[0017] Inputting the third feature matrix sequence and the fourth feature matrix sequence into a graph convolutional neural network to generate feature matrices of multi-order neighbor nodes of the node to be tested; the graph convolutional neural network includes: a plurality of groups of processing layers connected in sequence, and a tail graph convolution layer connected to the last group of processing layers; wherein each group of processing layers includes: a graph convolution layer, a batch normalization layer, and an activation layer;

[0018] A first feature matrix sequence is generated based on the feature matrices of the multi-order neighbor nodes of the node to be tested and the feature matrices of the first-order neighbor nodes output by the first group of processing layers.

[0019] In an optional implementation, determining the target spatial feature of each node to be tested based on the query value, key value, and mapping value of the spatial feature of each node to be tested includes:

[0020] Determine the weight of the spatial feature of each node to be tested according to the query value and key value of each node to be tested;

[0021] Based on the weight of the spatial feature of each node to be measured and the mapping value of the spatial feature, the spatial feature of each node to be measured is modified to obtain the target spatial feature of each node to be measured.

[0022] In an optional implementation, determining a network intrusion prediction result of the network to be tested in a prediction time period based on the second characteristic matrix sequence includes:

[0023] The feature matrices of the second feature matrix sequence are respectively input into the prediction model to obtain the network intrusion probability corresponding to each feature matrix, where the network intrusion probability is the probability that the network to be tested has a network intrusion;

[0024] According to the network intrusion probability and probability threshold corresponding to each feature matrix, the network intrusion prediction result of the network to be tested in the prediction time period is determined.

[0025] In an optional embodiment, the method further includes:

[0026] When the network intrusion probability corresponding to the target feature matrix is ​​greater than or equal to the probability threshold, the node information of the target node is determined according to the feature representation of the node attribute dimension of the target feature matrix;

[0027] Determine the abnormal data information of the target node according to the feature representation of the data attribute dimension of the target feature matrix;

[0028] Generate alarm information based on node information and abnormal data information;

[0029] Send the alarm information to the monitoring end.

[0030] In an optional implementation, determining a second characteristic matrix sequence of the network to be tested according to the target space characteristics of each node to be tested includes:

[0031] Generate the spatial features to be updated based on the spatial features of each node to be tested and the target spatial features;

[0032] The spatial features to be updated of each node to be tested are input into the feedforward neural network to obtain the feature matrix of multiple time snapshots of the network to be tested in the prediction time period;

[0033] Based on the addition operation, the feature matrices of multiple time snapshots of each node to be tested in the prediction time period and the target space features are processed to determine a second feature matrix sequence of the network to be tested.

[0034] In a second aspect, the present invention provides a network intrusion prediction device, the device comprising:

[0035] An acquisition module is used to acquire a first feature matrix sequence of the network to be tested, wherein the first feature matrix sequence includes first feature matrices of multiple time snapshots of the network to be tested in a target historical time period, and the first feature matrix includes: feature representation of data attribute dimension and feature representation of time step dimension;

[0036] A first determination module is used to determine mapping information of the spatial features of each node to be tested in the network to be tested in the target space according to the first feature matrix sequence, wherein the mapping information includes a query value, a key value, and a mapping value of the spatial features, and the spatial features include a feature representation of a data attribute dimension and a feature representation of a time step dimension;

[0037] A second determination module is used to determine the target spatial feature of each node to be tested based on the query value, key value and mapping value of the spatial feature of each node to be tested;

[0038] A third determination module is used to determine a second characteristic matrix sequence of the network to be tested based on the target space characteristics of each node to be tested, where the second characteristic matrix is ​​a characteristic matrix of multiple time snapshots of the network to be tested in a prediction time period;

[0039] The fourth determination module is used to determine the network intrusion prediction result of the network to be tested in the prediction time period based on the second characteristic matrix sequence.

