Abnormality detection method and system for network security

Abstract

The embodiment of the invention relates to the technical field of network security, and particularly discloses an anomaly detection method and system for network security. According to the embodiment of the invention, real-time network occupancy monitoring is carried out on the target network equipment to judge whether a suspicious anomaly exists or not; when the suspicious exception exists, screening a plurality of associated online devices; screening an auxiliary network device from the plurality of associated online devices; transmitting the network monitoring data to auxiliary network equipment in an associated manner; and performing anomaly detection on the network monitoring data through the auxiliary network equipment, generating an anomaly detection result and performing corresponding anomaly processing. When the target network equipment has suspicious abnormity, the auxiliary network equipment can be screened from the multiple associated online equipment, abnormity detection is performed on the network monitoring data through the auxiliary network equipment, and the abnormity detection result is fed back and processed, so that the influence on the working target network equipment is avoided, the jamming phenomenon caused by resource occupancy is reduced, and the user experience is improved. The use experience is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to an anomaly detection method and system for network security. Background Art

[0002] Network security refers to the measures and technologies to protect the hardware, software and data carried in the network system from various forms of malicious attacks, accidents and other illegal access and use. The goal of network security is to ensure the stable and reliable operation of the network, as well as the confidentiality, integrity and availability of information and data in the network.

[0003] In the prior art, network security anomaly detection of network devices usually needs to be performed by the network devices themselves. For network devices in a working state, if they themselves need to perform anomaly detection processing, they will need to occupy certain network resources, computing resources and storage resources, which will easily affect the ongoing work tasks, cause freezes, and affect the user experience. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a method and system for anomaly detection in network security, aiming to solve the problems raised in the background technology.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions: A method for detecting anomalies in network security, the method specifically comprising the following steps: Performing real-time network occupancy monitoring on the target network device, obtaining occupancy monitoring data, and performing initial abnormality analysis on the occupancy monitoring data to determine whether there is any suspicious abnormality; When there is a suspicious anomaly, performing correlation analysis on the target network device and screening multiple related online devices; Acquire device operation data of the plurality of associated online devices, analyze the plurality of device operation data, and select auxiliary network devices from the plurality of associated online devices; Acquire network monitoring data of the target network device, and transmit the network monitoring data to the auxiliary network device in association; Through the auxiliary network device, the network monitoring data is detected for anomalies, anomaly detection results are generated and corresponding anomaly processing is performed.

[0006] An anomaly detection system for network security, the system comprising an initial anomaly analysis unit, a device association analysis unit, an auxiliary device screening unit, a data association transmission unit and an anomaly detection processing unit, wherein: An initial anomaly analysis unit is used to perform real-time network occupancy monitoring of a target network device, obtain occupancy monitoring data, perform initial anomaly analysis on the occupancy monitoring data, and determine whether there is a suspicious anomaly; A device association analysis unit, used to perform association analysis on the target network device and screen multiple associated online devices when there is a suspicious anomaly; an auxiliary device screening unit, configured to obtain device operation data of a plurality of the associated online devices, analyze the plurality of the device operation data, and screen an auxiliary network device from the plurality of the associated online devices; A data association transmission unit, used for acquiring the network monitoring data of the target network device, and transmitting the network monitoring data to the auxiliary network device in an associated manner; The anomaly detection processing unit is used to perform anomaly detection on the network monitoring data through the auxiliary network device, generate anomaly detection results and perform corresponding anomaly processing.

[0007] Compared with the prior art, the present invention has the following beneficial effects: The embodiment of the present invention performs real-time network occupancy monitoring on the target network device to determine whether there is a suspicious anomaly; when there is a suspicious anomaly, multiple associated online devices are screened; from the multiple associated online devices, an auxiliary network device is screened; the network monitoring data is associated and transmitted to the auxiliary network device; the network monitoring data is detected for anomalies through the auxiliary network device, an anomaly detection result is generated, and corresponding anomaly processing is performed. When the target network device has a suspicious anomaly, an auxiliary network device can be screened from multiple associated online devices, and the network monitoring data can be detected for anomalies through the auxiliary network device, and the anomaly detection result can be fed back and processed to avoid affecting the working target network device, reduce the jamming phenomenon caused by resource occupation, and improve the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention.

[0009] Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0010] Figure 2 A flow chart of suspicious anomaly analysis and judgment in the method provided by an embodiment of the present invention is shown.

[0011] Figure 3 A flow chart of network device association analysis in the method provided by an embodiment of the present invention is shown.

[0012] Figure 4 A flow chart of screening auxiliary network devices in the method provided by an embodiment of the present invention is shown.

[0013] Figure 5 A flow chart of monitoring data association transmission in the method provided by an embodiment of the present invention is shown.

[0014] Figure 6 A flowchart of anomaly detection and anomaly processing in the method provided by an embodiment of the present invention is shown.

[0015] Figure 7 The application architecture diagram of the system provided by the embodiment of the present invention is shown.

[0016] Figure 8 The structure block diagram of the initial abnormality analysis unit in the system provided by the embodiment of the present invention is shown.

[0017] Fig. 9 The structure block diagram of the device association analysis unit in the system provided by the embodiment of the present invention is shown.

[0018] Fig.10 A structural block diagram of an auxiliary device screening unit in a system provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] It is understandable that in the prior art, network security anomaly detection for network devices usually needs to be performed by the network devices themselves. For network devices in a working state, if they themselves need to perform anomaly detection processing, they will need to occupy certain network resources, computing resources and storage resources, which will easily affect the ongoing work tasks, cause freezes, and affect the user experience.

