Network security situation awareness and active defense system

Abstract

The invention relates to the technical field of network security, and discloses a network security situation awareness and active defense system, which comprises a micro-feature fine granularity extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module and an intelligent defense strategy generation and execution system module. According to the invention, a convolutional neural network and an attention mechanism are integrated through a micro-feature fine granularity extraction algorithm module, and micro-features of network flow data are extracted; the method comprises the following steps: extracting fine features from a dynamic abnormal behavior pattern library, matching the extracted fine features with abnormal behavior pattern features in the dynamic abnormal behavior pattern library, determining whether the fine features are abnormal features, if the fine features are abnormal features, evaluating the threat level of the abnormal features, and triggering a corresponding defense strategy based on the threat level. According to the network security situation awareness and active defense system, through fine analysis, intelligent identification and active defense strategies, micro flow attacks which are difficult to perceive by traditional security equipment are effectively handled, and the overall security protection capability of the network is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network security situation awareness and active defense system. Background Art

[0002] With the rapid development of network technology, network attack methods have become increasingly complex and covert, bringing unprecedented challenges to network security. Among them, the use of tiny traffic anomalies to penetrate or steal data is particularly tricky. Such attacks often use carefully designed tiny data packets to complete the attack in a very short time. Its traffic characteristics are similar to traditional normal traffic and are difficult to be detected by traditional security devices such as firewalls or intrusion detection systems. Attackers use this "low, slow and small" traffic pattern to quietly bypass security protection measures and sneak into the target system for deep penetration and data theft. Due to the strong concealment of the attack behavior and its short duration, traditional threshold- or rule-based security detection mechanisms are often difficult to respond effectively, resulting in attackers being able to successfully carry out attacks without being discovered.

[0003] Existing network security situation awareness systems focus more on macro-monitoring and analysis of network traffic, such as traffic size, protocol type, etc., but it is difficult to capture those tiny but extremely threatening abnormal traffic. This "broad-based" analysis method easily ignores malicious behaviors hidden in normal traffic, allowing attackers to use tiny traffic to infiltrate or steal data without being discovered. Therefore, a network security situation awareness and active defense system is proposed to solve the above problems. Summary of the invention

[0004] The purpose of this invention is to propose a network security situation awareness and active defense system through refined analysis, intelligent identification and active defense strategies, which can effectively respond to tiny traffic attacks that are difficult for traditional security equipment to detect, and improve the overall network security protection capabilities.

[0005] The present invention provides a network security situation awareness and active defense system, which includes a micro-feature fine-grained extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module, and an intelligent defense strategy generation and execution system module;

[0006] The micro-feature fine-grained extraction algorithm module integrates convolutional neural networks and attention mechanisms to extract micro-features of real-time network traffic data through deep analysis;

[0007] The dynamic abnormal behavior pattern library module constructs a dynamic abnormal behavior pattern library based on incremental learning, and the dynamic abnormal behavior pattern library contains known minor abnormal behavior patterns and abnormal behavior pattern features corresponding to each minor abnormal behavior pattern;

[0008] The real-time matching and dynamic assessment engine module is responsible for matching the fine features extracted from the real-time network traffic data with the abnormal behavior pattern features in the dynamic abnormal behavior pattern library, and determining whether the fine features are abnormal features. If they are abnormal features, the abnormal features are evaluated based on the dynamic assessment engine to obtain a threat level assessment result;

[0009] The intelligent defense strategy generation and execution system module is used to generate and immediately execute targeted defense strategies according to the threat level assessment results, and deploy the defense strategies to network security devices.

[0010] Based on the above technical solution, the present invention can also make the following improvements.

[0011] Optionally, the micro-feature fine-grained extraction algorithm module includes a multi-layer convolutional neural network structure, a multi-scale attention unit and a feature fusion unit;

[0012] The multi-layer convolutional neural network structure is used to extract fine features of different time scales and spatial scales from real-time network traffic data;

[0013] The multi-scale attention unit is used to dynamically adjust feature weights at different time scales and spatial scales through a multi-scale attention mechanism;

[0014] The feature fusion unit is used to fuse fine features of different scales based on corresponding feature weights to form fused fine features.

[0015] Optionally, the multi-layer convolutional neural network structure is used to extract feature representations from low-level to high-level from the real-time network traffic data layer by layer;

[0016] Each layer of the convolutional neural network structure includes a convolution layer, a pooling layer and an activation function layer. The convolution layer in the first layer of the convolutional neural network structure slides on the input real-time network traffic data through a convolution kernel, calculates the weighted sum of the local area, and captures the local features of the real-time network traffic data; the pooling layer downsamples the local features, and enters the convolution layer of the second layer of the convolutional neural network structure after passing through the activation function layer, and performs a convolution operation on the output of the first layer of the convolutional neural network structure. After being processed by multiple layers of the convolutional neural network structure, fine features of different time scales and spatial scales are extracted from the real-time network traffic data.

[0017] Optionally, the multi-scale attention unit is used to dynamically adjust feature weights at different time scales and spatial scales through a multi-scale attention mechanism, including:

[0018] According to the characteristics of real-time network traffic data, determine the time scale and spatial scale that need to be paid attention to;

[0019] Design corresponding attention layers for each temporal scale feature and spatial scale feature, learn the importance of features at different scales through training, and dynamically adjust the feature weights at different scales;

[0020] Among them, on the time scale, a self-attention mechanism layer is designed, and on the spatial scale, a cross-attention mechanism layer is designed.

[0021] Optionally, the dynamic abnormal behavior pattern library module constructs a dynamic abnormal behavior pattern library based on incremental learning, wherein the dynamic abnormal behavior pattern library contains known minor abnormal behavior patterns and abnormal behavior pattern features corresponding to each minor abnormal behavior pattern, including:

[0022] Collect known abnormal behavior pattern data from cybersecurity incidents, vulnerability reports, and attack sample sources;

[0023] Preprocessing and labeling the abnormal behavior pattern data, wherein the preprocessing includes data cleaning, data deduplication and output normalization, and the labeling refers to the abnormal type of each data sample;

[0024] Using a machine learning or deep learning algorithm to perform feature extraction on the preprocessed abnormal behavior pattern data, converting the abnormal behavior pattern data into a feature vector or representation form that can be processed by a computer to obtain abnormal behavior pattern features;

[0025] The obtained abnormal behavior pattern features are associated with the abnormal behavior pattern data to establish a dynamic abnormal behavior pattern library.

[0026] Optionally, the dynamic abnormal behavior pattern library introduces a forgetting mechanism or other storage optimization mechanisms, and the other storage optimization mechanisms include compression algorithms, index optimization mechanisms, and distributed storage mechanisms;

[0027] Regularly evaluate the abnormal behavior pattern data in the dynamic abnormal behavior pattern library, analyze the frequency of occurrence of the abnormal behavior pattern data in recent network traffic data and the correlation with known threats to determine whether the abnormal behavior pattern data is still representative or important, and based on the evaluation results, filter out outdated or redundant abnormal behavior pattern data as forgotten objects; remove the selected forgotten objects from the dynamic abnormal behavior pattern library;

[0028] Compressing the feature vector and pattern representation of the dynamic abnormal behavior pattern library based on the compression algorithm;

[0029] Selecting an index structure according to the characteristics of the abnormal behavior pattern data in the dynamic abnormal behavior pattern library, and regularly maintaining and updating the index structure;

[0030] When the data scale in the dynamic abnormal behavior pattern library is large, the abnormal behavior pattern data in the dynamic abnormal behavior pattern library is dispersedly stored on multiple nodes.