[0040] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the network intrusion prediction method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0041] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the network intrusion prediction method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 is one of the flow charts of the network intrusion prediction method according to an embodiment of the present invention;

[0044] Figure 2 is a schematic diagram of a residual graph convolutional network block according to an embodiment of the present invention;

[0045] Figure 3 is a second flowchart of the network intrusion prediction method according to an embodiment of the present invention;

[0046] Figure 4 is a schematic flow chart of a second characteristic matrix sequence according to an embodiment of the present invention;

[0047] Figure 5 is a schematic diagram of a network intrusion prediction device according to an embodiment of the present invention;

[0048] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0050] According to an embodiment of the present invention, an embodiment of a method for predicting network intrusion is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] In this embodiment, a network intrusion prediction method is provided, which can be used for the above-mentioned server. Figure 1 FIG. 1 is a flowchart of a method for predicting network intrusion according to an embodiment of the present invention. Figure 1 As shown, the above method includes:

[0052] Step S101, obtaining a first characteristic matrix sequence of a network to be tested.

[0053] In this embodiment, the first feature matrix sequence includes the first feature matrix of multiple time snapshots of the network to be tested in the target historical time period, and the first feature matrix includes: feature representation of data attribute dimension and feature representation of time step dimension. Collect multiple time snapshots of the network to be tested in the historical time period, and construct a first feature matrix for each time snapshot. The feature representation of the data attribute dimension can be the attribute of the input and output data of the node, such as the data type, the flow size of the data, etc. The feature representation of the time step dimension can be the change of the node's characteristics over time, such as the change of the communication activity frequency, data flow, etc. of the node in the target historical time period.

[0054] Step S102: Determine mapping information of the spatial features of each node to be tested in the network to be tested in the target space according to the first feature matrix sequence.

[0055] In this embodiment, the mapping information includes a query value, a key value, and a mapping value of the spatial feature, wherein the spatial feature includes a feature representation of the data attribute dimension and a feature representation of the time step dimension. The query value (Query), the key value (Key), and the mapping value (Value) of the spatial feature can be a linear mapping of the first feature matrix projected to a high-dimensional latent subspace.

[0056] Step S103, determining the target spatial feature of each of the nodes to be tested based on the query value, the key value and the mapping value of the spatial feature of each of the nodes to be tested.

[0057] In this embodiment, the target space features of each of the above-mentioned nodes to be tested may be determined by calculating a new feature representation of the node in the target space through a self-attention mechanism, and aggregating spatial features at different times in a weighted manner.

[0058] Step S104: determining a second characteristic matrix sequence of the network to be tested based on the target space characteristics of each of the nodes to be tested.

[0059] In this embodiment, the second feature matrix is ​​a feature matrix of multiple time snapshots of the network under test in the prediction time period. Each node under test can obtain the corresponding target space feature through the above steps in parallel, and the second feature matrix of the network under test can be obtained by aggregating the target space features of each node under test.

[0060] Step S105: determining the network intrusion prediction result of the network to be tested in the prediction time period based on the second characteristic matrix sequence.

[0061] In this embodiment, the network intrusion prediction result can be the network intrusion probability corresponding to each time snapshot, which can be determined by inputting the above-mentioned second feature matrix sequence into a trained classification model or regression model, etc., to obtain the network intrusion probability corresponding to each time snapshot. When the network intrusion probability is greater than a preset value, an alarm can be issued.

[0062] The network intrusion prediction method provided by the present invention has the following advantages:

[0063] By obtaining the first feature matrix sequence of the network to be tested, combining the feature representation of the data attribute dimension and the feature representation of the time step dimension, the spatial features are mapped to the target space to obtain the mapping values ​​of the query value, key value, and spatial features, thereby effectively simulating the dynamic spatial dependency between nodes. According to the target spatial features of each node to be tested, the feature matrix of multiple time snapshots of the network to be tested in the prediction time period is determined, and the technical effect of predicting the network intrusion that the network to be tested may face based on the first feature matrix sequence is achieved. Since the dynamic spatial dependency between nodes is simulated when the target spatial features of each node to be tested are determined in the prediction process, the accuracy of the network intrusion prediction results determined based on the target spatial features of each node to be tested is improved in the space-time dimension.

[0064] In some optional implementations, the network to be tested includes: a plurality of nodes to be tested; the first feature matrix includes: a first feature representation of the attribute dimension of the node to be tested; the first feature representation of the attribute dimension of the node to be tested indicates the neighbor node feature of each node to be tested. The second feature matrix sequence of the network to be tested is determined based on the target space feature of each node to be tested, including: generating the second feature matrix sequence of the network to be tested according to the target space feature of each node to be tested and the first feature representation of the attribute dimension of the node to be tested.

