Method and apparatus for predicting network intrusion

Abstract

The application relates to the technical field of network security, and discloses a network intrusion prediction method and device, which comprises the following steps: acquiring a first feature matrix sequence of a network to be measured, wherein the first feature matrix sequence comprises first feature matrices of multiple time snapshots of the network to be measured in a target historical time period; determining mapping information of spatial features of each node to be measured in the network to be measured in a target space according to the first feature matrix sequence; determining target space features of each node to be measured based on a query value, a key value and a mapping value of the spatial features of each node to be measured; determining a second feature matrix sequence of the network to be measured based on the target space features of each node to be measured; and determining a network intrusion prediction result of the network to be measured in a prediction time period based on the second feature matrix sequence. Thus, the technical effect of predicting the network intrusion that the network to be measured may face is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network intrusion prediction method and device. BACKGROUND

[0002] At present, in a cloud computing environment, user information and data may face the risk of being stolen. At present, solutions to network intrusion in cloud computing are mostly concentrated in detection technology, which can discover the occurrence of network intrusion events, but is limited to post-identification and cannot prevent the event from occurring. Even if the intrusion behavior can be detected in time, it has often caused losses. Therefore, how to accurately predict network intrusion has become a problem to be solved. SUMMARY

[0003] Therefore, the present application provides a network intrusion prediction method and device, and computer equipment to solve the problem of how to predict network intrusion.

[0004] In a first aspect, the present application provides a network intrusion prediction method, which comprises:

[0005] obtaining a first feature matrix sequence of the network to be tested, the first feature matrix sequence comprising a first feature matrix of a plurality of time snapshots of the network to be tested in a target historical time period, the first feature matrix comprising a feature representation of a data attribute dimension and a feature representation of a time step dimension;

[0006] determining mapping information of a spatial feature of each node to be tested in the network to be tested in a target space according to the first feature matrix sequence, the mapping information comprising a query value, a key value, and a mapping value of the spatial feature, the spatial feature comprising the feature representation of the data attribute dimension and the feature representation of the time step dimension;

[0007] determining a target spatial feature of each node to be tested based on the query value, the key value, and the mapping value of the spatial feature of each node to be tested;

[0008] determining a second feature matrix sequence of the network to be tested based on the target spatial feature of each node to be tested, the second feature matrix being a feature matrix of a plurality of time snapshots of the network to be tested in a prediction time period;

[0009] determining a network intrusion prediction result of the network to be tested in the prediction time period based on the second feature matrix sequence.

[0010] The network intrusion prediction method provided by the present application has the following advantages:

[0011] The first feature matrix sequence of the to-be-tested network is acquired, and the spatial features are mapped to a target space by combining the feature representation of the data attribute dimension and the feature representation of the time step dimension, so that the mapping values of the query value, the key value and the spatial feature are obtained, thereby effectively simulating the dynamic spatial dependency relationship between nodes. According to the target space feature of each to-be-tested node, the feature matrix of the to-be-tested network at multiple time snapshots in a prediction time period is determined, and the technical effect of predicting the network intrusion that the to-be-tested network may face based on the first feature matrix sequence is realized. Since the dynamic spatial dependency relationship between nodes is simulated when the target space feature of each to-be-tested node is determined in the prediction process, the accuracy of the network intrusion prediction result determined based on the target space feature of each to-be-tested node is improved in the time and space dimensions.

[0012] In an optional implementation, the to-be-tested network includes a plurality of to-be-tested nodes; the first feature matrix includes a first feature representation of the attribute dimension of the to-be-tested node; the first feature representation of the attribute dimension of the to-be-tested node indicates the neighbor node feature of each to-be-tested node;

[0013] Based on the target space feature of each to-be-tested node, a second feature matrix sequence of the to-be-tested network is determined, including:

[0014] According to the target space feature of each to-be-tested node and the first feature representation of the attribute dimension of the to-be-tested node, a second feature matrix sequence of the to-be-tested network is generated.