[0031] Optionally, the real-time matching and dynamic assessment engine module is responsible for matching the fine features extracted from the real-time network traffic data with the abnormal behavior pattern features in the dynamic abnormal behavior pattern library, including:

[0032] Design a reasonable indexing and query mechanism for the dynamic abnormal behavior pattern library;

[0033] Retrieving abnormal behavior pattern data from the dynamic abnormal behavior pattern library according to the designed indexing and query mechanism based on the fine features extracted from the real-time network traffic data;

[0034] Calculating the similarity between the micro-feature and each abnormal behavior pattern feature in the dynamic abnormal behavior pattern library;

[0035] If there is an abnormal behavior pattern feature whose similarity with the subtle feature is greater than a set threshold, the subtle feature is an abnormal feature, and the abnormal behavior pattern corresponding to the abnormal feature is obtained.

[0036] Optionally, the abnormal feature is evaluated based on a dynamic evaluation engine to obtain a threat level evaluation result, including:

[0037] Analyzing the complexity of the abnormal features based on a dynamic assessment engine to assess the potential impact of the threat;

[0038] Based on historical attack data, the similarities and differences between the abnormal behavior pattern corresponding to the abnormal feature and the known attack behavior are evaluated, the current threat level is evaluated, and a threat level assessment result is obtained. The threat level assessment result includes the urgency of the threat, the scope of impact, and the possible losses.

[0039] Optionally, the intelligent defense strategy generation and execution system module is used to generate and immediately execute a targeted defense strategy according to the threat level assessment result, and deploy the defense strategy to the network security device, including:

[0040] According to the threat level assessment result, searching a defense strategy template library for at least one corresponding defense strategy, wherein the defense strategy template library records the defense strategy corresponding to each threat level;

[0041] Arrange the multiple defense strategies found to form a task sequence, and use an automation tool to deploy the task sequence to the network security device;

[0042] The defense strategy includes at least traffic redirection, session termination, IP blocking, dynamic network isolation and honeypot trapping.

[0043] Optionally, the defense system also includes an adaptive optimization mechanism module, which fine-tunes the micro-feature fine-grained extraction algorithm, the dynamic abnormal behavior pattern library and the defense strategy according to the feedback results each time the defense strategy is used to successfully block the attack.

[0044] The network security situation awareness and active defense system provided by the present invention has the following beneficial technical effects compared with the prior art:

[0045] The present invention integrates advanced convolutional neural networks and attention mechanisms. This technological innovation enables the system to deeply and meticulously analyze the subtle features of network traffic data. Compared with traditional methods that only focus on macro traffic features, it can accurately capture those tiny but extremely threatening abnormal patterns, effectively making up for the problem that the existing system is insufficient in identifying tiny traffic anomalies. By constructing a dynamic abnormal behavior pattern library based on incremental learning, this system not only includes known tiny abnormal behavior patterns, but also has a strong self-learning ability. The online learning mechanism enables the system to continuously absorb newly discovered abnormal patterns and realize real-time updating and dynamic expansion of the pattern library. This feature ensures that the system can always maintain a high degree of sensitivity and adaptability in the face of evolving network threats. The real-time matching and dynamic evaluation engine module processes the real-time network traffic data with a fine-grained micro-feature extraction algorithm, and then efficiently matches it with the dynamic abnormal behavior pattern library. At the same time, the introduction The dynamic assessment engine can evaluate the threat level in real time according to the complexity of abnormal characteristics and historical attack data. This instant and dynamic assessment mechanism enables the system to respond quickly to potential threats and accurately judge the degree of harm, providing strong support for the formulation of subsequent defense strategies; the intelligent defense strategy generation and execution system module is a concentrated embodiment of the intelligence of the system. It can automatically generate and instantly execute targeted defense strategies based on real-time assessment results, and quickly deploy them to network security equipment. This ability to respond quickly and accurately implement policies effectively curbs potential network attacks and ensures the stability and security of the network environment. In summary, the network security situation awareness and active defense system of the present invention has significantly improved the intelligence, accuracy and response speed of network security protection through its unique technical features, effectively solving the key problems such as insufficient recognition ability and delayed response mentioned in the background technology, and providing new ideas and solutions for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A block diagram of a network security situation awareness and active defense system provided by the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be arbitrarily combined with each other to form a feasible technical solution. This combination is not subject to the constraints of the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in this field to achieve. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0048] Figure 1 The present invention provides a network security situation awareness and active defense system, such as Figure 1 As shown, the network security situation awareness and active defense system mainly includes a micro-feature fine-grained extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module, and an intelligent defense strategy generation and execution system module.

[0049] Among them, the micro-feature fine-grained extraction algorithm module integrates convolutional neural networks and attention mechanisms to extract subtle features of real-time network traffic data through deep analysis.

[0050] The dynamic abnormal behavior pattern library module constructs a dynamic abnormal behavior pattern library based on incremental learning, and the dynamic abnormal behavior pattern library contains known minor abnormal behavior patterns and abnormal behavior pattern features corresponding to each minor abnormal behavior pattern.

[0051] The real-time matching and dynamic assessment engine module is responsible for matching the subtle features extracted from the real-time network traffic data with the abnormal behavior pattern features in the dynamic abnormal behavior pattern library, and determining whether the subtle features are abnormal features. If they are abnormal features, the abnormal features are evaluated based on the dynamic assessment engine to obtain a threat level assessment result.

[0052] The intelligent defense strategy generation and execution system module is used to generate and immediately execute targeted defense strategies according to the threat level assessment results, and deploy the defense strategies to network security devices.

[0053] In a preferred embodiment, the present invention can be further configured as follows: a multi-layer convolutional neural network structure is designed in the micro-feature fine-grained extraction algorithm module, each layer includes a convolution layer, a pooling layer and a possible activation function layer, and multiple convolution layers, pooling layers and activation function layers together constitute a multi-layer convolutional neural network structure. The multi-layer convolutional neural network structure gradually extracts feature representations from low-level to high-level from the original network traffic data. Among them, the convolution layer slides on the input data through the convolution kernel to calculate the weighted sum of the local area, thereby capturing the local features in the data. As the number of network layers increases, the extracted features gradually become abstract and complex, and can express deeper semantic information. The pooling layer downsamples the feature map output by the convolution layer to reduce the spatial dimension of the feature, while retaining important feature information, reducing the amount of calculation and avoiding overfitting. The introduction of the activation function layer (such as the ReLU layer) introduces nonlinear factors into the network and enhances the expressive power of the model.

