Encrypted traffic attack detection method and system based on deep learning

Abstract

The invention discloses an encrypted traffic attack detection method and system based on deep learning, and the method comprises the steps: obtaining real-time encrypted traffic data of a power system, and carrying out the feature extraction of the encrypted traffic data; constructing an attack chain knowledge graph, matching the extracted features with the attack chain knowledge graph, inputting the matched features into a pre-trained first detection model, and performing primary classification; and performing secondary confirmation on the primary classification result through a second detection model to generate a final detection result. According to the method, the accuracy of abnormal instruction recognition is remarkably improved, the false alarm rate is reduced, mass data can be efficiently processed, the labor cost is reduced, the data processing time is shortened, good adaptability is achieved, a detection model can be dynamically adjusted, a novel attack mode can be found and recognized in time, reliable and lasting guarantee is provided for network security, and the method is worthy of popularization and application. And the device is especially suitable for the power industry with extremely high safety requirements.

Description

Technical Field

[0001] The present invention relates to the technical field of power system information security, and in particular to a method and system for detecting encrypted traffic attacks based on deep learning. Background Art

[0002] At present, the research methods for malicious encrypted traffic detection at home and abroad are mainly based on machine learning and deep learning models. By analyzing the statistical characteristics and protocol characteristics of the traffic, the classification of malicious encrypted traffic can be achieved. Among them, machine learning detection methods are divided into supervised learning models and semi-supervised learning models. For supervised learning, the existing ones have strong dependence on feature extraction and selection, limited model generalization ability, inflexible feature weight processing, delayed response to new encryption technologies and attacks, and there is still room for improvement in the interpretability of new threats, performance optimization, and side-channel attack response. For deep learning, since it does not require decryption when detecting malicious encrypted traffic and has outstanding capabilities in mining features, it has certain advantages over traditional machine learning methods in improving detection efficiency, enhancing model generalization ability, and improving long-term dependency processing.

[0003] As an important infrastructure for the operation of the country and society, the security of the information system of the power industry is of vital importance. Encrypted traffic attacks, as a hidden and complex means of network attack, pose a serious threat to the security of the information system of the power industry. The existing mainstream methods such as non-decryption detection mainly analyze through session characteristics, spatiotemporal characteristics, etc., and cannot deeply unpack and check the core encrypted content. The false alarm rate can even be as high as 10% or more in a complex network environment. Non-decryption detection is difficult to provide effective evidence to explain the root cause of the alarm, which is not conducive to alarm judgment and further correlation analysis, and brings difficulties to subsequent investigation and processing. Traditional bypass decryption has great limitations and can only decrypt RSA encryption algorithms below TLS1.2, and is powerless for encryption algorithms such as elliptic curves. And with the large-scale popularization of TLS1.3, RSA encryption algorithms are gradually abandoned, and the availability of traditional bypass decryption technology is even lower. Although man-in-the-middle decryption of all traffic on the gateway device can achieve complete decryption, the decryption process involves complex mathematical operations, which consumes a lot of time and computing resources, and is prone to network fluctuations, delays, and even denial of service, affecting the real-time and continuity of the business. Normal encrypted traffic and malicious traffic may be very similar in some features, and it is difficult to accurately distinguish them by relying solely on traffic feature matching. Faced with evolving encryption technologies and new attack methods, such as highly concealed malicious sniffing, brute force cracking, APT attacks, etc. using encrypted channels, detection technology may lag behind and fail to detect and defend in a timely and effective manner. In certificate forgery detection, there are issues such as certificate validity, revocation mechanism, and complexity of certificate chain verification; man-in-the-middle attack detection faces challenges such as interference from legitimate nodes, differences in encryption algorithms, and complexity of traffic features, all of which increase the difficulty of detecting encrypted traffic attacks. Therefore, it is urgent to build a solution that can detect and protect against encrypted traffic attacks in a timely and accurate manner. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides an encrypted traffic attack detection method and system based on deep learning to solve the problems mentioned in the background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides an encrypted traffic attack detection method based on deep learning, comprising: obtaining real-time encrypted traffic data of a power system, and performing feature extraction on the encrypted traffic data;

[0009] Constructing an attack chain knowledge graph, matching the extracted features with the attack chain knowledge graph, and inputting the matched features into a pre-trained first detection model for classification;

[0010] The first classification result is reconfirmed by a second detection model to generate a final detection result.