[0015] In an optional implementation, the first feature matrix sequence of the to-be-tested network is acquired, including:

[0016] A third feature matrix sequence and a fourth feature matrix sequence of the to-be-tested network are acquired, the feature matrix of the third feature matrix sequence is an initial feature matrix generated according to a plurality of time snapshots of the to-be-tested network in a target historical time period, the feature matrix of the third feature matrix sequence includes a feature representation of a data attribute dimension, a feature representation of a time step dimension and an initial feature representation of an attribute dimension of the to-be-tested node, and the feature matrix in the fourth feature matrix sequence includes a feature representation of a node attribute dimension of a plurality of to-be-tested nodes in the to-be-tested network, a feature identification of the time step dimension and a feature representation of a pair-wise network distance dimension between different to-be-tested nodes;

[0017] The third feature matrix sequence and the fourth feature matrix sequence are input into a graph convolutional neural network to generate a feature matrix of a multi-order neighbor node of the to-be-tested node; the graph convolutional neural network includes a plurality of groups of processing layers connected in sequence and a tail graph convolutional layer connected with the last group of processing layers; each group of processing layers includes a graph convolutional layer, a batch normalization layer and an activation layer.

[0018] generate a first feature matrix sequence based on the feature matrix of the multi-order neighbor nodes of the to-be-tested node and the feature matrix of the first-order neighbor nodes of the first group of processing layers.

[0019] In an optional implementation, the target spatial feature of each to-be-tested node is determined based on the query value, the key value, and the mapping value of the spatial feature of each to-be-tested node, and includes:

[0020] According to the query value and the key value of each to-be-tested node, the weight of the spatial feature of each to-be-tested node is determined.

[0021] Based on the weight of the spatial feature of each to-be-tested node and the mapping value of the spatial feature, the spatial feature of each to-be-tested node is modified to obtain the target spatial feature of each to-be-tested node.

[0022] In an optional implementation, the network intrusion prediction result of the to-be-tested network in the prediction time period is determined based on the second feature matrix sequence, and includes:

[0023] The feature matrix of the second feature matrix sequence is input into the prediction model respectively to obtain the network intrusion probability corresponding to each feature matrix, and the network intrusion probability is the probability of the existence of network intrusion of the to-be-tested network.

[0024] According to the network intrusion probability corresponding to each feature matrix and the probability threshold, the network intrusion prediction result of the to-be-tested network in the prediction time period is determined.

[0025] In an optional implementation, the method further includes:

[0026] When the network intrusion probability corresponding to the target feature matrix is greater than or equal to the probability threshold, the node information of the target node is determined according to the feature representation of the node attribute dimension of the target feature matrix;

[0027] According to the feature representation of the data attribute dimension of the target feature matrix, the abnormal data information of the target node is determined.

[0028] According to the node information and the abnormal data information, the alarm information is generated;

[0029] The alarm information is sent to the monitoring end.

[0030] In an optional implementation, the second feature matrix sequence of the to-be-tested network is determined according to the target spatial feature of each to-be-tested node, and includes:

[0031] Based on the spatial feature and the target spatial feature of each to-be-tested node, the to-be-updated spatial feature is generated;

[0032] The to-be-updated spatial feature of each to-be-tested node is input into the feedforward neural network to obtain the feature matrix of a plurality of time snapshots of the to-be-tested network in the prediction time period.

[0033] Based on the feature matrix and target spatial features of each node under test during the prediction period, the second feature matrix sequence of the network under test is determined.

[0034] Secondly, the present invention provides a network intrusion prediction device, the device comprising:

[0035] The acquisition module is used to acquire the first feature matrix sequence of the network under test. The first feature matrix sequence includes the first feature matrix of the network under test in multiple time snapshots of the target historical time period. The first feature matrix includes: feature representation in the data attribute dimension and feature representation in the time step dimension.

[0036] The first determining module is used to determine the mapping information of the spatial features of each node under test in the network under test in the target space according to the first feature matrix sequence. The mapping information includes query value, key value, and mapping value of spatial features. The spatial features include feature representation of data attribute dimension and feature representation of time step dimension.

[0037] The second determination module is used to determine the target spatial features of each node under test based on the query value, key value, and spatial feature mapping value of each node under test.

[0038] The third determination module is used to determine the second feature matrix sequence of the network under test based on the target space features of each node under test. The second feature matrix is ​​the feature matrix of multiple time snapshots of the network under test during the prediction period.

[0039] The fourth determination module is used to determine the network intrusion prediction result of the network under test in the prediction time period based on the second feature matrix sequence.

[0040] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the network intrusion prediction method described in the first aspect or any corresponding embodiment thereof.