[0054] Based on the convolutional neural network structure to extract network traffic data features, an attention mechanism is introduced to dynamically adjust the weights of different features or feature areas by training one or more attention layers. The self-attention mechanism allows attention to different parts inside a single data packet when processing it, while the cross-attention mechanism helps to establish associations between multiple data packets or sessions and identify abnormal behaviors across time scales. The multi-layer convolutional neural network structure introduced in the micro-feature fine-grained extraction algorithm module and its fusion with the attention mechanism have brought significant beneficial effects.

[0055] The steps of extracting network traffic data by the micro-feature fine-grained extraction algorithm module are as follows: First, the multi-layer convolutional neural network structure can gradually extract feature representations from low-level to high-level from the original network traffic data through its layer-by-layer deepening structure. This feature extraction method is not only fine, but also can capture tiny abnormal patterns that are difficult to identify with traditional methods. Secondly, the combination of convolutional layers and pooling layers effectively reduces the spatial dimension of features and reduces computational complexity, while retaining key feature information and avoiding the occurrence of overfitting. Finally, the attention mechanism introduced on the basis of the features extracted by CNN further enhances the model's ability to recognize key features. Whether it is focusing on different parts within a single data packet through the self-attention mechanism, or establishing associations between multiple data packets or sessions through the cross-attention mechanism, it can significantly improve the system's recognition accuracy and response speed for abnormal behaviors across time scales. This enables the network security situation awareness system to defend more intelligently and accurately when facing complex and changeable network attacks.

[0056] In the specific operation process of the micro-feature fine-grained extraction algorithm module, it is first necessary to build a multi-layer convolutional neural network structure. The structure consists of multiple convolutional layers, pooling layers, and possible activation function layers. The input layer receives the original network traffic data, which may include information such as the content, structure, and timestamp of the data packet. Subsequently, the data passes through the first convolutional layer, which uses a preset convolution kernel to slide on the input data and calculate the weighted sum of the local area to capture the local features in the data. These features are then passed to the pooling layer for downsampling to reduce the spatial dimension of the features and retain important information. As the number of network layers increases, the convolutional layer continues to perform convolution operations on the output of the previous layer to extract more abstract and complex features. These features gradually express deeper semantic information, such as the interaction pattern between data packets, the regularity of time intervals, etc. Based on the features extracted by CNN, the system introduces an attention mechanism to dynamically adjust the feature weights. By training one or more attention layers, the model can learn the importance of different features or feature areas and give them higher weights during processing. The self-attention mechanism allows the model to focus on different parts of a single data packet when processing it, such as specific protocol fields, changes in packet size, etc., while the cross-attention mechanism helps the model establish associations between multiple packets or sessions and identify abnormal behavior patterns across time scales. Finally, the features processed above are input into the subsequent analysis module for further anomaly detection and defense strategy generation. The operation process of the entire micro-feature fine-grained extraction algorithm module realizes the transformation from raw network traffic data to high-level feature representation, providing strong technical support for network security situation awareness and active defense.

[0057] In a preferred embodiment, the present invention can be further configured as follows: considering the diversity of network traffic data on the basis of extracting features by convolutional neural networks, a multi-scale attention mechanism can be designed to capture feature changes at different time scales and spatial scales. In this way, the system can not only pay attention to the subtle differences within a single data packet, but also identify abnormal patterns in a data packet sequence. Therefore, on the basis of extracting features by convolutional neural networks, a multi-scale attention mechanism is innovatively introduced. The multi-scale attention mechanism can simultaneously pay attention to the feature changes of network traffic data on both time scales and spatial scales, which means that the system can not only deeply analyze the subtle differences within a single data packet, such as abnormalities in protocol fields, mutations in data packet sizes, etc., but also identify the overall abnormal patterns in data packet sequences from a macro level, such as abnormal traffic outbreaks, abnormal session behavior, etc. Secondly, by dynamically adjusting the feature weights at different scales, the system can more accurately locate potential network threats and improve the accuracy and efficiency of anomaly detection. Finally, the multi-scale attention mechanism enhances the adaptability and robustness of the system, so that it can maintain stable detection performance and response speed when facing a variety of network attack methods. First, it is necessary to use a convolutional neural network (CNN) to perform preliminary feature extraction on the original network traffic data. Through multi-layer convolution and pooling operations, CNN can extract low-level to high-level feature representations from data, which provide the basis for subsequent analysis. Based on the features extracted by CNN, a multi-scale attention mechanism is designed and introduced. This step can be divided into the following sub-steps: Determine the scale of the attention mechanism: According to the characteristics of network traffic data, determine the time scale and spatial scale that need to be paid attention to. The time scale may include the time interval between data packets, the duration of the session, etc.; the spatial scale may involve the structure and field distribution inside the data packet, etc. Design multi-scale attention layer: Design a corresponding attention layer for each scale. These attention layers can learn the importance of features at different scales through training and dynamically adjust their weights. For example, on the time scale, a self-attention mechanism can be designed to focus on the long-term dependencies in the data packet sequence; on the spatial scale, a cross-attention mechanism can be designed to identify anomalies in key fields inside the data packet. Fusion of multi-scale features: Fusion of the features output by the attention layers of each scale to form a comprehensive description of the network traffic data. The fusion process can be carried out by weighted summation, splicing, etc., and the specific method depends on the specific application scenario and performance requirements. Anomaly detection and response: Anomaly detection analysis is performed based on the fused multi-scale features. By comparing the similarity between current traffic characteristics and known abnormal patterns, it is determined whether there is a network threat. Once an abnormality is found, the corresponding defense strategy is immediately triggered, such as traffic redirection, session termination, IP blocking, etc., to curb potential network attacks.Through the above operation steps, the multi-scale attention mechanism can effectively improve the performance of the network security situation awareness system and realize accurate identification and rapid response to complex abnormal behaviors in network traffic data.