[0011] As a preferred solution of the encrypted traffic attack detection method based on deep learning described in the present invention, it also includes: when the detected traffic data is suspicious traffic, triggering the system to generate an alarm signal with alarm information, and executing preset security response measures;

[0012] Feedback the results of each detection to the attack chain knowledge graph and update the relevant nodes and edges in the graph.

[0013] As a preferred solution of the encrypted traffic attack detection method based on deep learning described in the present invention, obtaining real-time encrypted traffic data of the power system includes: network traffic data, system logs and other relevant context information.

[0014] As a preferred solution of the encrypted traffic attack detection method based on deep learning described in the present invention, wherein: extracting features from the encrypted traffic data includes: extracting features from the encrypted traffic data using a fast Fourier transform deep learning network structure based on multi-scale feature fusion;

[0015] The encrypted traffic data is divided into a training set and a test set, feature maps of different scales are generated through a feature extraction network, the feature maps of different scales are respectively input into a residual attention module, a channel attention map is calculated through the residual attention module, and the updated feature map is obtained by multiplying the channel attention map with the original feature map; important features are optimized through a channel attention mechanism and a spatial attention mechanism;

[0016] The feature map processed by the residual attention module is divided into blocks and linearly mapped into embedding vectors, which are input into the feature fusion module for cross-scale feature fusion and output feature vectors of multi-level features, which represent the key characteristics of encrypted traffic.

[0017] As a preferred solution of the deep learning-based encrypted traffic attack detection method described in the present invention, matching the extracted features with the attack chain knowledge graph includes: mapping entities and their relationships in the traffic data, matching behavior patterns based on timestamps, and performing subgraph matching using a graph database query language to find the attack pattern most similar to the current traffic features.

[0018] As a preferred solution of the encrypted traffic attack detection method based on deep learning described in the present invention, the matched features are input into the pre-trained first detection model, and a classification is performed, including:

[0019] The first detection model outputs a probability distribution based on the input sample and distinguishes normal traffic from suspicious traffic based on a preset threshold;

[0020] If the current traffic probability exceeds the preset threshold, it is classified as suspicious traffic; if the current traffic probability does not exceed the preset threshold, it is classified as normal traffic.

[0021] As a preferred solution of the encrypted traffic attack detection method based on deep learning described in the present invention, wherein: the primary classification result is secondary confirmed by the second detection model to generate the final detection result, including:

[0022] The primary classification result is integrated with the original traffic feature, and the integrated feature set is input into the second detection model, and the second detection model outputs a new probability distribution to determine the secondary classification result;

[0023] Integrate the classification results of the first detection model and the second detection model to generate a new comprehensive probability distribution, calculate the confidence score of each prediction, and use uncertainty estimation technology to comprehensively analyze the reliability of the results, generate the final classification decision, and trigger corresponding alarms and response measures.

[0024] In a second aspect, the present invention provides an encrypted traffic attack detection system based on deep learning, comprising: a data acquisition and processing module, for acquiring real-time encrypted traffic data of a power system, and performing feature extraction on the encrypted traffic data;

[0025] A graph matching module, used to construct an attack chain knowledge graph, match the extracted features with the attack chain knowledge graph, input the matched features into a pre-trained first detection model, and perform a classification;

[0026] The detection module is used to perform a second confirmation on the primary classification result through a second detection model to generate a final detection result.

[0027] In a third aspect, the present invention provides an electronic device, comprising:

[0028] Memory and processor;

[0029] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the encrypted traffic attack detection method based on deep learning are implemented.