[0041] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the network intrusion prediction method described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0042] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the drawings needed in the specific embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0043] Figure 1 is one of the flowcharts of the network intrusion prediction method according to an embodiment of the present application;

[0044] Figure 2 is a schematic diagram of a residual graph convolution network block according to an embodiment of the present application;

[0045] Figure 3 is the second flowchart of the network intrusion prediction method according to an embodiment of the present application;

[0046] Figure 4 is a flowchart of the second feature matrix sequence according to an embodiment of the present application;

[0047] Figure 5 is a schematic diagram of a network intrusion prediction device according to an embodiment of the present application;

[0048] Figure 6 is a hardware structure schematic diagram of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0050] According to an embodiment of the present application, a network intrusion prediction method embodiment is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0051] In the present embodiment, a network intrusion prediction method is provided, which can be used in the above-mentioned server, Figure 1 is one of the flowcharts of the network intrusion prediction method according to an embodiment of the present application, as Figure 1 shown, the above-mentioned method comprises:

[0052] Step S101, a first feature matrix sequence of the to-be-tested network is obtained.

[0053] In the embodiment, the first feature matrix sequence includes first feature matrices of multiple time snapshots of the to-be-tested network in a target historical time period, and the first feature matrix includes feature representations in a data attribute dimension and feature representations in a time step dimension. Multiple time snapshots of the to-be-tested network in a historical time period are collected, and a first feature matrix is constructed for each time snapshot. The feature representations in the data attribute dimension can be attributes of data input and output of a node, for example, data types, data flow sizes, and the like. The feature representations in the time step dimension can be a case where features of a node change over time, for example, changes in communication activity frequency, data flow, and the like of the node in the target historical time period.

[0054] Step S102, mapping information of a spatial feature of each to-be-tested node in the to-be-tested network in a target space is determined according to the first feature matrix sequence.

[0055] In the embodiment, the mapping information includes a query value, a key value, and a mapping value of the spatial feature, and the spatial feature includes the feature representations in the data attribute dimension and the feature representations in the time step dimension. The query value, the key value, and the mapping value of the spatial feature can be linear mapping of the first feature matrix projected to a high-dimensional latent subspace.

[0056] Step S103, a target spatial feature of each to-be-tested node is determined based on the query value, the key value, and the mapping value of the spatial feature of each to-be-tested node.

[0057] In the embodiment, the target spatial feature of each to-be-tested node can be determined by calculating a new feature representation of a node in a target space through a self-attention mechanism, and aggregating spatial features at different times through a weighted manner.

[0058] Step S104, a second feature matrix sequence of the to-be-tested network is determined based on the target spatial feature of each to-be-tested node.

[0059] In the embodiment, the second feature matrix is a feature matrix of multiple time snapshots of the to-be-tested network in a prediction time period. Each to-be-tested node can obtain a corresponding target spatial feature through the above steps, and the second feature matrix of the to-be-tested network can be obtained by aggregating the target spatial features of each to-be-tested node.

[0060] Step S105, a network intrusion prediction result of the to-be-tested network in the prediction time period is determined based on the second feature matrix sequence.

[0061] In the embodiment, the network intrusion prediction result can be a network intrusion probability corresponding to each time snapshot, and the network intrusion probability corresponding to each time snapshot can be determined by inputting the second feature matrix sequence into a trained classification model or regression model, etc. If the network intrusion probability is greater than a preset value, an alarm can be given.

[0062] The network intrusion prediction method provided by the application has the following advantages:

[0063] By obtaining the first feature matrix sequence of the to-be-tested network, combining the feature representation of the data attribute dimension and the feature representation of the time step dimension, mapping the spatial features to a target space, and obtaining the mapping values of the query value, the key value, and the spatial features, the dynamic spatial dependency relationship between nodes can be effectively simulated. According to the target space features of each to-be-tested node, the feature matrix of the to-be-tested network at multiple time snapshots in a prediction time period is determined, and the technical effect of predicting the network intrusion that the to-be-tested network may face based on the first feature matrix sequence is realized. Since the dynamic spatial dependency relationship between nodes is simulated when the target space features of each to-be-tested node are determined in the prediction process, the accuracy of the network intrusion prediction result determined based on the target space features of each to-be-tested node is improved in the time-space dimension.

[0064] In some optional embodiments, the to-be-tested network includes a plurality of to-be-tested nodes, and the first feature matrix includes a first feature representation of the attribute dimension of the to-be-tested nodes. The first feature representation of the attribute dimension of the to-be-tested nodes indicates the neighbor node features of each to-be-tested node. The second feature matrix sequence of the to-be-tested network is determined based on the target space features of each to-be-tested node and the first feature representation of the attribute dimension of the to-be-tested nodes, and includes generating the second feature matrix sequence of the to-be-tested network according to the target space features of each to-be-tested node and the first feature representation of the attribute dimension of the to-be-tested nodes.