[0058] In a preferred embodiment, the present invention can be further configured as follows: in the micro-feature fine-grained extraction algorithm module, the hierarchical features extracted by CNN are combined with the weights assigned by the attention mechanism to perform feature fusion. In order to train the micro-feature fine-grained extraction algorithm, a suitable loss function needs to be designed to minimize the difference between the predicted features and the actual features. The loss function may include classification loss, regression loss, or a combination thereof, depending on the task type of anomaly recognition. The gradient descent method is used to optimize the algorithm parameters, and the weights of CNN and the attention mechanism are adjusted through the back propagation algorithm to improve the recognition accuracy and generalization ability of the model. In the micro-feature fine-grained extraction algorithm module, the hierarchical features extracted by CNN are combined with the weights assigned by the attention mechanism to achieve deep fusion and dynamic optimization of features. Through the multi-layer convolution and pooling operations of CNN, hierarchical features from low-level to high-level can be gradually extracted from the original network traffic data. These features not only retain the detailed information of the data, but also reveal the internal structure of the data; secondly, the introduction of the attention mechanism enables the model to dynamically adjust its weights according to the importance of different features, so that it can focus more on key information in the process of feature fusion, and improve the accuracy and robustness of feature expression; finally, by designing a suitable loss function and optimizing it with the gradient descent method and the back propagation algorithm, the model can continuously approach the real abnormal pattern, and improve the recognition accuracy and generalization ability of the model. These beneficial effects work together on the micro-feature fine-grained extraction algorithm module, so that the network security situation awareness system can respond to complex and changeable network threats more intelligently and efficiently. In order to train and optimize the above micro-feature fine-grained extraction algorithm, the following are the specific operation steps: Feature extraction and hierarchical representation: First, the original network traffic data is processed using a convolutional neural network (CNN), and hierarchical feature representations are extracted through multi-layer convolution and pooling operations. These features capture different attributes of the data at different levels, such as local details, structural information, etc. Attention mechanism weight allocation: Based on the features extracted by CNN, an attention mechanism is introduced. By training one or more attention layers, weights are dynamically assigned to different features or feature regions. These weights reflect the importance of the features in the anomaly recognition task, allowing the model to pay more attention to key information in subsequent processing. Feature fusion: The hierarchical features extracted by CNN are combined with the weights assigned by the attention mechanism for feature fusion. This step aims to integrate feature information at different levels to form a comprehensive and in-depth description of the original data. The fused features retain the fine-grained information of the data and highlight the importance of key features. Loss function design: According to the task type of anomaly recognition (such as classification, regression, etc.), a suitable loss function is designed. The loss function should be able to measure the difference between the abnormal pattern predicted by the model and the actual abnormal pattern, and serve as an optimization target to guide the adjustment of model parameters. The loss function can include classification loss, regression loss, or a combination of them.Parameter optimization and model training: Gradient descent is used as the optimization algorithm, and the weights of CNN and attention mechanism are adjusted through the back propagation algorithm. During the training process, the value of the loss function is continuously calculated, and the model parameters are updated according to its gradient information. This process is iterated until the loss function value converges below the preset threshold or reaches the predetermined training round. Model evaluation and tuning: Use an independent test data set to evaluate the trained model to verify its recognition accuracy and generalization ability. According to the evaluation results, the necessary tuning operations are performed on the model, such as adjusting the network structure, optimizing the loss function parameters, etc., to further improve the performance of the model. Through the above steps, the fine-grained extraction algorithm of micro-features can be effectively trained and optimized, providing strong technical support for the network security situation awareness system.

[0059] In a preferred embodiment, the present invention can be further configured as follows: in the dynamic abnormal behavior pattern library module, known abnormal behavior pattern data is collected from existing network security events, vulnerability reports, attack samples and other sources. After preprocessing and annotation, these data form the initial data set of the pattern library, and feature extraction is performed on the initial data set using machine learning or deep learning algorithms to convert abnormal behavior patterns into computer-processable feature vectors or representations, which are called abnormal behavior pattern features. These features should be able to fully and accurately describe the essential characteristics of abnormal behavior. Based on the extracted abnormal behavior pattern features, a dynamic abnormal behavior pattern library is established. The dynamic abnormal behavior pattern library can be stored in a variety of forms such as databases, file systems or memory data structures for rapid retrieval and matching. Receive network traffic data in real time, use micro-feature fine-grained extraction algorithms to perform anomaly detection on real-time data streams, identify potential abnormal behavior patterns, and incorporate newly discovered abnormal behavior patterns into the dynamic abnormal behavior pattern library through incremental learning mechanisms. This usually involves steps such as feature extraction, pattern representation, and storage of new patterns. At the same time, according to the characteristics of the new patterns, the existing patterns in the pattern library can be updated and optimized to improve the accuracy and adaptability of the pattern library. By collecting known abnormal behavior pattern data from multiple sources (such as network security incidents, vulnerability reports, attack samples, etc.), and after preprocessing and annotation, the initial data set of the pattern library is formed. This step ensures the diversity and comprehensiveness of the pattern library, laying a solid foundation for subsequent feature extraction and pattern recognition. Secondly, use advanced machine learning or deep learning algorithms to extract features from the initial data set, and convert abnormal behavior patterns into computer-processable feature vectors or representations. These features not only comprehensively and accurately describe the essential characteristics of abnormal behavior, but also improve the accuracy and efficiency of pattern matching. Furthermore, the dynamic abnormal behavior pattern library established based on the extracted features adopts flexible and diverse storage forms (such as databases, file systems or memory data structures) to achieve rapid retrieval and matching of abnormal behavior patterns. This design enables the system to respond to abnormal behaviors in network traffic in real time, improving the real-time and accuracy of detection. Finally, through the incremental learning mechanism, the system can continuously incorporate newly discovered abnormal behavior patterns into the pattern library and update and optimize existing patterns. This mechanism ensures the timeliness and adaptability of the pattern library, enabling the system to continuously respond to the ever-changing network threat environment. The following are the specific operation steps: Data collection and preprocessing: First, collect known abnormal behavior pattern data from sources such as network security incidents, vulnerability reports, and attack samples. Then, preprocess these data, including data cleaning, deduplication, and normalization operations to ensure data quality and consistency. Finally, annotate the data to clarify the abnormal type or label of each sample. Feature extraction and pattern representation: Use machine learning or deep learning algorithms to extract features from preprocessed data.This step aims to convert the raw data into a feature vector or representation that can be processed by a computer. The extracted features should fully and accurately describe the essential characteristics of the abnormal behavior. Subsequently, the extracted features are associated with the corresponding abnormal behavior patterns to form the initial data set of the pattern library. Establish a dynamic abnormal behavior pattern library: Based on the extracted features and the initial data set, a dynamic abnormal behavior pattern library is established. The pattern library can be stored in a variety of forms such as databases, file systems, or memory data structures for fast retrieval and matching. At the same time, a reasonable indexing and query mechanism is designed to improve the efficiency and accuracy of pattern matching. Real-time anomaly detection: Receive network traffic data in real time, and perform preprocessing and feature extraction on it. Then, a micro-feature fine-grained extraction algorithm is used to detect anomalies in real-time data streams. The algorithm can deeply analyze the subtle features of the data stream and identify potential abnormal behavior patterns. Incremental learning and pattern library update: For newly discovered abnormal behavior patterns, they are incorporated into the pattern library through the incremental learning mechanism. First, the new pattern is feature extracted and represented; then, the new pattern is added to the pattern library, and the index and query mechanism are updated; finally, the existing patterns in the pattern library are updated and optimized according to the characteristics of the new pattern to improve the accuracy and adaptability of the pattern library. This step is ongoing to ensure that the pattern library can keep up with changes in the cyber threat environment.