[0030] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the deep learning-based encrypted traffic attack detection method.

[0031] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention significantly improves the accuracy of abnormal instruction recognition, reduces the false alarm rate, can efficiently process massive data, reduces labor costs, shortens data processing time, has good adaptability, can dynamically adjust the detection model, and timely discover and identify new attack modes, providing reliable and lasting protection for network security, and is particularly suitable for the power industry with extremely high security requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0033] Figure 1 A schematic diagram of a method flow of a method and system for detecting encrypted traffic attacks based on deep learning according to an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of the structure of a gated recurrent unit model of an encrypted traffic attack detection method and system based on deep learning according to an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of the structure of a supplementary gated recurrent unit model of an encrypted traffic attack detection method and system based on deep learning according to an embodiment of the present invention;

[0036] Figure 4 A schematic diagram of the Transformer architecture of a method and system for detecting encrypted traffic attacks based on deep learning according to an embodiment of the present invention;

[0037] Figure 5 A schematic diagram of a multi-scale feature fusion Transformer structure of an encrypted traffic attack detection method and system based on deep learning according to an embodiment of the present invention;

[0038] Figure 6 A schematic diagram of the residual attention module structure of a deep learning-based encrypted traffic attack detection method and system described in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0041] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0042] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0043] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0044] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0045] Example 1

[0046] Reference Figure 1 to Figure 6 , is an embodiment of the present invention, which provides an encrypted traffic attack detection method based on deep learning, including:

[0047] S100: Obtaining real-time encrypted flow data of the power system and performing feature extraction on the encrypted flow data;

[0048] S200: construct an attack chain knowledge graph, match the extracted features with the attack chain knowledge graph, input the matched features into the pre-trained first detection model, and perform a classification;

[0049] S300: Perform a second confirmation on the first classification result through the second detection model to generate a final detection result.

[0050] It should be noted that in today's network security field, improving the accuracy of identifying abnormal instructions and reducing the false alarm rate are crucial goals, which have a direct and critical impact on improving the efficiency of attack detection. This application can perform in-depth analysis of complex and changeable encrypted traffic data. By learning and understanding the characteristics of massive data, abnormal instruction signals hidden under the appearance of normal traffic can be accurately captured. Compared with traditional detection methods, it is no longer limited to simple rule setting and feature matching, but analyzes data from a more macro and in-depth perspective, thereby effectively reducing false alarms caused by rigid rules or imperfect feature libraries, so that attack detection can be more efficient and accurate.

[0051] From the perspective of technical and economic feasibility, this application uses a combination of deep learning and machine learning algorithms. In the process of processing massive encrypted traffic data, there is no need to invest a lot of manpower in tedious manual analysis and screening, which greatly reduces labor costs. At the same time, due to the high efficiency of the algorithm, the time required for data processing is also greatly shortened, and work efficiency is improved. Traditional rule and feature matching methods often require a lot of manpower and time to build a rule base and update the feature base, and are prone to inefficiency when processing large-scale data.

[0052] In response to the challenges of emerging new attack methods, with the rapid development of network technology, attack methods are becoming increasingly complex and diverse. Traditional detection methods often rely on pre-set rules and fixed feature libraries and are difficult to quickly respond to new attacks. This application can dynamically adjust the detection model through continuous self-learning and optimization, timely discover and identify attack patterns, and automatically update model parameters according to the emerging attack data characteristics, so as to always maintain keen insight and efficient detection capabilities for various types of attacks, providing more reliable and lasting protection for network security.

[0053] In the embodiment of the present application, it also includes: when the detected traffic data is suspicious traffic, the trigger system generates an alarm signal with alarm information, and executes a preset security response measure;

[0054] Feedback the results of each detection to the attack chain knowledge graph and update the relevant nodes and edges in the graph.

[0055] In an optional embodiment, the preset security response measures may include isolating suspicious devices, blocking specific connections, etc.

