Network security detection method based on big data

Abstract

The invention discloses a network security detection method based on big data, relates to the technical field of network security, and aims to solve the problems that a high-end fraud means at present is to fraud a target by using friend WeChat and other chat tools through AI face changing and voiceprint technologies, and ordinary people cannot recognize whether the opposite side is a real person or not. Comprising the following steps: step 1, data collection: collecting network traffic data through a network data packet capture tool, log recording and the like; 2, data processing: processing and analyzing the collected data by using a big data technology; 3, data preprocessing: preprocessing the audio or video extracted by the network security detection system; step 4, data cleaning: carrying out defuzzification processing on the audio or the video input into the network security detection system; and step 5, feature extraction: the convolutional neural network technology analyzes videos and audios, so that the detection effect is improved, network security threats can be quickly identified and processed through real-time detection and threat response, and the network security is protected.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security detection method based on big data. Background Art

[0002] Network security is a very important field in today's society. A large amount of personal and corporate information is stored on the Internet. Therefore, the development of network security detection methods has become increasingly critical. This patent provides a network security detection method based on big data, which aims to improve the reliability and efficiency of network security. At present, high-end fraud methods use chat tools such as friends' WeChat to defraud the target through AI face-changing and voiceprint technology. For ordinary people, video verification is enough to prove that it is the person himself. If fraud is carried out on this basis, most people will believe it and then lose money. Therefore, it is necessary to design a network security detection method based on big data. Summary of the invention

[0003] The purpose of the present invention is to provide a network security detection method based on big data to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security detection method based on big data, comprising: Step 1: Data collection: Collect network traffic data through network packet capture tools and logging. Step 2: Data processing: Use big data technology to process and analyze the collected data; Step 3: Data preprocessing: preprocessing the audio or video extracted by the network security detection system; Step 4: Data cleaning: defuzzification of audio or video input into the network security detection system; Step 5: Feature extraction: Convolutional neural network technology is used to analyze the video and audio.

[0005] According to the above technical solution, the specific method of using step 1 is: In the data collection step, the convolutional neural network data needs to be input into the network security detection system. During the video or audio period, manual selection and confirmation are made as to whether to extract video and audio features. After manual confirmation, the network security detection system extracts the audio or video being executed and transmits the extracted audio or video to the network security detection system. The convolutional neural network technology extracts features from the video and audio to extract key visual and audio features.

[0006] According to the above technical solution, the data processing includes data preprocessing, data cleaning, and feature extraction.

[0007] According to the above technical solution, the data preprocessing includes noise reduction, sampling, and normalization to improve the effect of subsequent processing.

[0008] According to the above technical solution, the specific method of using step 4 is: Correct the unclear and weak audio parts to normal state, provide a good environment for subsequent audio detection, and de-code the coded parts in the video. At the same time, in a video, the network security detection system is used to extract the lip shape of the characters in the video, and the convolutional neural network technology is used to compare the lip shape and audio data. The audio in the video and the character's lip shape are aligned to correct the video to normal state.

[0009] According to the above technical solution, the specific method of using step 5 is: The audio and video are divided into several different databases, each of which stores a piece of audio or video data, and each database is labeled. The labels are mainly divided into lip shape, tremor rate, timbre, articulation, and facial expressions.

[0010] According to the above technical solution, an AI learning robot system is implanted in network security detection. The AI ​​learning robot system is used to learn the algorithm and perform feature extraction and resolution on the processed data to establish a network security detection model. During the training process, we use cross-validation and data set partitioning techniques to avoid overfitting problems.

[0011] According to the above technical solution, the trained network security detection model is applied to real-time network traffic detection, and the network traffic is classified and detected in real time to determine whether there is a threat. The data that generates the threat is secondary verified. That is, recurrent neural network technology is implanted at the bottom of the network security detection model to perform secondary classification of the extracted features to determine whether the input video and audio are false data. If they are false data, the threatening instructions will be deleted and the account will be marked.

[0012] According to the above technical solution, when a threat is detected, corresponding measures are taken to respond, including blocking traffic, issuing alarms, and tracking events.

[0013] According to the above technical scheme, the network security detection system is divided into automatic detection and independent detection. Automatic detection is to input a large amount of video data or audio data, and the network security detection system automatically detects the audio and video, and marks the database with the detection results as threatening. Independent detection is to input personal real audio and video, personal suspicious audio and video into the network security detection system, and divide the real audio and video into several databases through convolutional neural network technology, and transfer them to the AI ​​learning robot system.