[0060] In a preferred embodiment, the present invention can be further configured as follows: in the dynamic abnormal behavior pattern library module, due to the continuous changes in the network threat environment, some old abnormal behavior patterns may gradually lose their representativeness or importance. In order to optimize the storage space and improve the matching efficiency, the pattern library needs to introduce a forgetting mechanism to regularly clean up outdated or redundant abnormal behavior patterns. In addition to the forgetting mechanism, other storage optimization technologies can also be used to improve the efficiency and scalability of the pattern library. The introduction of the forgetting mechanism enables the pattern library to regularly clean up outdated or redundant abnormal behavior patterns. This mechanism helps to free up valuable storage space resources, allowing the pattern library to remain compact and efficient. At the same time, by removing patterns that are no longer representative or important, interference factors in the matching process can be reduced, and the accuracy and efficiency of anomaly detection can be improved. Secondly, in addition to the forgetting mechanism, other storage optimization technologies are also considered to improve the efficiency and scalability of the pattern library. These technologies may include compression algorithms, index optimization, distributed storage, etc., which can further reduce the storage space occupied, speed up the data retrieval speed, and enable the pattern library to flexibly expand to adapt to larger-scale data and more complex network environments. The following are the specific steps: Implementation of the forgetting mechanism: Evaluate the effectiveness of the pattern: Evaluate the abnormal behavior patterns in the pattern library regularly (such as weekly or monthly), analyze the frequency of its occurrence in recent network traffic data, the correlation with known threats and other indicators to determine whether it is still representative or important, and select the forgotten objects: According to the evaluation results, filter out outdated or redundant abnormal behavior patterns as forgotten objects. These patterns may lose their value because they are no longer frequently triggered, have no direct association with known threats, or have been replaced by newly discovered patterns. Perform the forgetting operation: Remove the selected forgotten objects from the pattern library, and update the index and query mechanism to ensure that the system can continue to work efficiently. At the same time, record the relevant information of the forgetting operation for subsequent auditing or analysis. Use other storage optimization technologies: Compression algorithm application: Compress the data in the pattern library to reduce the storage space occupied. Select appropriate compression algorithms (such as dictionary compression, Huffman coding, etc.) to compress feature vectors, pattern representations, etc., and ensure that the integrity and recoverability of the data are maintained during the compression process. Index optimization: Optimize the index structure in the pattern library to improve retrieval efficiency. Select appropriate index types (such as hash tables, B-trees, etc.) according to the characteristics of the pattern data, and regularly maintain and update the index to ensure its accuracy and efficiency. Distributed storage considerations: When the pattern library is large, you can consider using a distributed storage solution to improve the scalability and fault tolerance of the system. Store pattern data in a distributed manner on multiple nodes, and work together through the network to achieve efficient retrieval and update operations. When implementing distributed storage, you need to pay attention to issues such as data consistency, availability, and partition fault tolerance.

[0061] In a preferred embodiment, the present invention can be further configured as follows: in real-time matching and dynamic evaluation engine module, network traffic data is captured in real-time, including key information such as data packet content, protocol type, timestamp, etc., the collected data is preprocessed, such as denoising, formatting, normalization, etc., for subsequent processing, and a micro-feature fine-grained extraction algorithm is used to deeply analyze the preprocessed data to extract subtle features including data packet content, structure, time interval, etc., and an efficient indexing mechanism such as a hash table, an inverted index, etc. is established for a dynamic abnormal behavior pattern library to accelerate the matching process. After the real-time data feature extraction is completed, these indexes are used to quickly retrieve relevant abnormal patterns in the pattern library, and appropriate similarity or distance measurement methods such as cosine similarity, Euclidean distance, etc. are used to calculate the similarity between the real-time data features and the abnormal patterns in the pattern library to determine whether there are matching items. In view of large-scale data sets and real-time requirements, technical means such as parallel processing and distributed computing are used to optimize the matching process, improve the matching speed and accuracy, and ensure the integrity and availability of the data by capturing network traffic data in real time and preprocessing it. Preprocessing steps such as denoising, formatting, and normalization effectively reduce the noise and redundant information in the data, laying a solid foundation for subsequent feature extraction and pattern matching. Secondly, the preprocessed data is deeply analyzed using a micro-feature fine-grained extraction algorithm to extract subtle features including packet content, structure, and time interval. These features not only fully and accurately describe the behavioral characteristics of network traffic, but also improve the sensitivity and specificity of pattern matching. Furthermore, an efficient indexing mechanism such as hash tables and inverted indexes is established for the dynamic abnormal behavior pattern library to accelerate the matching process. These indexing mechanisms enable the system to quickly locate abnormal patterns related to real-time data features, reduce unnecessary search and comparison operations, and improve matching efficiency. In addition, the use of appropriate similarity or distance measurement methods to calculate the similarity between real-time data features and abnormal patterns in the pattern library can accurately determine whether there is a match. This quantitative evaluation method avoids the errors and uncertainties of subjective judgment and improves the accuracy and reliability of anomaly detection. Finally, in view of large-scale data sets and real-time requirements, technical means such as parallel processing and distributed computing are used to optimize the matching process. These technical means make full use of the parallelism and scalability of modern computing resources, improve the processing power and response speed of the system, and ensure the efficiency and accuracy of real-time matching and dynamic evaluation. The following are the specific steps: Real-time capture of network traffic data: Use network packet capture tools or network interface cards (NICs) to capture data packets in the network in real time. Extract key information of data packets, including data packet content, protocol type, timestamp, etc. Data preprocessing: De-noise the captured data and remove invalid or redundant data packets. Format the data packets to ensure data consistency and comparability. Normalize the data packets and convert data of different dimensions into the same dimension for subsequent processing.Fine-grained micro-feature extraction: Use fine-grained micro-feature extraction algorithms to perform in-depth analysis on preprocessed data. Extract subtle features such as data packet content, structure, and time interval to form feature vectors or representations. Establish an indexing mechanism: Establish an efficient indexing mechanism for the dynamic abnormal behavior pattern library, such as hash tables and inverted indexes. Associate the extracted feature vectors or representations with the indexing mechanism for fast retrieval. Real-time matching: After the real-time data feature extraction is completed, use the indexing mechanism to quickly retrieve related abnormal patterns in the pattern library. Use appropriate similarity or distance measurement methods (such as cosine similarity, Euclidean distance, etc.) to calculate the similarity between the real-time data features and the abnormal patterns in the pattern library. Determine whether there is a match based on the similarity threshold, and if so, perform exception processing or alarm. Optimize the matching process: For large-scale data sets and real-time requirements, use parallel processing, distributed computing and other technical means to optimize the matching process. Decompose the matching task into multiple subtasks for parallel execution to improve processing speed. Use distributed computing resources to achieve load balancing and fault tolerance to ensure system stability and reliability.