[0056] In an embodiment of the present application, real-time encrypted flow data of the power system is obtained, including: network flow data, system logs, and other relevant context information.

[0057] In an optional embodiment, other relevant context information may also include system logs, user activity records, etc.

[0058] It should be noted that cleaning preprocessing is required before feature extraction of encrypted traffic data.

[0059] In an embodiment of the present application, extracting features from encrypted traffic data includes: extracting features from encrypted traffic data using a fast Fourier transform deep learning network structure based on multi-scale feature fusion;

[0060] The encrypted traffic data is divided into a training set and a test set. Feature maps of different scales are generated through the feature extraction network. The feature maps of different scales are respectively input into the residual attention module. The channel attention map is calculated by the residual attention module and multiplied with the original feature map to obtain the updated feature map. Important features are optimized through the channel attention mechanism and the spatial attention mechanism.

[0061] The feature map processed by the residual attention module is divided into blocks and linearly mapped into embedding vectors. The embedding vectors are input into the feature fusion module for cross-scale feature fusion, and the feature vectors of multi-level features are output. The feature vectors represent the key characteristics of encrypted traffic.

[0062] In an optional embodiment, in order to perform holographic intelligent cognition of cryptographic applications, a deep learning algorithm is used to analyze and identify the cleaned ciphertext data. The design adopts a cryptographic protocol and digital certificate intelligent cognition solution based on a bidirectional gated recurrent unit model GRU structure (supplementary gated recurrent unit model SGRU) to identify the specific cryptographic protocol type used by each ciphertext data, including network layer encryption protocol, transport layer encryption protocol, etc., and analyze the specific information of the digital certificate used. The analysis of encrypted data includes the following steps:

[0063] B1: Initialize and normalize the data set, and divide the processed data into training set and test set;

[0064] B2: Input the training set into the SGRU-based cryptographic protocol and digital certificate intelligent cognitive model and train it n times;

[0065] B3: Input the test set into the trained SGRU-based cryptographic protocol and digital certificate intelligent cognitive model to obtain the cryptographic protocol and digital certificate feature value S;

[0066] B4: Compare the cryptographic protocol with the digital certificate characteristic value S and the true label of the cryptographic protocol to obtain the corresponding comparison result R.

[0067] The algorithm of the SGRU-based cryptographic protocol and digital certificate intelligent recognition scheme is shown in Table 1:

[0068] Table 1 Cryptographic protocols and digital certificate intelligent recognition scheme based on SGRU

[0069]

[0070]

[0071] It should be noted that in order to solve the problem of invalid transmission of long-term memory information and gradient vanishing in back propagation, the existing method designed a new convolutional neural network - GRU. Specifically, GRU has two gate structural units: reset gate R t and update gate Z t ,like Figure 2 As shown. Reset gate R t It is used to control the hidden state information flow from the previous moment of the current candidate set to the current candidate hidden state moment. Update gate Z t It is used to control how much irrelevant content in the current candidate state needs to be forgotten at the previous moment and decide how much of the current candidate set hidden state is retained.

[0072] First, in GRU, the previous information h t-1 and current information t To define the reset gate and update gate, as shown below:

[0073] R t =σ(W R ·[h t-1 ,x t ])

[0074] Z t =σ(W Z ·[h t-1 ,x t ])

[0075] Secondly, the candidate set of GRU can be controlled by resetting the gate. The formula is as follows:

[0076]

[0077] Again, in the memory update phase, GRU updates h by the following formula t :

[0078]

[0079] Finally, the output of the forward propagation is y t , the following formula can be used to calculate y t :

[0080] y t =softmax(W 0 ·h t )

[0081] Generally speaking, GRU can learn representations based on the temporal characteristics of network traffic data. However, GRU contains a large number of nonlinear transformations, which may cause feature information loss when learning network traffic data. Therefore, a new neural network model based on GRU is designed, namely, the supplementary gated recurrent unit, such as Figure 3 As shown in Figure 2. Different from the original GRU, SGRU uses the loss compensation principle to mitigate the loss of feature information during GRU nonlinear transformation. Therefore, SGRU has better advantages in learning and characterizing current large-scale network traffic data.