[0014] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a network security detection system and an AI learning robot system, can process massive amounts of network traffic data using the network security detection system, thereby improving detection efficiency and accuracy; the AI ​​learning robot system is used for model training, and can automatically learn the characteristics of network security threats, thereby improving detection effects; real-time detection and threat response can quickly identify and process network security threats, thereby protecting network security; traditional video and audio detection methods often rely on manual analysis and judgment, and are difficult to meet the processing requirements of large-scale data; when a large amount of video data or audio data needs to be detected to determine whether it constitutes fraud or other problems, the network security detection system implanted with the AI ​​learning robot system can automatically learn virtual audio and video features, thereby reducing manual intervention, and can adapt to the processing requirements of large-scale data. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 It is a schematic diagram of the detection method of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] See also Figure 1 The present invention provides a technical solution: a network security detection method based on big data, which adopts a network security detection method based on big data. The method is divided into the following steps: Data collection: Collect network traffic data through network packet capture tools and log records. In the data collection step, the convolutional neural network data needs to be input into the network security detection system. During the video or audio period, manual selection and confirmation are made whether to extract video and audio features. After manual confirmation, the network security detection system extracts the audio or video being executed and transmits the extracted audio or video to the network security detection system. The convolutional neural network technology extracts features from the video and audio to extract key visual and audio features. If there is no audio or video being executed, the data of the audio or video to be detected will be transmitted to the network security detection system.

[0018] Data processing: Use big data technology to process and analyze the collected data, including data preprocessing, data cleaning, feature extraction and other operations; Data preprocessing: preprocessing the audio or video extracted by the network security detection system, including noise reduction, sampling, normalization and other operations to improve the effect of subsequent processing; Data cleaning: defuzzify the audio or video input into the network security detection system, correct the unclear and weak audio parts to normal, provide a good environment for the subsequent audio detection, and de-code the coded parts in the video. At the same time, in a video, the network security detection system extracts the lip shape of the characters in the video, and the convolutional neural network technology compares the lip shape with the audio data, and aligns the audio in the video with the lip shape of the characters to correct the video to normal. Feature extraction: Convolutional neural network technology is used to analyze video and audio, and the audio and video are divided into several different databases. Each database stores a piece of audio or video data, and each database is labeled. The major types of labels are lip shape, tremor rate, timbre, articulation, and facial expression. The major categories of mouth shape include the lip arc, lip opening range, and number of exposed teeth. The lip arc refers to the lip opening arc. Individuals speak habitually. When pronouncing a single word, the lip opening range is the upper and lower opening range of the mouth. When pronouncing a single word, the upper and lower opening range of the lips is fixed. The number of exposed teeth refers to the number of teeth exposed by an individual due to pronunciation when pronouncing some single words or words. The tremor rate includes the audio tremor value, the video lip flap shaking frequency, and the pronunciation speed. The pronunciation emotions are divided into happy, sad, and normal. The audio database is segmented and labeled through the network security detection system. If the audio is in a happy emotion, its pronunciation speed, audio tremor value, and video lip flap shaking frequency are recorded. If it is in a sad emotion, its pronunciation speed, audio tremor value, and video lip flap shaking frequency are recorded. If it is in a normal emotion, its pronunciation speed, audio tremor value, and video lip flap shaking frequency are recorded. Timbre includes audio loudness and pitch, and the loudness, frequency, and pitch of a single word pronunciation under different emotions. The pitch is divided into overall pitch and single word pitch. Overall pitch is the overall pitch value of a whole sentence, and single word pitch is the pitch value of a single word. Articulation includes single-word pronunciation habits and dialect recognition. Single-word pronunciation habits refer to the special facial changes or body movements when a person says a single word or a sentence. Dialect recognition refers to the identification of the audio dialect type and whether a single word or word group is pronounced in a dialect. Facial expressions include ears, eyeballs, nose, forehead, cheeks, and chin, and the movement of the above parts when a person pronounces, such as the rotation of the eyeballs, the frequency of nose twitching, the movement of forehead skin lines, the movement of cheek muscles, the movement of the chin, and the movement of the ears; The network security detection system is divided into automatic detection and independent detection. Automatic detection is to input a large amount of video data or audio data. The network security detection system automatically detects the audio and video and marks the detection results as threatening databases. Independent detection is to input personal real audio and video, personal suspicious audio and video into the network security detection system, and divide the real audio and video into several databases through convolutional neural network technology. Transfer it to the AI ​​learning robot system, and the AI ​​learning robot system efficiently learns the real audio and video database. At the same time, it requires others or individuals to enter the time when this audio and video are generated, and the facial and voice changes of the audio and video producers before and after this period of time into the network security detection system. For example, in the audio Before the audio or video is generated, the person who produced the audio or video has undergone facial or vocal surgery or other actions that affect the face or voice. This can assist the AI ​​learning robot system in identifying whether the audio or video is threatening. The suspicious audio and video are also divided into several databases, waiting for the AI ​​learning robot system to detect. The AI ​​learning robot system compares the video images in the suspicious database one by one through database notes. If there is a change, the database will be marked as a first-level database, waiting for manual intervention detection. If there are multiple changes, the database will be marked as a second-level database. The threat of a first-level database is less than that of a second-level database, which is convenient for sorting during manual screening. Manual detection of the second-level database is given priority to check the database with high threat.