[0062] In a preferred embodiment, the present invention can be further configured as follows: in the real-time matching and dynamic evaluation engine module, after matching the abnormal pattern, the dynamic evaluation engine first analyzes the complexity of the abnormal features, including the rarity, diversity, and relevance of the features, so as to evaluate the potential impact range of the threat. Combined with historical attack data, the similarity and difference between the current abnormal pattern and the known attack behavior are evaluated. The historical data includes key information such as attack type, attack source, attack target, and attack means. Based on the complexity of the abnormal features and the fusion results of the historical attack data, the evaluation algorithm based on rule evaluation is adopted to calculate the threat level in real time. The evaluation results may include the urgency of the threat, the scope of impact, and the possible losses. According to the threat level evaluation results, the corresponding security response mechanism is triggered, such as automatic blocking, alarm notification, log recording, etc. The real-time matching and evaluation results are fed back to the dynamic abnormal behavior pattern library for updating and optimizing the abnormal pattern set and evaluation algorithm in the pattern library. At the same time, the response effect data is collected and analyzed for subsequent system improvement and performance optimization. After matching the abnormal pattern, the dynamic evaluation engine will first analyze the complexity of the abnormal features, including the rarity, diversity, and relevance of the features. This fine-grained feature analysis helps to more accurately understand the nature of abnormal behavior and provide a more comprehensive information basis for subsequent threat assessment. By evaluating the potential impact range of the threat, the system can more accurately locate potential security risks. Secondly, historical attack data is combined to evaluate the similarities and differences between the current abnormal pattern and known attack behaviors. This historical data-based evaluation method can make full use of past experience and knowledge to improve the accuracy and reliability of threat assessment. At the same time, through comprehensive analysis of key information such as attack type, attack source, attack target, and attack means, the system can more comprehensively understand the overall picture of the threat and provide strong support for the formulation of effective security strategies. Furthermore, based on the complexity of abnormal features and the fusion results of historical attack data, a rule-based evaluation algorithm is used to calculate the threat level in real time. This quantitative evaluation method can intuitively reflect the urgency, impact range, and possible losses of the threat, providing a clear reference for decision makers. At the same time, according to the threat level assessment results, the system can automatically trigger the corresponding security response mechanism, such as automatic blocking, alarm notification, log recording, etc., to ensure that the threat can be responded to quickly and effectively when it occurs. Finally, the real-time matching and evaluation results are fed back to the dynamic abnormal behavior pattern library to update and optimize the abnormal pattern collection and evaluation algorithm in the pattern library. This closed-loop feedback mechanism ensures that the system maintains sensitivity and response capabilities to new threats during the process of continuous learning and evolution.At the same time, by collecting and analyzing response effect data, the system can continuously optimize its own performance and functions, and provide strong support for the continuous protection of network security. The following are the specific operation steps: Abnormal pattern matching: In the real-time matching and dynamic assessment engine module, the captured network traffic data is first matched in real time to identify potential abnormal patterns. Abnormal feature analysis: After matching the abnormal pattern, the dynamic assessment engine analyzes the complexity of the abnormal features. This includes evaluating the rarity of the feature (i.e., the frequency of the feature appearing in normal traffic), diversity (i.e., the number of different types of features contained in the abnormal pattern), and correlation (i.e., the interaction and relationship between different features). Historical data fusion: Combined with historical attack data, evaluate the similarity and difference between the current abnormal pattern and known attack behaviors. This involves a comprehensive analysis of key information such as attack type, attack source, attack target, and attack means in historical data to determine whether the current abnormal pattern belongs to a known attack behavior or a new attack variant. Threat level assessment: Based on the complexity of the abnormal features and the fusion results of historical data, a rule-based assessment algorithm is used to calculate the threat level in real time. The evaluation algorithm will consider multiple factors (such as the urgency of the threat, the scope of impact, the possible losses, etc.) to comprehensively evaluate the severity and priority of the threat. Triggering security response mechanism: According to the threat level assessment results, the system automatically triggers the corresponding security response mechanism. This may include automatically blocking potential malicious traffic, sending alarm notifications to administrators for manual intervention, and recording relevant logs for subsequent audits and analysis. Feedback and optimization: Feedback real-time matching and evaluation results to the dynamic abnormal behavior pattern library. This includes adding newly discovered abnormal patterns to the pattern library for future identification and evaluation of similar threats, and updating and optimizing the abnormal pattern collection and evaluation algorithm in the pattern library based on the evaluation results. At the same time, collect and analyze response effect data (such as blocking success rate, alarm accuracy, system response time, etc.) for subsequent system improvements and performance optimization. These data can help the system continue to learn and evolve to better respond to future network threats.

[0063] In a preferred embodiment, the present invention can be further configured as follows: in the intelligent defense strategy generation and execution system module, network traffic data, user behavior data, log information, etc. are collected in real time, and big data analysis and machine learning algorithms are used to deeply mine the data to identify potential threats and abnormal behavior patterns. The identified threats are verified and classified in combination with historical attack data and the latest threat intelligence to ensure the accuracy and timeliness of strategy generation, and a library containing a variety of defense strategy templates is established. These templates cover a variety of means from basic traffic redirection, session termination, IP blocking, to advanced dynamic network isolation, honeypot trapping, etc. The template library is regularly updated and optimized according to the latest security standards and best practices to ensure the effectiveness and advancement of the defense strategy. The selected defense strategy is orchestrated to form an executable task sequence. The task sequence is quickly deployed to network security devices using automated tools and technologies. The automated deployment process includes steps such as configuring network devices, updating security rules, and starting monitoring and response mechanisms to ensure that the defense strategy can be implemented in real time. After the deployment, the system continuously monitors network traffic and abnormal behavior data, and dynamically adjusts and optimizes defense strategies according to real-time situations. If new threats are found or existing strategies are ineffective, the system will automatically trigger the strategy update mechanism, reselect and deploy more appropriate defense strategies, and strictly abide by data security and privacy protection regulations during strategy generation and execution to ensure that sensitive information is not leaked or abused. Encryption technology is used to protect the security of data transmission and storage, prevent data from being illegally accessed or tampered with, and ensure that all defense strategies comply with relevant laws, regulations and security standards. Compliance issues caused by improper strategies are avoided. Regular compliance audits and assessments are conducted on the system to promptly discover and correct potential risks and vulnerabilities. The intelligent defense strategy generation and execution system module collects and analyzes multi-source data (including network traffic data, user behavior data, log information, etc.) in real time, and uses big data analysis and machine learning algorithms to deeply explore potential threats and abnormal behavior patterns. This process greatly improves the accuracy and speed of threat identification. At the same time, historical attack data and the latest threat intelligence are combined for verification and classification to ensure the accuracy and timeliness of strategy generation, so that defense measures can respond quickly to emerging threats. In addition, the defense strategy template library established by this module covers a variety of defense methods from basic to advanced, providing a wealth of options for dealing with different types of network attacks. The regular update and optimization of the template library ensures that the defense strategy is always consistent with the latest security standards and best practices, thereby improving the effectiveness and advancement of defense. In terms of policy execution, the application of automated deployment and dynamic adjustment mechanisms enables defense strategies to be quickly and accurately deployed to network security devices and flexibly adjusted according to real-time conditions. This not only reduces the need for manual intervention and the risk of operational errors, but also significantly improves the response speed and efficiency of network defense.More importantly, in the process of policy generation and execution, data security and privacy protection regulations are strictly followed, encryption technology is used to protect the security of data transmission and storage, and sensitive information is ensured not to be leaked or abused. At the same time, through regular compliance audits and assessments, potential risks and loopholes are discovered and corrected in a timely manner, avoiding compliance issues caused by improper policies. The specific operation steps of the intelligent defense policy generation and execution system module can be summarized as follows: Data collection: Real-time collection of network traffic data, user behavior data, log information, etc. to ensure the comprehensiveness and real-time nature of the data. Data analysis and threat identification: Use big data analysis and machine learning algorithms to conduct in-depth mining of the collected data to identify potential threats and abnormal behavior patterns. Combine historical attack data with the latest threat intelligence to verify and classify the identified threats to ensure the accuracy and timeliness of threat identification. Policy template library construction and update: Establish a library containing a variety of defense policy templates, covering a variety of defense methods from basic to advanced. According to the latest security standards and best practices, the template library is regularly updated and optimized to ensure the effectiveness and advancement of defense strategies. Policy selection and orchestration: According to the type and severity of the threat, select appropriate defense strategies from the template library for orchestration to form an executable task sequence. Automated deployment: Use automation tools and technologies to quickly deploy the orchestrated task sequence to network security devices. This includes steps such as configuring network devices, updating security rules, and starting monitoring and response mechanisms to ensure that the defense strategy can take effect immediately. Continuous monitoring and dynamic adjustment: After deployment, the system continuously monitors network traffic and abnormal behavior data. Dynamically adjust and optimize defense strategies based on real-time conditions. If new threats are found or existing strategies are ineffective, the system will automatically trigger the policy update mechanism to reselect and deploy more appropriate defense strategies. Data security and privacy protection: During the process of policy generation and execution, strictly abide by data security and privacy protection regulations. Encryption technology is used to protect the security of data transmission and storage to prevent data from being illegally accessed or tampered with. Compliance audit and assessment: Regularly conduct compliance audits and assessments on the system to promptly discover and correct potential risks and vulnerabilities and ensure that all defense strategies comply with the requirements of relevant laws, regulations and security standards.