[0082] The SGRU model contains two GRUs: OGRU and DGRU. In SGRU, OGRU is used to represent the learning input data, and DGRU is used to decode and recover the feature data after OGRU represents the learning data. input represents the input data, x t Represents the data after OGRU learning, x out Indicates the data recovered by DGRU, l c Represents feature loss. The specific implementation process of SGRU is as follows:

[0083] First, use OGRU to complete the representation learning of the input data and get x t The specific formula is as follows:

[0084] x t =OGRU(x input )

[0085] Second, use DGRU to recover x t , we get x out . Then, use x input Subtract x out , get the loss data l c The formula is as follows:

[0086] x out =OGRU(x t )

[0087] l c =x input -x out

[0088] Finally, OGRU is repeated to obtain the loss compensation data l cout , loss data l cout Can be represented and learned.

[0089] After that, l cout Add to x t , at this time, in x t The feature loss information in can be supplemented, thereby improving the accuracy of password recognition. The formula is as follows:

[0090] l cout =OGRU(l c )

[0091] x t =x t +l cout

[0092] Among them, the existing cryptographic protocol identification features are mainly the following aspects: port-based identification method: identification with the help of the protocol default port number, not applicable to protocols using dynamic ports; payload content-based identification method: identification by matching protocol keywords, not applicable to the case where the protocol message is fully encrypted, and there is a lag in the identification of new protocols; traffic statistical feature-based identification method: network flows of the same protocol have similar statistical features, and the protocol can be identified based on the traffic statistical features of the network message. Most of these methods use machine learning technology and can identify fully encrypted protocols, but their accuracy and robustness are lower than those based on payload content.

[0093] In an optional embodiment, if Figures 4 to 6As shown in the figure, the FFT network structure based on the multi-scale feature fusion Transformer includes three main parts: a) traffic feature extraction network; b) residual attention module; c) feature fusion module (FFTBlock). Specifically, the traffic data is input into the feature extraction network ResNet, and four feature layers are output on four stages. The low-level details are rich, while the high-level semantic information is rich. Different feature layers are input into the residual attention module respectively so that the network can select the feature channels and feature regions of interest. Finally, the feature map is divided into blocks and linearly mapped into an embedding vector and input into FFTBlock for feature fusion. The final embedding vector contains both high-level semantic information and the fine feature information in the low-level feature map, providing richer and more effective fusion features for encrypted traffic identification. The model uses ResNet as the feature extraction network for target identification to extract the feature map of encrypted traffic. The adaptive average pooling layer and the fully connected layer in the ResNet network are removed, and only the convolutional layer of feature extraction is used. The feature maps at different stages have feature information of different scales. In order to avoid excessive model complexity, only the last three feature maps are input into FFTBlock for feature fusion. In addition, to improve the robustness of the model, each feature map is input into the RAM module separately to emphasize the feature channels and feature regions that the network focuses on, and keep the feature dimension unchanged.

[0094] By placing the channel attention module and the spatial attention module in front and behind, the convolutional feature map F∈R is extracted. C×H×W After that, the RAM module first learns the channel attention map CA(F)∈R C×1×1 , and then multiply it with the original feature map by weight, and obtain the feature F through matrix multiplication ′ ∈R C×Hm×Wm , and then F ′ Input the spatial attention module and calculate the spatial attention map SA(F ′ )∈R 1 ×Hm×Wm , SA(F ′ ) and F ′ Element multiplication is used to obtain the new feature map. In addition, the residual operation is introduced to enable the model to aggregate better. The calculation process can be summarized as follows:

[0095]

[0096] It should be noted that for some traffic data that cannot be accurately identified as safe or dangerous, an attack chain knowledge graph based on the time sequence diagram is constructed based on the sensitive instruction set of the power grid system and the ATT&CK framework. The ATT&CK framework is a tool widely used to describe and classify network attack methods, and the attack chain knowledge graph can vividly depict the time sequence and logical structure of the attack behavior. In this way, complex traffic data can be converted into structured knowledge, and potential attack behaviors can be analyzed more deeply and accurately.

