Active defense method and device for interactive network malicious intrusion and storage medium

Abstract

The invention discloses an interactive network malicious intrusion active defense method and device and a storage medium, belongs to the technical field of information security, and particularly relates to active defense of interactive network malicious intrusion. The problems that an existing intrusion detection method and an existing active defense system often do not fully consider requirements in a specific network environment, difficulty exists in the aspects of function adjustment and configuration updating, namely, the existing intrusion detection method and the existing active defense system cannot flexibly adapt to diversified intrusion types, fine classification and instant dynamic defense cannot be carried out, and misinformation and missing information exist are solved. The method comprises a step of adopting a malicious intrusion prevention model to calculate the posterior probability of the feature of each data packet in a data sample to malicious intrusion, and identifying the malicious intrusion in the network. The interactive network malicious intrusion active defense method and device and the storage medium are suitable for active defense of malicious intrusion.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to active defense against malicious intrusions in interactive networks. Background Art

[0002] With the rapid development of the digital age, widespread access to the Internet has made network security an unavoidable challenge. The inherent vulnerability of network information systems combined with the frequent online activities of users poses a serious threat to personal privacy, and cybercrime may lead to serious economic losses and information security crises. In this context, it is particularly important to seek effective protection strategies.

[0003] Existing intrusion detection methods include feature detection, statistical detection, and expert systems. The disadvantages of existing intrusion detection methods are: Due to the diversity of network environments and attack behaviors, existing intrusion detection methods and active defense systems often do not fully consider the needs of specific network environments, and have difficulties in function adjustment and configuration updates. That is, they cannot flexibly adapt to various intrusion types, and cannot perform fine classification and real-time dynamic defense, which leads to problems of false alarms and missed alarms. Summary of the invention

[0004] The present invention proposes an interactive network malicious intrusion active defense method, device and storage medium, which solves the problem that existing intrusion detection methods and active defense systems often do not fully consider the needs of specific network environments, have difficulties in function adjustment and configuration update, that is, they cannot flexibly adapt to various intrusion types, cannot perform fine classification and real-time dynamic defense, and thus have problems of false alarms and missed alarms.

[0005] The interactive network malicious intrusion detection method based on Bayesian decision-making of the present invention comprises the following steps: Steps for collecting data packets and flow information in the network; A step for preprocessing data packets and flow information to obtain frequency hopping data samples; A step for performing cluster analysis on frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A step for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A step for calculating the energy entropy increment and frequency domain mutual correlation coefficient of features representing malicious intrusion behavior, and screening out multiple effective malicious intrusion features; A step for performing feature enhancement and feature fusion on the screened effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; Steps for constructing a malicious intrusion defense model based on a comprehensive malicious intrusion feature description and prior probability using Bayesian decision theory; It is used to adopt malicious intrusion defense model, calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, and identify the steps of malicious intrusion in the network.

[0006] Further, a preferred embodiment is provided, wherein the preprocessing in the step of preprocessing the data packets and flow information to obtain the data samples includes data cleaning, flow reassembly and data standardization; The data cleaning is used to remove invalid or erroneous data packets; The traffic reassembly is used to group data packets according to sessions or flows; The data normalization is used to unify the dimensions of all features in the data package so that all features are on the same scale.

[0007] Further, a preferred implementation manner is provided, wherein the step of performing cluster analysis on the frequency hopping data samples to identify the frequency hopping data suspected of malicious intrusion comprises the following steps: A step for performing cluster analysis on the frequency hopping data samples by using a K-clustering algorithm, calculating the similarity and distance between data in the frequency hopping data samples, clustering data with similar characteristics together, and obtaining malicious intrusion data clusters of different categories; A step for constructing an interactive network malicious intrusion node distribution model according to different categories of malicious intrusion data clusters; the interactive network malicious intrusion node distribution model is used to divide the distribution positions and diffusion trends of different categories of malicious intrusion data clusters in the network; The invention is a step for identifying frequency hopping data suspected of malicious intrusion according to the distribution position and diffusion trend of different types of malicious intrusion data clusters in the network.