[0064] In a preferred embodiment, the present invention can be further configured as follows: the system also includes an adaptive optimization mechanism module. After each successful attack blocking, the module will fine-tune the micro-feature fine-grained extraction algorithm, the dynamic abnormal behavior pattern library, and the defense strategy according to the feedback results. Through continuous learning and optimization, the system can continuously improve its recognition accuracy and response speed to cope with the increasingly complex network threat environment. The core of the adaptive optimization mechanism module lies in its ability to continuously learn and optimize. After each successful attack blocking, the module will fine-tune the micro-feature fine-grained extraction algorithm, the dynamic abnormal behavior pattern library, and the defense strategy according to the feedback results. This fine-tuning mechanism based on actual feedback enables the system to continuously accumulate experience and knowledge and optimize its recognition logic and defense means. Over time, the system's recognition accuracy for network threats will gradually improve, and the response speed will also be accelerated, thereby more effectively coping with the increasingly complex network threat environment. Specifically, the adaptive optimization mechanism module can more accurately extract key information related to threats from massive data and improve the accuracy of threat identification by optimizing the micro-feature fine-grained extraction algorithm. At the same time, by updating the dynamic abnormal behavior pattern library, the system can timely incorporate new attack patterns to ensure rapid response to new threats. In addition, fine-tuning the defense strategy enables the system to respond to different types of attacks more flexibly and improve the defense effect. In order to realize the functions of the adaptive optimization mechanism module, the following are the specific operation steps: Collect feedback after successfully blocking the attack: When the system successfully blocks a network attack, the adaptive optimization mechanism module will first collect all feedback data related to the attack, including but not limited to the attack type, attack source, attack time, blocking effect, etc. Analyze the feedback results: After collecting the feedback data, the module will analyze the data in detail to evaluate the recognition accuracy and response speed of the current system. In particular, it will focus on whether the system accurately identifies the attack, whether blocking measures are taken in time, and whether the blocking measures are effective. Fine-tune the fine-grained extraction algorithm of micro-features: Based on the feedback results, the module will fine-tune the fine-grained extraction algorithm of micro-features. This may involve adjusting algorithm parameters, optimizing feature selection strategies, or introducing new feature extraction methods to improve the algorithm's ability to extract key information. Update the dynamic abnormal behavior pattern library: At the same time, the module will update the dynamic abnormal behavior pattern library based on the new attack patterns or variant attack patterns involved in the feedback. This includes adding new attack patterns to the pattern library and adjusting the correlation and weight between patterns to improve the pattern library's ability to identify new threats. Adjust the defense strategy: Finally, the module will adjust the current defense strategy based on the feedback results. This may involve changing the execution order of the strategy, adjusting the parameter settings of the strategy, or introducing new defense methods to improve the system's defense effect against different types of attacks. Cyclic learning and optimization: After the above steps are completed, the adaptive optimization mechanism module will enter the next learning cycle.As the system continues to block new attacks and collect feedback data, the module will continue to learn and optimize, continuously improving the system's recognition accuracy and response speed.

[0065] The system first collects real-time network traffic data through the network interface or related security devices. These data include but are not limited to the content, structure, protocol type, source address, destination address, timestamp, etc. of the data packet. The collected data is sent to the micro-feature fine-grained extraction algorithm module for preprocessing in preparation for more in-depth analysis. The micro-feature fine-grained extraction algorithm module uses the powerful capabilities of convolutional neural networks (CNN) and attention mechanisms to conduct in-depth analysis of network traffic packets. By extracting subtle features such as packet content, structure, and time intervals between packets, the module can accurately identify abnormal patterns that are difficult to detect with traditional methods. The extracted micro-features not only cover the surface information of the data, but also deeply explore the inherent laws and potential anomalies of the data, providing rich materials for subsequent analysis. The real-time matching and dynamic evaluation engine module efficiently matches the preprocessed network traffic data (including micro-features) with the dynamic abnormal behavior pattern library. The pattern library is continuously updated through an incremental learning mechanism and contains known minor abnormal behavior patterns and newly discovered abnormal patterns. During the matching process, the dynamic evaluation engine evaluates the threat level in real time based on the complexity of the abnormal features and historical attack data. This step not only considers the matching degree of abnormal patterns, but also integrates multi-dimensional information such as historical trends of attacks and attackers' behavior patterns to ensure the accuracy and timeliness of threat assessment. The intelligent defense strategy generation and execution system module automatically generates targeted defense strategies based on the results of real-time matching and dynamic evaluation. These strategies cover a variety of means from basic traffic redirection, session termination, IP blocking to advanced dynamic network isolation, honeypot trapping, etc. The system analyzes the characteristics and severity of the current threat through intelligent algorithms and selects the most appropriate defense strategy for deployment. The deployment process uses automated tools and technologies to quickly configure defense strategies to network security devices to ensure that defense measures can take effect immediately. After the defense strategy is deployed, the system continuously monitors network traffic and abnormal behavior data. If new threats are found or existing strategies are ineffective, the system will automatically trigger the strategy update mechanism to reselect and deploy more appropriate defense strategies. Through this continuous monitoring and dynamic adjustment method, the system can continuously adapt to changes in network threats and ensure the effectiveness and advancement of network security protection.