[0065] In this embodiment, the first feature representation of the attribute dimension of the node to be tested can be a node attribute feature representation that captures the multi-order neighbor features of the network, which is not only the attributes of the node itself (such as type, traffic, etc.), but also includes the features of the neighbor nodes of the node. The second feature matrix sequence can be obtained by aggregating the target space features of all nodes to be tested and the first feature representation of the attribute dimension.

[0066] The network intrusion prediction method in this embodiment can more comprehensively capture the interdependence between nodes in the network by comprehensively considering the characteristics of each node and the characteristics of its neighboring nodes, which makes the network intrusion prediction more accurate and can effectively identify potential network threats. Not only does it rely on static node characteristics (such as node type or location, etc.), but it also considers the dynamic behavior of the node (such as communication traffic, time changes, etc.). The first feature representation of the attribute dimension of the node to be tested is further considered, and then the time characteristics and spatial characteristics of the network to be tested are combined to determine the network intrusion prediction result of the network to be tested in the prediction time period. This method of combining dynamic and static features can better capture the behavioral changes of the network, thereby improving the timeliness and accuracy of the prediction results.

[0067] Figure 2 is a schematic diagram of a residual graph convolutional network block according to an embodiment of the present invention, such as Figure 2 As shown in the figure, the residual graph convolutional network block includes: input, three groups of graph convolutional layers connected in sequence, batch normalization layer, activation layer, tail graph convolutional layer, addition operation, and output. The first batch normalization layer to the output constitutes a residual block. The input of the addition operation is the output of the first graph convolutional layer and the tail graph convolutional layer.

[0068] In some optional embodiments, Figure 3 FIG. 2 is a second flowchart of a method for predicting network intrusion according to an embodiment of the present invention. Figure 3 As shown, the above step S101 includes:

[0069] Step S1011, obtaining the third characteristic matrix sequence and the fourth characteristic matrix sequence of the network to be tested.

[0070] In this embodiment, the feature matrix of the third feature matrix sequence is an initial feature matrix generated according to multiple time snapshots of the network to be tested in the target historical time period. The feature matrix of the third feature matrix sequence includes: feature representation of data attribute dimension, feature representation of time step dimension, initial feature representation of attribute dimension of the node to be tested, and the feature matrix in the fourth feature matrix sequence includes feature representation of node attribute dimension of multiple nodes to be tested in the network to be tested, feature identification of time step dimension, and feature representation of paired network distance dimension between different nodes to be tested. The third feature matrix sequence can be obtained by splicing the original data packets of the disabled target historical time period, dividing the data packets into fragments of multiple time snapshots, and generating a feature matrix of a time snapshot for each fragment using standardized processing. The feature representation of the paired network distance dimension between different nodes to be tested can be the number of switches passed between network nodes. The fourth feature matrix can be an adjacency matrix constructed using a threshold Gaussian kernel.

[0071] Step S1012: input the third feature matrix sequence and the fourth feature matrix sequence into a graph convolutional neural network (i.e., the residual graph convolutional network block) to generate feature matrices of multi-order neighbor nodes of the node to be tested.

[0072] In this embodiment, the graph convolutional neural network includes: a plurality of groups of processing layers connected in sequence, and a tail graph convolution layer connected to the last group of processing layers; wherein each group of the processing layers includes: a graph convolution layer, a batch normalization layer, and an activation layer. The graph convolution layer may be a layer that performs a convolution operation on node features according to the connection relationship between nodes (such as the network topology), thereby extracting the feature relationship between the node and its neighbors, and the batch normalization layer may be a layer that standardizes the features output by the graph convolution layer, reduces the fluctuation of the feature values, and improves the training stability of the model. The activation layer may be a layer that uses a nonlinear activation function (such as ReLU) to enhance the expression ability of the model. The tail graph convolution layer may be used for feature fusion, further processing and integration of the input features, and forming a final feature matrix of multi-order neighbor nodes.

[0073] Step S1013, generating the first characteristic matrix sequence based on the characteristic matrices of the multi-order neighbor nodes of the node to be tested and the characteristic matrices of the first-order neighbor nodes output by the first group of processing layers.