[0008] Further, a preferred embodiment is provided, wherein the method further comprises: It is used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

[0009] Further, a preferred embodiment is provided, wherein the step of calculating the energy entropy increment and frequency domain mutual correlation coefficient of the features representing the malicious intrusion behavior and screening out multiple valid malicious intrusion features comprises: A step for obtaining IMF components representing characteristics of malicious intrusion behavior and calculating energy results of each IMF component; A step for obtaining a normalized energy result of each IMF component according to the energy result of each IMF component; A step for obtaining an energy entropy increment value of each IMF component according to the normalized energy result of each IMF component; Used to obtain a power spectrum representing a feature of malicious intrusion behavior, and obtain a frequency domain mutual correlation coefficient of the feature representing the malicious intrusion behavior based on the power spectrum; The step of screening out multiple effective malicious intrusion features is performed using the energy entropy increment value of each IMF component and the frequency domain mutual correlation coefficient of the features representing the malicious intrusion behavior.

[0010] The present invention also proposes an interactive network malicious intrusion detection device based on Bayesian decision making, the device comprising the following modules: A module for collecting data packets and flow information in the network; A module for preprocessing data packets and flow information to obtain frequency hopping data samples; A module for clustering frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A module for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A module for calculating the energy entropy increment and frequency domain correlation coefficient of features representing malicious intrusion behavior, and screening out multiple valid malicious intrusion features; A module used to enhance and fuse the selected effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; A module for building a malicious intrusion defense model based on comprehensive malicious intrusion feature descriptions and prior probabilities using Bayesian decision theory; A module used to use a malicious intrusion defense model to calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, thereby determining whether the current network status is a malicious intrusion.

[0011] Further, a preferred embodiment is provided, wherein the device further comprises: A module used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

[0012] The present invention also proposes a computer device, comprising: a processor and a memory, wherein the memory is used to store executable instructions of the processor, and the processor is configured to execute any one of the above-mentioned interactive network malicious intrusion detection methods based on Bayesian decision-making by executing the executable instructions.

[0013] The present invention also proposes a computer storage medium, in which a computer program is stored. When the computer program is running, any one of the above-mentioned interactive network malicious intrusion detection methods based on Bayesian decision-making is executed.

[0014] The present invention also proposes a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of any one of the above-mentioned interactive network malicious intrusion detection methods based on Bayesian decision making.

[0015] The present invention has the following beneficial effects: 1. The interactive network malicious intrusion active defense method described in the present invention can accurately identify and resist potential malicious behaviors. The core concept of the method is to monitor network traffic in real time, analyze the behaviors therein, classify network behaviors into normal and abnormal, and implement defense strategies accordingly. Among them, the Bayesian (decision) algorithm plays a key role. It responds to changes in the network environment in real time through interactive learning and active defense, and has extremely high accuracy and processing efficiency.

[0016] 2. The interactive network malicious intrusion active defense method described in the present invention can effectively distinguish and defend against different types of intrusion behaviors, and can self-adjust to adapt to the evolving network threats.

[0017] The interactive network malicious intrusion active defense method, device and storage medium of the present invention are suitable for active defense against malicious intrusion. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of an interactive network malicious intrusion active defense method in one embodiment of the present invention; Figure 2 This is a network structure diagram of an interactive network in one embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to make the technical solutions and advantages of the present invention more clearly described, the specific implementation methods of the present invention will be further described in detail and completely in conjunction with the accompanying drawings. The various implementation methods described below are only part of the preferred solutions of the present invention, rather than all implementation methods; the various implementation methods described below are intended to explain the present invention and cannot be understood as limitations on the present invention; the reasonable combination of technical features defined in the various implementation methods of the present invention, and all other implementation methods obtained by ordinary technicians in the field without creative work based on the implementation methods of the present invention, are within the scope of protection of the present invention.

[0021] In one embodiment, an interactive network malicious intrusion detection method based on Bayesian decision making is provided, the method comprising the following steps: Steps for collecting data packets and flow information in the network; A step for preprocessing data packets and flow information to obtain frequency hopping data samples; A step for performing cluster analysis on frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A step for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A step for calculating the energy entropy increment and frequency domain mutual correlation coefficient of features representing malicious intrusion behavior, and screening out multiple effective malicious intrusion features; A step for performing feature enhancement and feature fusion on the screened effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; Steps for constructing a malicious intrusion defense model based on a comprehensive malicious intrusion feature description and prior probability using Bayesian decision theory; It is used to adopt malicious intrusion defense model, calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, and identify the steps of malicious intrusion in the network.