[0065] In the embodiment, the first feature representation of the attribute dimension of the to-be-tested nodes can be a node attribute feature representation that captures network multi-order neighbor features. The first feature representation of the attribute dimension of the to-be-tested nodes is not only the attributes (such as types, flows, etc.) of the nodes themselves, but also includes the features of the neighbor nodes of the nodes. The second feature matrix sequence can be obtained by aggregating the target space features and the first feature representation of the attribute dimension of all to-be-tested nodes.

[0066] The prediction method of network intrusion in the embodiment can more comprehensively capture the interdependence between nodes in the network by comprehensively considering the characteristics of each node and the characteristics of its neighbor nodes, which makes the network intrusion prediction more accurate and can effectively identify potential network threats. Not only static node characteristics (such as node type or location, etc.) are relied on, but also dynamic behaviors of nodes (such as communication traffic, time variation, etc.) are considered. Further, the first feature representation of the attribute dimension of the to-be-tested node is considered, and then the time feature and the space feature of the to-be-tested network are combined to determine the network intrusion prediction result of the to-be-tested network in the prediction time period. The combination of dynamic and static features can better capture the behavior changes of the network, thereby improving the timeliness and accuracy of the prediction result.

[0067] Figure 2 is a schematic diagram of a residual graph convolutional network block according to an embodiment of the application, as shown in Figure 2 The residual graph convolutional network block includes input, three groups of sequentially connected graph convolutional layers, batch normalization layers, activation layers, tail graph convolutional layers, addition operations, and output. The first batch normalization layer to the output constitutes a residual block. The addition operation inputs the outputs of the first graph convolutional layer and the tail graph convolutional layer.

[0068] In some optional embodiments, Figure 3 is a second flowchart of a prediction method of network intrusion according to an embodiment of the application, as shown in Figure 3 The step S101 includes:

[0069] In step S1011, the third feature matrix sequence and the fourth feature matrix sequence of the to-be-tested network are obtained.

[0070] In the embodiment, the feature matrix of the third feature matrix sequence is an initial feature matrix generated according to a plurality of time snapshots of the to-be-tested network in a target historical time period. The feature matrix of the third feature matrix sequence includes a feature representation of a data attribute dimension, a feature representation of a time step dimension, and an initial feature representation of an attribute dimension of the to-be-tested node. The feature matrix in the fourth feature matrix sequence includes a feature representation of a node attribute dimension of a plurality of to-be-tested nodes in the to-be-tested network, a feature representation of a time step dimension, and a feature representation of a pair-wise network distance dimension between different to-be-tested nodes. The third feature matrix sequence can be obtained by using a standardized processing of each fragment to generate a feature matrix of a time snapshot after splicing and dividing the original data packets of the target historical time period into a plurality of time snapshot fragments. The feature representation of the pair-wise network distance dimension between different to-be-tested nodes can be the number of switches passed between network nodes. The fourth feature matrix can be an adjacency matrix constructed using a threshold Gaussian kernel.

[0071] Step S1012, input the third feature matrix sequence and the fourth feature matrix sequence into the graph convolutional neural network (i.e., the residual graph convolutional network block) to generate a feature matrix of the multi-order neighbor nodes of the to-be-detected node.

[0072] In this embodiment, the graph convolutional neural network includes a plurality of groups of processing layers connected in sequence, and a tail graph convolutional layer connected with the last group of processing layers; each group of processing layers includes a graph convolutional layer, a batch normalization layer, and an activation layer. The graph convolutional layer can perform convolutional operation on the node features according to the connection relationship between nodes (such as network topology), thereby extracting the feature relationship of the node and its neighbors. The batch normalization layer can standardize the features output by the graph convolutional layer, reduce the fluctuation of the feature values, and improve the training stability of the model. The activation layer can use a nonlinear activation function (such as ReLU) to enhance the expression ability of the model. The tail graph convolutional layer can be used for feature fusion, further processing and integration of the input features, and formation of the final feature matrix of the multi-order neighbor nodes.

[0073] Step S1013, based on the feature matrix of the multi-order neighbor nodes of the to-be-detected node and the feature matrix of the first-order neighbor nodes output by the first group of processing layers, the first feature matrix sequence is generated.