[0066] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0067] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0069] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0070] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0071] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0072] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network security situation awareness and active defense system, including a micro-feature fine-grained extraction algorithm module, a dynamic abnormal behavior pattern library module, a real-time matching and dynamic evaluation engine module, and an intelligent defense strategy generation and execution system module; The micro-feature fine-grained extraction algorithm module integrates convolutional neural networks and attention mechanisms to extract micro-features of real-time network traffic data through deep analysis; The dynamic abnormal behavior pattern library module constructs a dynamic abnormal behavior pattern library based on incremental learning, wherein the dynamic abnormal behavior pattern library contains known minor abnormal behavior patterns and abnormal behavior pattern features corresponding to each minor abnormal behavior pattern; The real-time matching and dynamic assessment engine module is responsible for matching the fine features extracted from the real-time network traffic data with the abnormal behavior pattern features in the dynamic abnormal behavior pattern library, and determining whether the fine features are abnormal features. If they are abnormal features, the abnormal features are evaluated based on the dynamic assessment engine to obtain a threat level assessment result; The intelligent defense strategy generation and execution system module is used to generate and immediately execute targeted defense strategies according to the threat level assessment results, and deploy the defense strategies to network security devices.

2. The network security situation awareness and active defense system according to claim 1 is characterized in that: The micro-feature fine-grained extraction algorithm module includes a multi-layer convolutional neural network structure, a multi-scale attention unit and a feature fusion unit; The multi-layer convolutional neural network structure is used to extract fine features of different time scales and spatial scales from real-time network traffic data; The multi-scale attention unit is used to dynamically adjust feature weights at different time scales and spatial scales through a multi-scale attention mechanism; The feature fusion unit is used to fuse fine features of different scales based on corresponding feature weights to form fused fine features.

3. The network security situation awareness and active defense system according to claim 2 is characterized in that: The multi-layer convolutional neural network structure is used to extract low-level to high-level feature representations from real-time network traffic data layer by layer; Each layer of the convolutional neural network structure includes a convolution layer, a pooling layer and an activation function layer. The convolution layer in the first layer of the convolutional neural network structure slides on the input real-time network traffic data through a convolution kernel, calculates the weighted sum of the local area, and captures the local features of the real-time network traffic data; the pooling layer downsamples the local features, and enters the convolution layer of the second layer of the convolutional neural network structure after passing through the activation function layer, and performs a convolution operation on the output of the first layer of the convolutional neural network structure. After being processed by multiple layers of the convolutional neural network structure, fine features of different time scales and spatial scales are extracted from the real-time network traffic data.

4. The network security situation awareness and active defense system according to claim 2 is characterized in that: The multi-scale attention unit is used to dynamically adjust the feature weights at different time scales and spatial scales through a multi-scale attention mechanism, including: According to the characteristics of real-time network traffic data, determine the time scale and spatial scale that need to be paid attention to; Design corresponding attention layers for each temporal scale feature and spatial scale feature, learn the importance of features at different scales through training, and dynamically adjust the feature weights at different scales; Among them, on the time scale, a self-attention mechanism layer is designed, and on the spatial scale, a cross-attention mechanism layer is designed.

5. The network security situation awareness and active defense system according to claim 1 is characterized in that: The dynamic abnormal behavior pattern library module constructs a dynamic abnormal behavior pattern library based on incremental learning. The dynamic abnormal behavior pattern library contains known minor abnormal behavior patterns and abnormal behavior pattern features corresponding to each minor abnormal behavior pattern, including: Collect known abnormal behavior pattern data from cybersecurity incidents, vulnerability reports, and attack sample sources; Preprocessing and labeling the abnormal behavior pattern data, wherein the preprocessing includes data cleaning, data deduplication and output normalization, and the labeling refers to the abnormal type of each data sample; Using a machine learning or deep learning algorithm to perform feature extraction on the preprocessed abnormal behavior pattern data, converting the abnormal behavior pattern data into a feature vector or representation form that can be processed by a computer to obtain abnormal behavior pattern features; Associating the obtained abnormal behavior pattern features with the abnormal behavior pattern data to establish a dynamic abnormal behavior pattern library; The dynamic abnormal behavior pattern library is continuously updated based on an incremental learning model.

6. The network security situation awareness and active defense system according to claim 5 is characterized in that: The dynamic abnormal behavior pattern library introduces a forgetting mechanism or other storage optimization mechanisms, and the other storage optimization mechanisms include a compression algorithm, an index optimization mechanism, and a distributed storage mechanism; Regularly evaluate the abnormal behavior pattern data in the dynamic abnormal behavior pattern library, analyze the frequency of occurrence of the abnormal behavior pattern data in recent network traffic data and the correlation with known threats to determine whether the abnormal behavior pattern data is still representative or important, and screen out outdated or redundant abnormal behavior pattern data as forgotten objects based on the evaluation results; removing the selected forgotten object from the dynamic abnormal behavior pattern library; Compressing the feature vector and pattern representation of the dynamic abnormal behavior pattern library based on the compression algorithm; Selecting an index structure according to the characteristics of the abnormal behavior pattern data in the dynamic abnormal behavior pattern library, and regularly maintaining and updating the index structure; When the data scale in the dynamic abnormal behavior pattern library is large, the abnormal behavior pattern data in the dynamic abnormal behavior pattern library is dispersedly stored on multiple nodes.

7. The network security situation awareness and active defense system according to claim 1 is characterized in that: The real-time matching and dynamic evaluation engine module is responsible for matching the fine features extracted from the real-time network traffic data with the abnormal behavior pattern features in the dynamic abnormal behavior pattern library, including: Design a reasonable indexing and query mechanism for the dynamic abnormal behavior pattern library; Retrieving abnormal behavior pattern data from the dynamic abnormal behavior pattern library according to the designed indexing and query mechanism based on the fine features extracted from the real-time network traffic data; Calculating the similarity between the micro-feature and each abnormal behavior pattern feature in the dynamic abnormal behavior pattern library; If there is an abnormal behavior pattern feature whose similarity with the subtle feature is greater than a set threshold, the subtle feature is an abnormal feature, and the abnormal behavior pattern corresponding to the abnormal feature is obtained.

8. The network security situation awareness and active defense system according to claim 1 is characterized in that: The abnormal features are evaluated based on the dynamic evaluation engine to obtain a threat level evaluation result, including: Analyzing the complexity of the abnormal features based on a dynamic assessment engine to assess the potential impact of the threat; Based on historical attack data, the similarities and differences between the abnormal behavior patterns corresponding to the abnormal features and known attack behaviors are evaluated, the current threat level is evaluated, and a threat level assessment result is obtained. The threat level assessment result includes the urgency of the threat, the scope of impact, and the possible losses.

9. The network security situation awareness and active defense system according to claim 1, characterized in that: The intelligent defense strategy generation and execution system module is used to generate and immediately execute targeted defense strategies according to the threat level assessment results, and deploy the defense strategies to network security devices, including: According to the threat level assessment result, searching a defense strategy template library for at least one corresponding defense strategy, wherein the defense strategy template library records the defense strategy corresponding to each threat level; Arrange the multiple defense strategies found to form a task sequence, and use an automation tool to deploy the task sequence to the network security device; The defense strategy includes at least traffic redirection, session termination, IP blocking, dynamic network isolation and honeypot trapping.

10. The network security situation awareness and active defense system according to claim 9, characterized in that: The defense system also includes an adaptive optimization mechanism module, which fine-tunes the micro-feature fine-grained extraction algorithm, the dynamic abnormal behavior pattern library and the defense strategy according to the feedback results each time the defense strategy is used to successfully block the attack.

Images