[0019] Model training: We implant AI learning robot systems into network security detection, use AI learning robot systems to learn algorithms and perform feature extraction and discrimination on processed data to establish network security detection models. During the training process, we use cross-validation and data set partitioning techniques to avoid overfitting problems.

[0020] Model application: Apply the trained network security detection model to real-time network traffic detection, classify and detect network traffic in real time, determine whether there is a threat, and perform secondary verification on the data that generates the threat. That is, implant recurrent neural network technology at the bottom of the network security detection model to perform secondary classification of the extracted features, determine whether the input video and audio are false data, and if so, delete the threatening instructions and mark the account.

[0021] Threat response: When a threat is detected, appropriate measures are taken to respond, including blocking traffic, issuing alerts, and conducting event tracking.

[0022] The network security detection system can process massive amounts of network traffic data, improving detection efficiency and accuracy. The AI ​​learning robot system is used for model training, which can automatically learn the characteristics of network security threats and improve detection results. Real-time detection and threat response can quickly identify and handle network security threats and protect network security. Traditional video and audio detection methods often rely on manual analysis and judgment, and it is difficult to meet the processing needs of large-scale data. When there is a large amount of video data or audio data that needs to be detected to see if it constitutes fraud, the network security detection system implanted with the AI ​​learning robot system can automatically learn virtual audio and video features, reduce manual intervention, and adapt to the processing needs of large-scale data.

[0023] The above network security detection system is implanted in personal mobile terminals or PC terminals. When the mobile audio or video involves words related to money transfer, the network security detection system automatically identifies the words contained in this sentence and detects whether the person who produced this audio or video is real. If the detection result shows that the audio or video is threatening, the mobile terminal user is simultaneously reminded that this conversation or video is threatening and needs to be confirmed in person.

[0024] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0025] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security detection method based on big data, characterized in that: include: Step 1: Data collection: Collect network traffic data through network packet capture tools and log recording methods, input convolutional neural network data into the network security detection system, and manually select and confirm whether to extract video and audio features during video or audio. After manual confirmation, the network security detection system extracts the audio or video being executed, and transmits the extracted audio or video to the network security detection system. The convolutional neural network technology extracts features from the video and audio, extracts key visual and audio features, and if there is no audio or video being executed, the audio or video data to be detected is transmitted to the network security detection system; Step 2: Data processing: Use big data technology to process and analyze the collected data. The data processing includes data preprocessing, data cleaning, and feature extraction. Step 3: Data preprocessing: preprocessing the audio or video extracted by the network security detection system, including noise reduction, sampling, and normalization operations, to improve the effect of subsequent processing; Step 4: Data cleaning: defuzzify the audio or video input into the network security detection system, correct the unclear and weak audio parts to normal, provide a good environment for the subsequent audio detection, and decode the coded parts in the video. At the same time, in a video, the network security detection system extracts the lip shape of the characters in the video, and the convolutional neural network technology compares the lip shape with the audio data, and aligns the audio in the video with the lip shape of the characters to correct the video to normal. Step 5: Feature extraction: Convolutional neural network technology is used to analyze the video and audio, and the audio and video are divided into several different databases. Each database stores a piece of audio or video data, and each database is labeled. The major types of labels are lip shape, tremor rate, timbre, articulation, and facial expression. We implanted AI learning robot systems into network security detection, used AI learning robot systems to learn algorithms and extract and distinguish features from processed data to build network security detection models. During the training process, we used cross-validation and data set partitioning techniques to avoid overfitting problems. Apply the trained network security detection model to real-time network traffic detection, classify and detect network traffic in real time, determine whether there are threats, and perform secondary verification on the data that generates threats. That is, embed recurrent neural network technology at the bottom of the network security detection model to perform secondary classification on the extracted features, determine whether the input video and audio are false data, and if they are false data, delete the threat instructions and mark the account; When a threat is detected, take appropriate action to respond, including blocking traffic, issuing alerts, and conducting event tracing; The above network security detection system is implanted in personal mobile terminals or PC terminals. When the mobile audio or video involves transfer-related sentences and words, the network security detection system automatically identifies the sentence and detects whether the person who produced the audio or video is real. If the detection result shows that the audio or video is threatening, the mobile terminal user is simultaneously reminded that the conversation or video is threatening and needs to be confirmed in person.

Images