[0074] In this embodiment, the feature matrix of the multi-order neighbor nodes can reflect the relationship between the to-be-detected node and the neighbor nodes of the multi-order neighbor nodes. The feature matrix of the first-order neighbor nodes can reflect the direct relationship between the to-be-detected node and the neighbor nodes. Specifically, the feature matrix of the multi-order neighbor nodes of the to-be-detected node and the feature matrix of the first-order neighbor nodes output by the first group of processing layers can be calculated through residual connection to obtain the first feature matrix, and then each first feature matrix is aggregated to obtain the first feature matrix sequence.

[0075] The network intrusion prediction method in this embodiment can comprehensively capture the static and dynamic features of the nodes by combining the multi-dimensional features (such as data attributes, time steps, network distances, etc.) of the nodes into the network prediction model, thereby enhancing the accuracy of the prediction model. The feature representation of the time step dimension and the pair-wise distance dimension between nodes can help capture the pattern of network behavior changing over time, thereby improving the timeliness and flexibility of the prediction. The graph convolutional neural network can consider the relationship between the node and the multi-order neighbor nodes. The gradient is propagated to the earlier layers through the addition operation to avoid the disappearance or explosion of the gradient. The multi-level graph convolutional operation and the deep feature fusion enable the model to identify potential security threats in a larger network topology, thereby making early intrusion prediction and improving the network security protection capability.

[0076] In some optional embodiments, the determining the target spatial feature of each of the to-be-tested nodes based on the query value, the key value and the mapping value of the spatial feature of each of the to-be-tested nodes comprises: determining the weight of the spatial feature of each of the to-be-tested nodes according to the query value and the key value of each of the to-be-tested nodes; and modifying the spatial feature of each of the to-be-tested nodes based on the weight of the spatial feature of each of the to-be-tested nodes and the mapping value of the spatial feature to obtain the target spatial feature of each of the to-be-tested nodes.

[0077] In the embodiment, the weight S can be obtained by scaling the dot product function softmax to capture the bidirectional dependency between time snapshots.

[0078]

[0079] wherein Q is a matrix corresponding to the query value, K T is the transpose of a matrix corresponding to the key value, and D is a feature representation of the data attribute dimension.

[0080] The modifying the spatial feature of each of the to-be-tested nodes can be obtained by aggregating the weight of the spatial feature of the to-be-tested node and the mapping value of the spatial feature, and the specific aggregation method can be weighted average, weighted summation, exponential weighting, etc.

[0081] The prediction method of network intrusion in the embodiment, the target spatial feature modification method based on the query value, the key value and the spatial feature mapping, can play an important role in network intrusion prediction. By improving the representation of the spatial feature, the model can more accurately detect potential intrusion behavior, and improve the security and defense capability of the network. This method fully utilizes the advantages of graph neural networks or self-attention mechanisms, and has good prediction effect and adaptability.

[0082] In some optional embodiments, the determining the network intrusion prediction result of the to-be-tested network in the prediction time period based on the second feature matrix sequence comprises: inputting the feature matrices of the second feature matrix sequence into a prediction model respectively to obtain a network intrusion probability corresponding to each feature matrix, the network intrusion probability being a probability of existence of network intrusion of the to-be-tested network; and determining the network intrusion prediction result of the to-be-tested network in the prediction time period according to the network intrusion probability corresponding to each feature matrix and a probability threshold.

[0083] In this embodiment, each feature matrix is input into a prediction model for further processing. The model can be a machine learning or deep learning-based prediction model (such as neural networks, support vector machines, etc.), which aims to predict whether a network intrusion occurs by learning patterns in the feature matrix. The prediction model will calculate a network intrusion probability for each feature matrix. This probability represents the likelihood of a network intrusion occurring in that time period. The probability threshold can be 70%, and in the case of a network intrusion probability greater than 70%, it can be determined that the network under test will have an intrusion in the prediction period.

[0084] The prediction method of network intrusion in this embodiment can adjust the sensitivity of intrusion prediction according to different risk preferences or security requirements through the setting of the probability threshold. For example, if you want to reduce false positives, you can increase the threshold; if you want to be more sensitive to capture intrusions, the threshold can be appropriately reduced. By combining the feature matrix sequence and the probability threshold, dynamic prediction based on time series is achieved, which can flexibly and efficiently determine whether a network intrusion occurs. This improves prediction accuracy, enhances model adaptability and flexibility, and provides real-time, automated network security protection capabilities.

[0085] In some optional embodiments, the above method further comprises:

[0086] When the network intrusion probability corresponding to the target feature matrix is greater than or equal to the probability threshold, the node information of the target node is determined according to the feature representation of the node attribute dimension of the target feature matrix; the abnormal data information of the target node is determined according to the feature representation of the data attribute dimension of the target feature matrix; the alarm information is generated according to the node information and the abnormal data information; and the alarm information is sent to the monitoring end.