[0097] Specifically, the process of building the attack chain knowledge graph includes the following steps:

[0098] A1: Extract the relationship between entities according to different attack scenarios to form preliminary structured knowledge.

[0099] It should be noted that this step requires a lot of expertise and experience, because different attack scenarios may involve different entities and relationship types, and algorithms are designed to integrate these structured knowledge together to establish a comprehensive knowledge base to dynamically track and identify attack behaviors, providing rich reference information for subsequent traffic analysis and attack detection.

[0100] A2: After the knowledge base is built, machine learning algorithms such as XGBoost, LightGBM, and RandForest are used for modeling to identify abnormal instructions.

[0101] It should be noted that machine learning algorithms have shown excellent performance in many classification and regression tasks, and are therefore very suitable for detecting complex and variable encrypted traffic attacks. By training a large amount of normal and abnormal traffic data, a model that can automatically identify and intercept potential attacks can be built.

[0102] In an embodiment of the present application, matching the extracted features with the attack chain knowledge graph includes: mapping entities and their relationships in the traffic data, matching behavior patterns based on timestamps, and performing subgraph matching using a graph database query language to find the attack pattern that is most similar to the current traffic features.

[0103] In the embodiment of the present application, the matched features are input into the pre-trained first detection model, and a classification is performed including:

[0104] The first detection model outputs a probability distribution based on the input sample and distinguishes normal traffic from suspicious traffic based on a preset threshold;

[0105] If the current traffic probability exceeds the preset threshold, it is classified as suspicious traffic; if the current traffic probability does not exceed the preset threshold, it is classified as normal traffic.

[0106] In an optional embodiment, the first detection model in the embodiment of the present application can be based on the Vision Transformer algorithm for detection. Vision Transformer has the ability to extract and identify traffic features in complex environments by learning to recognize and process large-scale data, which helps to quickly and accurately detect abnormal traffic in massive data streams, thereby improving the efficiency of attack protection.

[0107] In the embodiment of the present application, the first classification result is confirmed twice by the second detection model to generate the final detection result, including:

[0108] The first classification result is integrated with the original traffic feature, and the integrated feature set is input into the second detection model. The second detection model outputs a new probability distribution to determine the second classification result;

[0109] Integrate the classification results of the first detection model and the second detection model to generate a new comprehensive probability distribution, calculate the confidence score of each prediction, and use uncertainty estimation technology to comprehensively analyze the reliability of the results, generate the final classification decision, and trigger corresponding alarms and response measures.

[0110] Example 2

[0111] The above embodiment is a schematic scheme of an encrypted traffic attack detection method based on deep learning. It should be noted that the technical scheme of the encrypted traffic attack detection system based on deep learning and the technical scheme of the encrypted traffic attack detection method based on deep learning belong to the same concept. The details of the technical scheme of the encrypted traffic attack detection system based on deep learning in this embodiment that are not described in detail can be found in the description of the technical scheme of the encrypted traffic attack detection method based on deep learning.

[0112] In this embodiment, an encrypted traffic attack detection system based on deep learning includes:

[0113] A data acquisition and processing module is used to obtain real-time encrypted flow data of the power system and perform feature extraction on the encrypted flow data;

[0114] A graph matching module is used to construct an attack chain knowledge graph, match the extracted features with the attack chain knowledge graph, and input the matched features into the pre-trained first detection model for classification;

[0115] The detection module is used to perform a second confirmation on the primary classification result through a second detection model to generate a final detection result.

[0116] This embodiment further provides an electronic device, which is applicable to the case of the encrypted traffic attack detection method based on deep learning, including:

[0117] Memory and processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the encrypted traffic attack detection method based on deep learning as proposed in the above embodiment.