[0022] In this implementation, data packets and flow information in the network are collected, as follows: By deploying data collectors at key nodes in the network, data packets and traffic information in the network are collected.

[0023] In this implementation manner, the features representing malicious intrusion behavior include data packet size, frequency, protocol type, transmission time, and the like.

[0024] In this implementation manner, the effective malicious intrusion feature component is the feature component that is most sensitive to malicious intrusion behavior.

[0025] In this implementation, feature enhancement is performed on the screened effective malicious intrusion feature components to improve the recognition accuracy and anti-interference capability of malicious intrusion behaviors.

[0026] In this implementation, feature fusion is performed on the screened effective malicious intrusion feature components, and the robustness and generalization ability of the malicious intrusion defense model are improved by fusing features of different dimensions.

[0027] In this embodiment, the interactive network malicious intrusion detection method based on Bayesian decision can be used to build an interactive network malicious intrusion active defense system, which monitors network traffic and data packets in real time to continuously evaluate the network status.

[0028] In addition, in one embodiment, the preprocessing in the step of preprocessing the data packets and flow information to obtain the data samples includes data cleaning, flow reassembly and data standardization; The data cleaning is used to remove invalid or erroneous data packets; The traffic reassembly is used to group data packets according to sessions or flows; The data normalization is used to unify the dimensions of all features in the data package so that all features are on the same scale.

[0029] In this implementation, the data quality is ensured through the above preprocessing.

[0030] In addition, in one embodiment, the step of performing cluster analysis on the frequency hopping data samples to identify the frequency hopping data suspected of malicious intrusion includes the following steps: A step for performing cluster analysis on the frequency hopping data samples by using a K-clustering algorithm, calculating the similarity and distance between data in the frequency hopping data samples, clustering data with similar characteristics together, and obtaining malicious intrusion data clusters of different categories; A step for constructing an interactive network malicious intrusion node distribution model according to different categories of malicious intrusion data clusters; the interactive network malicious intrusion node distribution model is used to divide the distribution positions and diffusion trends of different categories of malicious intrusion data clusters in the network; The invention is a step for identifying frequency hopping data suspected of malicious intrusion according to the distribution position and diffusion trend of different types of malicious intrusion data clusters in the network.

[0031] In this implementation manner, when the interactive network is invaded, an invasion frequency hopping data will be generated.

[0032] In this embodiment, the K-clustering algorithm is used to complete the identification of intrusion frequency hopping data in the interactive network. In the identification process, the intrusion frequency hopping data is classified and identified according to the characteristics of the interactive network structure.

[0033] In addition, in one embodiment, the frequency hopping data sample is assumed to be ; ; in, The state space representing the intrusion frequency hopping data; Represents the prior probability distribution function of the intrusion frequency hopping data; express The measurement results within Indicates the number of groups of measurement results; represents the probability density function; Indicates differential characteristics; represents the prior probability; represents the likelihood function; Indicates the sequence number of the initial cluster; Indicates the number of partition clusters.

[0034] In addition, in one embodiment, the K-clustering algorithm is used to Clustering is performed, and the calculation formula is: ; in, Indicates the clustering results; The cluster center of the frequency hopping data representing the intrusion; represents the feature classification threshold; represents the prior probability distribution vector; represents the posterior probability distribution vector; Characterization of different categories of intrusion frequency hopping data; represents weight; After completing the clustering of the intrusion frequency hopping data through the above formula, malicious intrusion data clusters of different categories can be obtained.

[0035] In addition, in one embodiment, an interactive network malicious intrusion node distribution model is constructed according to different types of malicious intrusion data clusters to divide the distribution area of ​​the intrusion frequency jump data in the network: ; Where: Represents the training sample characteristics of the intrusion frequency hopping data; Indicates the category of intrusion frequency hopping data; Represents the original information in the intrusion frequency hopping data; Represents the time series of intrusion frequency hopping data at different scales; Indicates the number of samples of intrusion frequency hopping data; represents the feature vector; Indicates the result of differential feature marking; Indicates the number of partition clusters.