[0074] In this embodiment, the characteristic matrix of the multi-order neighbor nodes may be a matrix reflecting the relationship between the node to be tested and the neighbor nodes of the multiple neighbor nodes. The characteristic matrix of the first-order neighbor nodes may be a matrix reflecting the direct relationship between the node to be tested and the neighbor nodes. Specifically, the characteristic matrix of the multi-order neighbor nodes of the node to be tested and the characteristic matrix of the first-order neighbor nodes output by the first group of processing layers may be calculated through residual connection to obtain a first characteristic matrix, and then each first characteristic matrix may be aggregated to obtain a first characteristic matrix sequence.

[0075] The network intrusion prediction method in this embodiment, by combining the multi-dimensional features of the node (such as data attributes, time step, network distance, etc.) into the network prediction model, can comprehensively capture the static and dynamic characteristics of the node, thereby enhancing the accuracy of the prediction model. The feature representation of the time step dimension and the pairwise distance dimension between nodes can help capture the pattern of network behavior changing over time, improving the timeliness and flexibility of the prediction. The relationship between a node and multi-order neighboring nodes can be considered through a graph convolutional neural network. Through the addition operation, the gradient is passed to the earlier layer to avoid the disappearance or explosion of the gradient. The multi-level graph convolution operation is fused with the deep feature, so that the model can identify potential security threats in a larger network topology, make intrusion predictions in advance, and improve network security protection capabilities.

[0076] In some optional embodiments, the target spatial feature of each node to be tested is determined based on the query value, the key value and the mapping value of the spatial feature of each node to be tested, including: determining the weight of the spatial feature of each node to be tested according to the query value and the key value of each node to be tested; modifying the spatial feature of each node to be tested based on the weight of the spatial feature of each node to be tested and the mapping value of the spatial feature to obtain the target spatial feature of each node to be tested.

[0077] In this embodiment, the weight S can be obtained by scaling the dot product function softmax to capture the bidirectional dependency between time snapshots:

[0078]

[0079] Among them, Q is the matrix corresponding to the query value, K T is the transpose of the matrix corresponding to the key value, and D is the feature representation of the data attribute dimension.

[0080] Among them, modifying the spatial characteristics of each node to be measured can be obtained by aggregating the weight of the spatial characteristics of the node to be measured and the mapping value of the above spatial characteristics. The specific aggregation method can be weighted average method, weighted summation method, exponential weighting method, etc.

[0081] The network intrusion prediction method in this embodiment, based on the target spatial feature modification method of query value, key value and spatial feature mapping, can play an important role in network intrusion prediction. By improving the representation of spatial features, the model can more accurately detect potential intrusion behaviors and improve the security and defense capabilities of the network. This method makes full use of the advantages of graph neural networks or self-attention mechanisms and has good prediction effects and adaptability.

[0082] In some optional embodiments, the above-mentioned determining the network intrusion prediction result of the above-mentioned network to be tested in the above-mentioned prediction time period based on the above-mentioned second characteristic matrix sequence includes: inputting the characteristic matrices of the above-mentioned second characteristic matrix sequence into the prediction model respectively to obtain the network intrusion probability corresponding to each characteristic matrix, and the above-mentioned network intrusion probability is the probability that the above-mentioned network to be tested has a network intrusion; according to the network intrusion probability corresponding to each of the above-mentioned characteristic matrices and the probability threshold, determining the network intrusion prediction result of the above-mentioned network to be tested in the above-mentioned prediction time period.

[0083] In this embodiment, each feature matrix will be input into a prediction model for further processing. The model can be a prediction model based on machine learning or deep learning (such as a neural network, a support vector machine, etc.), and its goal is to predict whether the network is invaded by learning the patterns in the feature matrix. The prediction model will calculate a network intrusion probability for each feature matrix. This probability indicates the possibility of an intrusion in the network during the time period. The probability threshold can be 70%. When the network intrusion probability is greater than 70%, it can be determined that the above-mentioned network to be tested will be invaded during the above-mentioned prediction time period.

[0084] The network intrusion prediction method in this embodiment can flexibly adjust the sensitivity of intrusion prediction according to different risk preferences or security requirements by setting the probability threshold. For example, if you want to reduce false alarms, you can increase the threshold; if you want to capture intrusions more sensitively, the threshold can be appropriately lowered. By combining the feature matrix sequence and the probability threshold, dynamic prediction based on time series is achieved, which can flexibly and efficiently determine whether a network intrusion occurs. This improves the prediction accuracy, enhances the adaptability and flexibility of the model, and provides real-time, automated network security protection capabilities.