[0087] In this embodiment, the target feature matrix is used to obtain relevant feature information of each node in the network. These feature information is calculated through a specific algorithm model to obtain the network intrusion probability of the target node. If the probability is greater than or equal to the set threshold, the system will determine that the node may have a network intrusion. The node attribute dimension usually includes basic feature information of the node, such as address, device type, connection duration, etc. Through these features, the system can establish the node information of the target node, and further determine whether the behavior of the node is normal. When the target node is determined to be a potential network intrusion source, the system will generate an alarm according to the node information and the abnormal data information. These alarm information will be sent to the monitoring end to prompt the network administrator or security personnel to further investigate.

[0088] The network intrusion prediction method in the embodiment can timely identify potential network intrusion by monitoring the characteristics of the target node behavior, data traffic, etc., thereby strengthening network security protection. Through comprehensive analysis of node information and abnormal data information, the system can effectively distinguish between normal behavior and abnormal behavior, reducing the probability of false positives and false negatives. The generation and sending of alarm information enable security monitoring personnel to take timely measures to prevent the spread of intrusion events. The ability to predict network intrusion also enables the automatic generation of alarms and responses when network intrusion occurs, reducing manual intervention and improving response speed and accuracy. It can provide more comprehensive and accurate network security protection.

[0089] In some optional embodiments, determining the second feature matrix sequence of the to-be-tested network according to the target spatial feature of each to-be-tested node includes:

[0090] Based on the spatial feature of each to-be-tested node and the target spatial feature, a to-be-updated spatial feature is generated; the to-be-updated spatial feature of each to-be-tested node is input into the feedforward neural network to obtain a feature matrix of multiple time snapshots of the to-be-tested network in a prediction time period; and the second feature matrix sequence of the to-be-tested network is determined based on the addition operation processing the feature matrix of multiple time snapshots of each to-be-tested node in the prediction time period and the target spatial feature.

[0091] In the embodiment, the to-be-updated spatial feature can be obtained by connecting the target spatial feature of each to-be-tested node with the feature representation of the data attribute dimension and the feature representation of the time step dimension of the feature matrix of the third feature matrix sequence in residual connection. For each to-be-tested node, the system combines the feature matrix of multiple time snapshots in the prediction time period with the target spatial feature based on the addition operation. The feedforward neural network can be a three-layer feedforward neural network.

[0092] The network intrusion prediction method in the embodiment combines spatial features with time snapshot features, so that the system can not only consider the current state of the network, but also fully consider historical information. This multi-dimensional and multi-time-level feature fusion method greatly enhances the ability to identify complex network intrusion behavior. By using the feedforward neural network, the time dependence of node behavior can be captured, and nodes that may have intrusion risks due to historical behavior patterns can be accurately identified. Therefore, network intrusion behavior can be more accurately and efficiently predicted, and the ability of network security monitoring and emergency response can be improved, providing network administrators with a more intelligent protection scheme.

[0093] Figure 4 is a flowchart of the second feature matrix sequence according to an embodiment of the application, as Figure 4As shown, the flow includes: each first feature matrix is aggregated into a first feature matrix sequence by position embedding. The spatial features of each to-be-tested node are extracted. The spatial features of each to-be-tested node are processed in parallel, and the spatial features of each node are projected to three latent subspaces through linear mapping (linear layer) to obtain mapping values of the query value, the key value and the spatial features respectively. The query value and the key value are scaled and dot multiplied to obtain the weight of the spatial features. The weight of the spatial features and the mapping value of the spatial features are aggregated to obtain target spatial features. The target spatial features and the spatial features of the to-be-tested node are input into a front feedback neural network to obtain a feature matrix corresponding to a prediction time period of the to-be-tested node. The target spatial features after residual connection processing and the feature matrix corresponding to the prediction time period are added to obtain the spatial features corresponding to the matrix of the second feature matrix sequence. The spatial features corresponding to the matrix of the second feature matrix sequence of each node are aggregated to obtain the second feature matrix sequence.

[0094] The application provides a network intrusion prediction device, Figure 5 The application provides a network intrusion prediction device,

[0095] The acquisition module 501 is configured to acquire a first feature matrix sequence of a to-be-tested network, wherein the first feature matrix sequence comprises first feature matrices of a plurality of time snapshots of the to-be-tested network at a target historical time period, and each first feature matrix comprises feature representations in a data attribute dimension and feature representations in a time step dimension.