[0036] In addition, in one embodiment, after the distribution area is divided, the frequency hopping data suspected of malicious intrusion is identified according to the division result; Suppose the threshold for identifying frequency hopping data suspected of malicious intrusion is : ; Where: Indicates the attribute category of the intrusion frequency hopping data; represents the information entropy set; Indicates data similarity; represents the time series weight; according to Identify frequency hopping data suspected of malicious intrusion: ; Where: Indicates the degree of deviation of the recognition result.

[0037] In addition, in one embodiment, the step of selecting features representing malicious intrusion behavior based on the suspected malicious intrusion frequency hopping data and the interactive network malicious intrusion node distribution model is as follows: According to the interactive network malicious intrusion node distribution model, the traffic results in the channel are obtained to build a transmission channel model of malicious intrusion; Using the transmission channel model of malicious intrusion, the features representing malicious intrusion behavior are selected through high-order statistical description methods: ; Where: m Indicates the number of nodes; Represents a network node, and the energy spectrum density at the node is expressed as express; represents the characteristic component; Indicates the link length; Indicates different characteristics; Represents feature information; It means natural and constant; Assume that the malicious intrusion intensity in the network link layer is : ; Assume that under the mean square error principle, the minimum malicious intrusion envelope amplitude is , the maximum malicious intrusion envelope amplitude is , and obtain the curvature as The curve of Building the MatrixY , used to describe the envelope amplitude characteristics of network malicious intrusion code elements: ; Where: Represents the residual statistics of malicious intrusion data; express The Hermitian matrix of arrive Represents the characteristic information of different network nodes; Obtain feature model for network malicious intrusion data: ; Where: E represents the unitary matrix on the malicious intrusion code transmission link; represents a diagonal matrix, which is composed of the abnormal code element envelope amplitude characteristics of malicious intrusion data; The selection results of the features representing malicious intrusion behavior are: ; Where: , , represents the time linear control parameter; Indicates the malicious intrusion envelope amplitude; Indicates time; Indicates the maximum malicious intrusion envelope amplitude.

[0038] In addition, in one embodiment, the method further comprises: It is used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

[0039] In this implementation manner, the defense measures include blocking the attack source, recording the attack log, sending alarm information, etc.

[0040] In addition, in one embodiment, the step of calculating the energy entropy increment and the frequency domain correlation coefficient of the features representing the malicious intrusion behavior and screening out multiple valid malicious intrusion features includes: A step for obtaining IMF components representing characteristics of malicious intrusion behavior and calculating energy results of each IMF component; A step for obtaining a normalized energy result of each IMF component according to the energy result of each IMF component; A step for obtaining an energy entropy increment value of each IMF component according to the normalized energy result of each IMF component; Used to obtain a power spectrum representing a feature of malicious intrusion behavior, and obtain a frequency domain mutual correlation coefficient of the feature representing the malicious intrusion behavior based on the power spectrum; The step of screening out multiple effective malicious intrusion features is performed using the energy entropy increment value of each IMF component and the frequency domain mutual correlation coefficient of the features representing the malicious intrusion behavior.

[0041] In this implementation, by screening effective malicious intrusion features, feature information irrelevant to malicious intrusion information is reduced in the features, thereby improving the utilization effect of the features.

[0042] In this implementation, features with a small correlation degree (ie, less than a given threshold) and a small energy entropy increment value (ie, less than a given threshold) are deleted to obtain effective malicious intrusion features.

[0043] In addition, in one embodiment, the feature representing the malicious intrusion behavior is u(t) ; set up u(t) The IMF components formed after decomposition are Indicates that the energy results of each component are calculated : ; Where: Indicates i Order IMF component. In addition, in one embodiment, the normalized energy result p(i) of each IMF component is obtained: ; Where: N Indicates the total number of orders. In addition, in one embodiment, the energy entropy increment value of each IMF component is obtained : .

[0044] In addition, in one embodiment, the feature representing the malicious intrusion behavior is and , The power spectrum is ， The power spectrum is ; calculate and The frequency domain cross-correlation coefficient ; Determine the degree of correlation between the features representing malicious intrusion behaviors based on the calculation results of the frequency domain mutual correlation coefficient; The features with smaller correlation (i.e., less than a given threshold) are deleted and the features with smaller correlation (i.e., less than a given threshold) are retained. The result is higher in features.