[0085] In some optional implementations, the above method further includes:

[0086] When the network intrusion probability corresponding to the target feature matrix is ​​greater than or equal to the above-mentioned probability threshold, the node information of the target node is determined according to the feature representation of the node attribute dimension of the above-mentioned target feature matrix; the abnormal data information of the above-mentioned target node is determined according to the feature representation of the data attribute dimension of the above-mentioned target feature matrix; the alarm information is generated according to the above-mentioned node information and the above-mentioned abnormal data information; and the above-mentioned alarm information is sent to the monitoring end.

[0087] In this embodiment, the relevant feature information of each node in the network is obtained through the target feature matrix. These feature information are calculated through a specific algorithm model to obtain the network intrusion probability of the target node. If the probability is greater than or equal to the set threshold, the system will determine that the node may have a network intrusion. The node attribute dimension usually includes the basic feature information of the node, such as address, device type, connection duration, etc. Through these features, the system can establish the node information of the target node and then determine whether the behavior of the node is normal. When the target node is determined to be a potential source of network intrusion, the system will generate an alarm based on the node information and abnormal data information. These alarm messages will be sent to the monitoring end to prompt the network administrator or security personnel to conduct further investigation.

[0088] The network intrusion prediction method in this embodiment can timely identify potential network intrusions by monitoring the behavior of the target node, data flow and other characteristics, thereby strengthening network security protection. Through the comprehensive analysis of node information and abnormal data information, the system can effectively distinguish normal behavior from abnormal behavior and reduce the probability of false alarms and missed alarms. The generation and sending of alarm information enables security monitoring personnel to take timely measures to prevent the expansion of intrusion incidents. It can predict network intrusions and automatically generate alarms and respond when network intrusions occur, reducing manual intervention and improving response speed and accuracy. It can provide more comprehensive and accurate network security protection.

[0089] In some optional implementations, determining the second characteristic matrix sequence of the network to be tested according to the target space characteristics of each of the nodes to be tested includes:

[0090] Based on the spatial features of each of the above-mentioned nodes to be tested and the above-mentioned target spatial features, the spatial features to be updated are generated; the above-mentioned spatial features to be updated of each of the above-mentioned nodes to be tested are input into the forward feedback neural network to obtain the feature matrix of multiple time snapshots of the above-mentioned network to be tested in the prediction time period; based on the addition operation, the feature matrix of the above-mentioned multiple time snapshots of each of the above-mentioned nodes to be tested in the prediction time period and the above-mentioned target spatial features are processed to determine the second feature matrix sequence of the above-mentioned network to be tested.

[0091] In this embodiment, the spatial features to be updated can be obtained by residually connecting the target spatial features of each of the above-mentioned nodes to be tested with the feature representation of the data attribute dimension of the feature matrix of the above-mentioned third feature matrix sequence and the feature representation of the time step dimension. For each node to be tested, the system combines the feature matrices of multiple time snapshots within the prediction time period with the target spatial features based on the addition operation. The feedforward neural network can be a three-layer feedforward neural network.

[0092] The network intrusion prediction method in this embodiment combines spatial features with time snapshot features, so that the system can not only consider the current state of the network, but also fully consider historical information. This multi-dimensional, multi-time level feature fusion method greatly enhances the ability to identify complex network intrusion behaviors. By using a feedforward neural network, the time dependency of node behavior can be captured, and nodes that may be at risk of intrusion due to historical behavior patterns can be accurately identified. This makes it possible to more accurately and efficiently predict network intrusion behaviors, improve network security monitoring and emergency response capabilities, and provide network administrators with more intelligent protection solutions.