[0118] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the encrypted traffic attack detection method based on deep learning as proposed in the above embodiment is implemented.

[0119] The storage medium proposed in this embodiment and the method for implementing encrypted traffic attack detection based on deep learning proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0120] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0121] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting encrypted traffic attacks based on deep learning, characterized in that: include: Acquire real-time encrypted flow data of the power system, and perform feature extraction on the encrypted flow data; Constructing an attack chain knowledge graph, matching the extracted features with the attack chain knowledge graph, and inputting the matched features into a pre-trained first detection model for classification; The first classification result is reconfirmed by a second detection model to generate a final detection result.

2. The method for detecting encrypted traffic attacks based on deep learning according to claim 1, characterized in that: Also includes: When the detected traffic data is suspicious traffic, the system is triggered to generate an alarm signal with alarm information and execute the preset security response measures; Feedback the results of each detection to the attack chain knowledge graph and update the relevant nodes and edges in the graph.

3. The method for detecting encrypted traffic attacks based on deep learning as claimed in claim 2, characterized in that: Obtaining real-time encrypted traffic data of the power system includes: network traffic data, system logs, and other relevant contextual information.

4. The method for detecting encrypted traffic attacks based on deep learning as claimed in claim 3, characterized in that: Extracting features from the encrypted traffic data includes: extracting features from the encrypted traffic data using a fast Fourier transform deep learning network structure based on multi-scale feature fusion; The encrypted traffic data is divided into a training set and a test set, feature maps of different scales are generated through a feature extraction network, the feature maps of different scales are respectively input into a residual attention module, a channel attention map is calculated through the residual attention module, and the updated feature map is obtained by multiplying the channel attention map with the original feature map; important features are optimized through a channel attention mechanism and a spatial attention mechanism; The feature map processed by the residual attention module is divided into blocks and linearly mapped into embedding vectors, which are input into the feature fusion module for cross-scale feature fusion and output feature vectors of multi-level features, which represent the key characteristics of encrypted traffic.

5. The method for detecting encrypted traffic attacks based on deep learning as claimed in claim 4, characterized in that: Matching the extracted features with the attack chain knowledge graph includes: mapping entities and their relationships in the traffic data, matching behavioral patterns based on timestamps, and performing subgraph matching using a graph database query language to find the attack pattern most similar to the current traffic features.

6. The method for detecting encrypted traffic attacks based on deep learning as claimed in claim 5, characterized in that: The matched features are input into the pre-trained first detection model, and a classification is performed including: The first detection model outputs a probability distribution based on the input sample and distinguishes normal traffic from suspicious traffic based on a preset threshold; If the current traffic probability exceeds the preset threshold, it is classified as suspicious traffic; if the current traffic probability does not exceed the preset threshold, it is classified as normal traffic.

7. The method for detecting encrypted traffic attacks based on deep learning according to claim 6, characterized in that: The first classification result is confirmed again by the second detection model to generate a final detection result, which includes: The primary classification result is integrated with the original traffic feature, and the integrated feature set is input into the second detection model, and the second detection model outputs a new probability distribution to determine the secondary classification result; Integrate the classification results of the first detection model and the second detection model to generate a new comprehensive probability distribution, calculate the confidence score of each prediction, and use uncertainty estimation technology to comprehensively analyze the reliability of the results, generate the final classification decision, and trigger corresponding alarms and response measures.

8. An encrypted traffic attack detection system based on deep learning, characterized in that: include: A data acquisition and processing module is used to obtain real-time encrypted flow data of the power system and perform feature extraction on the encrypted flow data; A graph matching module, used to construct an attack chain knowledge graph, match the extracted features with the attack chain knowledge graph, input the matched features into a pre-trained first detection model, and perform a classification; The detection module is used to perform a second confirmation on the primary classification result through a second detection model to generate a final detection result.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the deep learning-based encrypted traffic attack detection method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the deep learning-based encrypted traffic attack detection method described in any one of claims 1 to 7.

Images