[0045] In addition, in one embodiment, the effective malicious intrusion features are: : ; Where: and Both represent the frequency components of the features; and All represent characteristic distribution coefficients; and They respectively represent the changes in characteristic amplitude.

[0046] In addition, in one embodiment, the step of using Bayesian decision theory to construct a malicious intrusion defense model based on a comprehensive malicious intrusion feature description and prior probability includes: Obtain effective fuzzy vector groups of malicious intrusion features through matched filtering algorithm; Let the fuzzy vector group be , the fuzzy vector groups grow into space: ; in, Represents the corresponding vector in the vector group; The frequency component representing the feature; In the growth space, obtain the spectrum characteristics of the intrusion code element: ; in, G represents the transmission matrix; i represents the i-th order, and the total number of orders is H ; Indicates valid malicious intrusion features; Assume the dimension of the transfer matrix is m×n , get the fuzzy value range of the transfer matrix output: ; in, j represents the jth order; The frequency component representing the feature; represents the characteristic distribution coefficient; Use Bayesian decision theory to obtain key feature quantities in the fuzzy value domain: ; Where: and Both represent the maximum peak value of the key feature quantity; In this implementation, an undirected graph model G = (V, E) is used to describe the transmission link of the intrusion code element in the interactive network. Here, V represents the link node, and E represents the link set. In order to describe the data set of the network transmission link, the previous recognition result X = { x 1 , x 2, ..., x n}; At the same time, G(A) and G(B) are used to represent the undirected graph model of code element transmission. In the case of advanced persistent malicious intrusion on the mobile terminal, the characteristics of network data distribution are represented by 〈x, y〉, and this pair of anchor points are located in the undirected graph A and B respectively; and the directed graph edge of the network data distribution is represented by (u, v)∈E; In addition, x(t) is used to represent the malicious intrusion data vector, and its calculation formula is x(t)=Ax(t)+n(t). In this formula, x(t) represents the dimension of the data vector at time t, and n(t) represents the noise signal.

[0047] Based on the above subsections, we can realize active defense against malicious intrusion in interactive networks by sampling fuzzy information. Perform conversion control to obtain output related functions of interactive network malicious intrusion; Set the malicious intrusion code sequence window function of the interactive network to ,and On this basis, the interactive network malicious intrusion code element sequence detection output result is obtained, and its calculation formula is: ; Here x represents the data of the network transmission link. , Data sets of network transmission links respectively; Where: represents the window variation coefficient; if = 1, then in the Bayesian decision model, the envelope of the malicious intrusion code element of the interactive network E(x) and variance ε(x) The calculation formula is:

[0048]

[0049] When detecting the power spectral density of malicious intrusion codeword sequences in interactive networks, it is completed in two segments, positive and negative (the positive segment of the codeword sequence represents logic "1", while the negative segment represents logic "0". This segmentation helps to decode and reconstruct the original information.), combined with the Bayesian decision algorithm to obtain the output result (i.e. ), its expression is: ; in, represents a fuzzy vector group; represents the number of fuzzy vector groups; represents a link node; When the x value in the sequence is the smallest, the stability of the interactive malicious intrusion code element sequence output is controlled to achieve active defense against malicious intrusions in the network. The expression is:

[0050] Where: A filter function representing the dimensions of the data vector; A filter function representing a malicious intrusion data vector; represents the reconstructed codeword sequence; Represents weight.

[0051] In one embodiment, an interactive network malicious intrusion detection device based on Bayesian decision making is provided, and the device includes the following modules: A module for collecting data packets and flow information in the network; A module for preprocessing data packets and flow information to obtain frequency hopping data samples; A module for clustering frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A module for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A module for calculating the energy entropy increment and frequency domain correlation coefficient of features representing malicious intrusion behavior, and screening out multiple valid malicious intrusion features; A module used to enhance and fuse the selected effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; A module for building a malicious intrusion defense model based on comprehensive malicious intrusion feature descriptions and prior probabilities using Bayesian decision theory; A module used to use a malicious intrusion defense model to calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, thereby determining whether the current network status is a malicious intrusion.

[0052] In addition, in one embodiment, the device further comprises: A module used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

[0053] In summary, we can know that: In this embodiment, the active defense method is used to actively defend the network, resist various network attacks and malicious code attacks, and protect the information system from threats.