[0093] Figure 4 is a flow chart of a second characteristic matrix sequence according to an embodiment of the present invention. Figure 4As shown, the process includes: each first feature matrix is ​​aggregated into a first feature matrix sequence by position embedding. The spatial features of each node to be tested are extracted. The spatial features of each node to be tested are processed in parallel, and the spatial features of each node are projected to three potential subspaces through linear mapping (linear layer) to obtain the query value, key value, and mapping value of the spatial feature respectively. The query value and the key value are scaled dot product to obtain the weight of the spatial feature. The weight of the spatial feature is aggregated with the mapping value of the spatial feature to obtain the target spatial feature. The target spatial feature and the spatial feature of the node to be tested are input into the feedforward neural network to obtain the feature matrix corresponding to the node to be tested in the prediction time period. The target spatial feature after residual connection processing is added to the feature matrix corresponding to the prediction time period to obtain the spatial features corresponding to the matrix of the second feature matrix sequence. The spatial features corresponding to the matrix of the second feature matrix sequence of each node are aggregated to obtain the second feature matrix sequence.

[0094] The present invention provides a network intrusion prediction device. Figure 5 is a schematic diagram of a network intrusion prediction device according to an embodiment of the present invention, the device comprising:

[0095] An acquisition module 501 is used to acquire a first feature matrix sequence of the network to be tested, wherein the first feature matrix sequence includes first feature matrices of multiple time snapshots of the network to be tested in a target historical time period, and the first feature matrix includes: feature representation of data attribute dimension and feature representation of time step dimension;

[0096] A first determination module 502 is used to determine the mapping information of the spatial features of each node to be tested in the network to be tested in the target space according to the first feature matrix sequence, wherein the mapping information includes a query value, a key value, and a mapping value of the spatial features, and the spatial features include a feature representation of the data attribute dimension and a feature representation of the time step dimension;

[0097] A second determination module 503 is used to determine the target spatial feature of each of the nodes to be tested based on the query value, the key value and the mapping value of the spatial feature of each of the nodes to be tested;

[0098] A third determination module 504 is used to determine a second characteristic matrix sequence of the network to be tested based on the target space characteristics of each of the nodes to be tested, where the second characteristic matrix is ​​a characteristic matrix of multiple time snapshots of the network to be tested in a prediction time period;

[0099] The fourth determination module 505 is used to determine the network intrusion prediction result of the network to be tested in the prediction time period based on the second characteristic matrix sequence.

[0100] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0101] The network intrusion prediction device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0102] The embodiment of the present invention also provides a computer device having the above Figure 5 A prediction device for network intrusion is shown.

[0103] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0104] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit. The integrated circuit may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0105] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0106] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0107] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0108] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0109] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0110] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A network intrusion prediction method, characterized in that: The method comprises: Acquire a first feature matrix sequence of the network to be tested, the first feature matrix sequence comprising first feature matrices of multiple time snapshots of the network to be tested in a target historical time period, the first feature matrix comprising: feature representation of data attribute dimension and feature representation of time step dimension; Determine mapping information of spatial features of each node to be tested in the network to be tested in a target space according to the first feature matrix sequence, wherein the mapping information includes a query value, a key value, and a mapping value of the spatial features, and the spatial features include a feature representation of the data attribute dimension and a feature representation of the time step dimension; Determine the target spatial feature of each node to be tested based on the query value, the key value and the mapping value of the spatial feature of each node to be tested; Based on the target space characteristics of each of the nodes to be tested, determining a second characteristic matrix sequence of the network to be tested, where the second characteristic matrix is ​​a characteristic matrix of multiple time snapshots of the network to be tested in a prediction time period; Based on the second feature matrix sequence, a network intrusion prediction result of the network to be tested in the prediction time period is determined.

2. The method according to claim 1, characterized in that The network to be tested includes: a plurality of nodes to be tested; the first feature matrix includes: a first feature representation of the attribute dimension of the node to be tested; the first feature representation of the attribute dimension of the node to be tested indicates the neighbor node feature of each node to be tested; The step of determining a second characteristic matrix sequence of the network to be tested based on the target space characteristics of each of the nodes to be tested comprises: A second feature matrix sequence of the network to be tested is generated according to the target space feature of each of the nodes to be tested and the first feature representation of the attribute dimension of the node to be tested.