[0096] The first determination module 502 is configured to determine mapping information of spatial features of each to-be-tested node in the to-be-tested network in a target space according to the first feature matrix sequence, wherein the mapping information comprises a query value, a key value and a mapping value of the spatial features, and the spatial features comprise the feature representations in the data attribute dimension and the feature representations in the time step dimension.

[0097] The second determination module 503 is configured to determine target spatial features of each to-be-tested node based on the query value, the key value and the mapping value of the spatial features of each to-be-tested node.

[0098] The third determination module 504 is configured to determine a second feature matrix sequence of the to-be-tested network based on the target spatial features of each to-be-tested node, wherein each second feature matrix is a feature matrix of a plurality of time snapshots of the to-be-tested network at a prediction time period.

[0099] The fourth determination module 505 is configured to determine a network intrusion prediction result of the to-be-tested network at the prediction time period based on the second feature matrix sequence.

[0100] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0101] In this embodiment, the network intrusion prediction device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0102] This invention also provides a computer device having the above-described features. Figure 5 The device shown is a network intrusion prediction device.

[0103] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 6 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 6 Take a processor 10 as an example.

[0104] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include an integrated circuit. The integrated circuit may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GPRS), or any combination thereof.

[0105] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiment.

[0106] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required for at least one function, and the like. The data storage area can store data created according to the use of the computer device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-transitory solid state memory device. In some alternative embodiments, the memory 20 can optionally include a memory disposed remotely from the processor 10, which can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0107] The memory 20 can include a volatile memory such as a random access memory, and can further include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can also include a combination of the above-mentioned types of memory.

[0108] The computer device further includes a communication interface 30 for communication of the computer device with other devices or communication networks.

[0109] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned method according to the embodiments of the present application can be implemented in hardware, firmware, or as computer code recorded on a storage medium, or stored in a remote storage medium or a non-transitory machine-readable storage medium and downloaded to a local storage medium through a network, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, and the like. Further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that the computer, processor, microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the method shown in the above-mentioned embodiments.

[0110] Although the embodiments of the present application have been described with reference to the accompanying drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes are intended to fall within the scope of the appended claims.

Claims

1. A method of predicting network intrusion, characterized by, The method comprises: obtaining a first feature matrix sequence of a to-be-tested network, the first feature matrix sequence comprising first feature matrices of the to-be-tested network at multiple time snapshots in a target historical time period, the first feature matrix comprising feature representations in a data attribute dimension and feature representations in a time step dimension; determining mapping information of a spatial feature of each to-be-tested node in the to-be-tested network in a target space according to the first feature matrix sequence, the mapping information comprising a query value, a key value, and a mapping value of the spatial feature, the spatial feature comprising the feature representations in the data attribute dimension and the feature representations in the time step dimension; determining a target spatial feature of each to-be-tested node based on the query value, the key value, and the mapping value of the spatial feature of each to-be-tested node; determining a second feature matrix sequence of the to-be-tested network based on the target spatial feature of each to-be-tested node, the second feature matrix being a feature matrix of the to-be-tested network at multiple time snapshots in a prediction time period; determining a network intrusion prediction result of the to-be-tested network in the prediction time period based on the second feature matrix sequence.

2. The method of claim 1, wherein, The to-be-tested network comprises multiple to-be-tested nodes; the first feature matrix comprises first feature representations in an attribute dimension of the to-be-tested nodes; the first feature representations in the attribute dimension of the to-be-tested nodes indicate neighbor node features of each to-be-tested node; The determining of the second feature matrix sequence of the to-be-tested network based on the target spatial feature of each to-be-tested node comprises: generating the second feature matrix sequence of the to-be-tested network according to the target spatial feature of each to-be-tested node and the first feature representations in the attribute dimension of the to-be-tested nodes.