[0054] In this implementation, the active defense method has a powerful statistical analysis function, can accurately and efficiently classify, predict and diagnose malicious intrusions in the network, and is suitable for many application scenarios.

[0055] In this embodiment, the interactive network malicious intrusion active defense method based on Bayesian decision theory can accurately identify and resist potential malicious behaviors. The core concept of the method is to monitor network traffic in real time, analyze the behaviors therein, classify network behaviors into normal and abnormal, and implement defense strategies accordingly. Among them, the Bayesian (decision) algorithm plays a key role. It responds to changes in the network environment in real time through interactive learning and active defense, and has extremely high accuracy and processing efficiency.

[0056] In this embodiment, the active defense method is unique in its flexibility, which enables effective differentiation and defense according to different types of intrusion behaviors, and can self-adjust to adapt to evolving network threats.

[0057] In this implementation, the active defense method can interact with the user and, through continuous learning and training, can better adapt to various network environments and new attack methods.

[0058] In this embodiment, the active defense method relies on a deep understanding of malicious behaviors in the network. It first extracts key behavior features and then uses a Bayesian decision mechanism to implement active defense to ensure the security of network interactions.

[0059] In this implementation, the Bayesian decision framework, as a core probability analysis tool, has shown significant value in multiple fields such as classification and identification, fault diagnosis, and future trend prediction. In the field of network security, the interactive network malicious intrusion active defense mechanism based on this theory provides a solid guarantee for the security and stable operation of the network with its precise detection and defense capabilities. Its unique advantage is that it can flexibly respond to various types of intrusions, and through fine classification and immediate defense, it achieves a dual improvement in high accuracy and high efficiency.

[0060] In this embodiment, the active defense method has strong adaptability and can adjust and optimize the strategy according to the dynamic changes of the network environment and intrusion means, ensuring that the defense strategy always remains efficient and targeted. In summary, the active defense method is an important innovation in the field of network security and provides strong support for building a more secure and intelligent network environment.

[0061] In addition, in one embodiment, in order to verify the application effect of the interactive network malicious intrusion active defense method, a relevant experimental verification is carried out by taking an interactive network as an example. The network structure of the interactive network is as follows: Figure 2 shown.

[0062] The network transmission and interaction data of the interactive network were collected after running for one week. A total of 16,000 groups of test data samples were collected, and the data length was 1024. The test data samples contain 6 types of malicious intrusion behaviors, namely denial of service attack, node attack, eavesdropping, unauthorized attack, message forgery, and message tampering.

[0063] Each frequency hopping data in the test data sample contains 6 kinds of malicious intrusion behaviors as the identification basis of the intrusion frequency hopping data.

[0064] In order to verify the detection effect of the active defense method on the malicious intrusion of the interactive network, the active defense method is used to detect 6 kinds of malicious intrusions and obtain the detection results, which are described by a matrix as shown in the following table. The underlined data are the correct detection results.

[0065]

[0066] After analyzing the test results in the above table, we can know that: The active defense method can effectively complete the accurate detection of six malicious intrusions, including denial of service attack, node attack, eavesdropping, unauthorized attack, message forgery, and message tampering, with the correct detection probability being above 0.993. During the detection process, the active defense method completes malicious intrusion detection by combining interactive network malicious intrusion feature extraction, thus ensuring the detection accuracy to a great extent.

[0067] The technical solution provided by the present invention is further described in detail above through several specific implementation modes in order to highlight the advantages and benefits of the technical solution provided by the present invention. However, the several specific implementation modes described above are not intended to be used as limitations on the present invention. Any reasonable changes and improvements to the present invention, reasonable combinations of implementation modes and equivalent substitutions based on the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An interactive network malicious intrusion detection method based on Bayesian decision making, characterized in that: The method comprises the following steps: Steps for collecting data packets and flow information in the network; A step for preprocessing data packets and flow information to obtain frequency hopping data samples; A step for performing cluster analysis on frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A step for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A step for calculating the energy entropy increment and frequency domain mutual correlation coefficient of features representing malicious intrusion behavior, and screening out multiple effective malicious intrusion features; A step for performing feature enhancement and feature fusion on the screened effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; Steps for constructing a malicious intrusion defense model based on a comprehensive malicious intrusion feature description and prior probability using Bayesian decision theory; It is used to adopt malicious intrusion defense model, calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, and identify the steps of malicious intrusion in the network.