3. The method according to claim 2, characterized in that The step of obtaining a first characteristic matrix sequence of the network to be tested comprises: Acquire a third characteristic matrix sequence and a fourth characteristic matrix sequence of the network to be tested, wherein the characteristic matrix of the third characteristic matrix sequence is an initial characteristic matrix generated according to multiple time snapshots of the network to be tested in a target historical time period, and the characteristic matrix of the third characteristic matrix sequence includes: a characteristic representation of a data attribute dimension, a characteristic representation of a time step dimension, and an initial characteristic representation of an attribute dimension of the node to be tested, and the characteristic matrix in the fourth characteristic matrix sequence includes a characteristic representation of a node attribute dimension of multiple nodes to be tested in the network to be tested, a characteristic identifier of a time step dimension, and a characteristic representation of a pairwise network distance dimension between different nodes to be tested; Inputting the third feature matrix sequence and the fourth feature matrix sequence into a graph convolutional neural network to generate feature matrices of multi-order neighbor nodes of the node to be tested; the graph convolutional neural network comprises: a plurality of groups of processing layers connected in sequence, and a tail graph convolutional layer connected to the last group of processing layers; wherein each group of processing layers comprises: a graph convolutional layer, a batch normalization layer, and an activation layer; The first feature matrix sequence is generated based on the feature matrices of the multi-order neighbor nodes of the node to be tested and the feature matrices of the first-order neighbor nodes output by the first group of processing layers.

4. The method according to any one of claims 1 to 3, characterized in that The determining the target spatial feature of each node to be tested based on the query value, the key value, and the mapping value of the spatial feature of each node to be tested includes: Determining the weight of the spatial feature of each of the nodes to be tested according to the query value and the key value of each of the nodes to be tested; Based on the weight of the spatial feature of each of the nodes to be measured and the mapping value of the spatial feature, the spatial feature of each of the nodes to be measured is modified to obtain the target spatial feature of each of the nodes to be measured.

5. The method according to any one of claims 1 to 3, characterized in that The determining, based on the second feature matrix sequence, a network intrusion prediction result of the network to be tested in the prediction time period includes: Input the feature matrices of the second feature matrix sequence into the prediction model respectively to obtain the network intrusion probability corresponding to each feature matrix, wherein the network intrusion probability is the probability that the network to be tested has a network intrusion; According to the network intrusion probability and the probability threshold corresponding to each characteristic matrix, a network intrusion prediction result of the network to be tested in the prediction time period is determined.

6. The method according to claim 5, characterized in that The method further comprises: When the network intrusion probability corresponding to the target feature matrix is ​​greater than or equal to the probability threshold, determining the node information of the target node according to the feature representation of the node attribute dimension of the target feature matrix; Determining abnormal data information of the target node according to the feature representation of the data attribute dimension of the target feature matrix; Generate warning information according to the node information and the abnormal data information; The alarm information is sent to the monitoring terminal.

7. The method according to any one of claims 1 to 3, characterized in that Determining a second characteristic matrix sequence of the network to be tested according to the target space characteristics of each of the nodes to be tested includes: Generate a spatial feature to be updated based on the spatial feature of each of the nodes to be measured and the target spatial feature; Inputting the to-be-updated spatial features of each of the nodes to be tested into a feedforward neural network to obtain a feature matrix of multiple time snapshots of the network to be tested in a prediction time period; Based on the addition operation, the feature matrices of the multiple time snapshots of each of the nodes to be tested in the prediction time period and the target space features are processed to determine a second feature matrix sequence of the network to be tested.

8. A network intrusion prediction device, characterized in that: The device comprises: An acquisition module is used to acquire a first feature matrix sequence of the network to be tested, wherein the first feature matrix sequence includes a first feature matrix of multiple time snapshots of the network to be tested in a target historical time period, and the first feature matrix includes: a feature representation of a data attribute dimension and a feature representation of a time step dimension; A first determination module is used to determine mapping information of the spatial features of each node to be tested in the network to be tested in the target space according to the first feature matrix sequence, wherein the mapping information includes a query value, a key value, and a mapping value of the spatial features, and the spatial features include a feature representation of the data attribute dimension and a feature representation of the time step dimension; A second determination module, configured to determine a target spatial feature of each of the nodes to be measured based on the query value, the key value, and the mapping value of the spatial feature of each of the nodes to be measured; A third determination module is used to determine a second feature matrix sequence of the network to be tested based on the target space feature of each of the nodes to be tested, where the second feature matrix is ​​a feature matrix of multiple time snapshots of the network to be tested in a prediction time period; The fourth determination module is used to determine the network intrusion prediction result of the network to be tested in the prediction time period based on the second feature matrix sequence.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the network intrusion prediction method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the network intrusion prediction method according to any one of claims 1 to 7.

Images