3. The method of claim 2, wherein, The obtaining of the first feature matrix sequence of the to-be-tested network comprises: obtaining a third feature matrix sequence and a fourth feature matrix sequence of the to-be-tested network, a feature matrix of the third feature matrix sequence being an initial feature matrix generated according to multiple time snapshots of the to-be-tested network in a target historical time period, the feature matrix of the third feature matrix sequence comprising feature representations in a data attribute dimension, feature representations in a time step dimension, and initial feature representations in an attribute dimension of the to-be-tested nodes, a feature matrix in the fourth feature matrix sequence comprising feature representations in a node attribute dimension of multiple to-be-tested nodes in the to-be-tested network, feature representations in a time step dimension, and feature representations in a pair-wise network distance dimension between different to-be-tested nodes; inputting the third feature matrix sequence and the fourth feature matrix sequence into a graph convolutional neural network to generate a feature matrix of multi-order neighbor nodes of the to-be-tested nodes; the graph convolutional neural network comprises multiple groups of processing layers connected in sequence and a tail graph convolutional layer connected with the last group of processing layers; each group of processing layers comprises a graph convolutional layer, a batch normalization layer, and an activation layer; generating the first feature matrix sequence based on the feature matrix of the multi-order neighbor nodes of the to-be-tested nodes and a feature matrix of first-order neighbor nodes output by a first group of processing layers.

4. The method according to any one of claims 1 to 3, characterized in that, The target space feature of each of the to-be-tested nodes is determined based on the query value, the key value, and the mapping value of the space feature of each of the to-be-tested nodes. The weight of the space feature of each of the to-be-tested nodes is determined according to the query value and the key value of each of the to-be-tested nodes. The space feature of each of the to-be-tested nodes is modified based on the weight of the space feature of each of the to-be-tested nodes and the mapping value of the space feature, to obtain the target space feature of each of the to-be-tested nodes.

5. The method according to any one of claims 1 to 3, characterized in that, The network intrusion prediction result of the to-be-tested network in the prediction time period is determined based on the second feature matrix sequence. Each feature matrix of the second feature matrix sequence is input into a prediction model to obtain a network intrusion probability corresponding to each feature matrix, the network intrusion probability being a probability of network intrusion existing in the to-be-tested network. The network intrusion prediction result of the to-be-tested network in the prediction time period is determined according to the network intrusion probability corresponding to each feature matrix and a probability threshold.

6. The method of claim 5, wherein, The method further comprises: When the network intrusion probability corresponding to the target feature matrix is greater than or equal to the probability threshold, node information of a target node is determined according to the feature representation of the node attribute dimension of the target feature matrix; Abnormal data information of the target node is determined according to the feature representation of the data attribute dimension of the target feature matrix; Alarm information is generated according to the node information and the abnormal data information; The alarm information is sent to a monitoring end.

7. The method according to any one of claims 1 to 3, characterized in that, The second feature matrix sequence of the to-be-tested network is determined according to the target space feature of each of the to-be-tested nodes, comprising: A to-be-updated space feature is generated based on the space feature and the target space feature of each of the to-be-tested nodes; The to-be-updated space feature of each of the to-be-tested nodes is input into a feedforward neural network to obtain feature matrices of multiple time snapshots of the to-be-tested network in a prediction time period; The second feature matrix sequence of the to-be-tested network is determined based on an addition operation processing the feature matrices of the multiple time snapshots of the to-be-tested network in the prediction time period and the target space feature of each of the to-be-tested nodes.

8. A network intrusion prediction apparatus characterized by comprising: The apparatus comprises: An acquisition module is configured to acquire a first feature matrix sequence of a to-be-tested network, the first feature matrix sequence comprising first feature matrices of multiple time snapshots of the to-be-tested network in a target historical time period, the first feature matrices comprising feature representations of data attribute dimensions and feature representations of time step dimensions; A first determination module is configured to determine mapping information of a space feature of each to-be-tested node in the to-be-tested network in a target space according to the first feature matrix sequence, the mapping information comprising a query value, a key value, and a mapping value of the space feature, the space feature comprising the feature representations of the data attribute dimensions and the feature representations of the time step dimensions; A second determination module is configured to determine a target space feature of each of the to-be-tested nodes based on the query value, the key value, and the mapping value of the space feature of each of the to-be-tested nodes. a third determining module, configured to determine a second feature matrix sequence of the to-be-tested network based on a target spatial feature of each of the to-be-tested nodes, the second feature matrix being a feature matrix of the to-be-tested network at a plurality of time snapshots in a prediction time period; a fourth determining module, configured to determine a network intrusion prediction result of the to-be-tested network in the prediction time period based on the second feature matrix sequence.

9. A computer device, comprising: comprising: a memory and a processor, which are in communication connection with each other, and the memory has stored computer instructions, and the processor executes the computer instructions to perform the network intrusion prediction method in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium has stored computer instructions, and the computer instructions are used to make a computer execute the network intrusion prediction method in any one of claims 1 to 7. The computer readable storage medium has stored computer instructions, and the computer instructions are used to make a computer execute the network intrusion prediction method in any one of claims 1 to 7.

Images