2. The interactive network malicious intrusion detection method based on Bayesian decision making according to claim 1 is characterized in that: The step of preprocessing the data packets and flow information to obtain data samples includes data cleaning, flow reorganization and data standardization; The data cleaning is used to remove invalid or erroneous data packets; The traffic reassembly is used to group data packets according to sessions or flows; The data normalization is used to unify the dimensions of all features in the data package so that all features are on the same scale.

3. The interactive network malicious intrusion detection method based on Bayesian decision making according to claim 1 is characterized in that: The step of performing cluster analysis on the frequency hopping data samples to identify the frequency hopping data suspected of malicious intrusion comprises the following steps: A step for performing cluster analysis on the frequency hopping data samples by using a K-clustering algorithm, calculating the similarity and distance between data in the frequency hopping data samples, clustering data with similar characteristics together, and obtaining malicious intrusion data clusters of different categories; A step for constructing an interactive network malicious intrusion node distribution model according to different categories of malicious intrusion data clusters; the interactive network malicious intrusion node distribution model is used to divide the distribution positions and diffusion trends of different categories of malicious intrusion data clusters in the network; The invention is a step for identifying frequency hopping data suspected of malicious intrusion according to the distribution position and diffusion trend of different types of malicious intrusion data clusters in the network.

4. The interactive network malicious intrusion detection method based on Bayesian decision making according to claim 1 is characterized in that: The method further comprises: It is used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

5. The interactive network malicious intrusion detection method based on Bayesian decision making according to claim 1 is characterized in that: The step of calculating the energy entropy increment and frequency domain mutual correlation coefficient of the features representing the malicious intrusion behavior and screening out multiple effective malicious intrusion features comprises: A step for obtaining IMF components representing characteristics of malicious intrusion behavior and calculating energy results of each IMF component; A step for obtaining a normalized energy result of each IMF component according to the energy result of each IMF component; A step for obtaining an energy entropy increment value of each IMF component according to the normalized energy result of each IMF component; Used to obtain a power spectrum representing a feature of malicious intrusion behavior, and obtain a frequency domain mutual correlation coefficient of the feature representing the malicious intrusion behavior based on the power spectrum; The step of screening out multiple valid malicious intrusion features is performed using the energy entropy increment value of each IMF component and the frequency domain mutual correlation coefficient of the features representing the malicious intrusion behavior.

6. An interactive network malicious intrusion detection device based on Bayesian decision making, characterized in that: The device comprises the following modules: A module for collecting data packets and flow information in the network; A module for preprocessing data packets and flow information to obtain frequency hopping data samples; A module for clustering frequency hopping data samples, building an interactive network malicious intrusion node distribution model, and identifying frequency hopping data suspected of malicious intrusion; A module for selecting features representing malicious intrusion behavior based on frequency hopping data of suspected malicious intrusion and an interactive network malicious intrusion node distribution model; A module for calculating the energy entropy increment and frequency domain correlation coefficient of features representing malicious intrusion behavior, and screening out multiple valid malicious intrusion features; A module used to enhance and fuse the selected effective malicious intrusion features to obtain a comprehensive malicious intrusion feature description; A module for building a malicious intrusion defense model based on comprehensive malicious intrusion feature descriptions and prior probabilities using Bayesian decision theory; A module used to use a malicious intrusion defense model to calculate the posterior probability of malicious intrusion for the characteristics of each data packet in the data sample, thereby determining whether the current network status is a malicious intrusion.

7. The interactive network malicious intrusion detection device based on Bayesian decision making according to claim 6 is characterized in that: The device also includes: A module used to automatically respond to identified malicious intrusions in the network and execute defensive measures.

8. A computer device comprising: A processor and a memory, characterized in that the memory is used to store executable instructions of the processor, and the processor is configured to execute the interactive network malicious intrusion detection method based on Bayesian decision-making as described in any one of claims 1 to 5 by executing the executable instructions.

9. A computer storage medium, characterized in that The storage medium stores a computer program, and when the computer program is run, the interactive network malicious intrusion detection method based on Bayesian decision-making described in any one of claims 1 to 5 is executed.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the interactive network malicious intrusion detection method based on Bayesian decision-making described in any one of claims 1 to 5 are implemented.

Images