[0021] To solve the above problems, the embodiment of the present invention performs real-time network occupancy monitoring on the target network device, obtains occupancy monitoring data, performs initial abnormality analysis on the occupancy monitoring data, and determines whether there is a suspicious abnormality; when there is a suspicious abnormality, the target network device is associated with analysis, and multiple associated online devices are screened; the device operation data of multiple associated online devices are obtained, the multiple device operation data are analyzed, and auxiliary network devices are screened from multiple associated online devices; the network monitoring data of the target network device is obtained, and the network monitoring data is associated and transmitted to the auxiliary network device; the network monitoring data is detected abnormally through the auxiliary network device, and the abnormal detection result is generated and the corresponding abnormal processing is performed. When the target network device has a suspicious abnormality, the auxiliary network device can be screened from multiple associated online devices, and the network monitoring data can be detected abnormally through the auxiliary network device, and the abnormal detection result can be fed back and processed to avoid affecting the working target network device, reduce the jamming phenomenon caused by resource occupation, and improve the user experience.

[0022] Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0023] Specifically, a method for detecting anomalies in network security includes the following steps: Step S101 , performing real-time network occupancy monitoring on a target network device, acquiring occupancy monitoring data, performing initial abnormality analysis on the occupancy monitoring data, and determining whether there is any suspicious abnormality.

[0024] In an embodiment of the present invention, a target network device that needs to be monitored for network security anomalies is determined, a target detection instruction is generated, and real-time network occupancy monitoring is performed on the target network device in accordance with the target detection instruction to obtain occupancy monitoring data. In addition, real-time operation detection is performed on the target network device in accordance with the target detection instruction to obtain operation monitoring data. By comparing the occupancy monitoring data with the operation monitoring data, it is determined according to the comparison result whether the actual network occupancy meets the network occupancy required for the current operation of the target network device, and then it is determined whether there is a suspicious anomaly. Specifically: when the actual network occupancy meets the network occupancy required for the current operation of the target network device, it is determined that there is no suspicious anomaly; when the actual network occupancy does not meet the network occupancy required for the current operation of the target network device, it is determined that there is a suspicious anomaly.

[0025] Specifically, Figure 2 A flow chart of suspicious anomaly analysis and judgment in the method provided by an embodiment of the present invention is shown.

[0026] Among them, in the preferred implementation mode provided by the present invention, the real-time network occupancy monitoring of the target network device, obtaining the occupancy monitoring data, performing initial abnormality analysis on the occupancy monitoring data, and determining whether there is a suspicious abnormality specifically include the following steps: Step S1011, determining a target network device and generating a target detection instruction; Step S1012, performing real-time network occupancy monitoring on the target network device according to the target detection instruction, and obtaining occupancy monitoring data; Step S1013, performing real-time operation detection on the target network device according to the target detection instruction to obtain operation monitoring data; Step S1014: performing an initial abnormality analysis on the occupancy monitoring data based on the operation monitoring data to determine whether there is any suspicious abnormality.

[0027] Among them, in the preferred embodiment provided by the present invention, the initial abnormality analysis of the occupancy monitoring data is performed according to the operation monitoring data to determine whether there is a suspicious abnormality, which specifically includes the following steps: Standardizing the operation monitoring data and the occupancy monitoring data to obtain standardized operation data and standardized occupancy data; The normalized operation data and the normalized occupancy data are combined to form a feature matrix; The radial basis function RBF kernel function is used to map the feature matrix to a high-dimensional feature space; In the high-dimensional feature space, the similarity between each data point in the feature matrix is ​​calculated to form a kernel matrix; Centralize the kernel matrix, perform eigenvalue decomposition on the centralized kernel matrix, and calculate the eigenvalues ​​and eigenvectors; According to the size of the eigenvalue, the eigenvectors corresponding to the first few eigenvalues ​​are selected as the principal components; Determine the contribution of each principal component according to the size of the eigenvalue, and standardize the contribution to obtain the dynamic weight of each principal component; The principal components are weighted by dynamic weights to obtain weighted principal components; The isolation forest algorithm is used to detect anomalies on the weighted principal components and obtain several abnormal points. The weighted principal components are used to calculate the entropy value of each data point to quantify its complexity and uncertainty and obtain the impact score; A dynamic threshold is constructed based on a combination of the mean and standard deviation of the impact score; The impact score is compared with the dynamic threshold, and the comparison result is combined with the abnormal point to obtain the judgment result.

[0028] In an embodiment of the present invention, the use of kernel principal component analysis (Kernel PCA) can effectively capture nonlinear relationships in data. Compared with linear PCA, this method is more adaptable to complex actual data, so that the features after dimensionality reduction can better reflect the structure of the original data. And the Kernel PCA and the isolation forest algorithm are used in combination to form a collaborative method. The former is used to extract and simplify data features, and the latter focuses on efficient anomaly detection. The combination of the two can improve the detection effect. And a dynamic weight mechanism and a dynamic threshold mechanism are designed. By dynamically allocating feature weights, the features that are important for anomaly detection are highlighted. This mechanism ensures that important information is not lost during the dimensionality reduction process, thereby improving the accuracy of anomaly detection. The outliers are determined by dynamic thresholds, so that the algorithm can automatically adjust according to the statistical characteristics of the data and has good adaptability to different data sets. This adaptability improves the robustness of the model in a changing environment. Finally, entropy is introduced as an impact score, which can better quantify the complexity and uncertainty of the data and help identify potential anomalies. Further, the anomaly detection method for network security also includes the following steps: Step S102: when there is a suspected anomaly, a correlation analysis is performed on the target network device to screen a plurality of associated online devices.

[0029] In an embodiment of the present invention, when there is a suspected abnormality, a device association instruction is generated. At this time, according to the device association instruction, a device association communication analysis is performed on the target network device, and multiple associated network devices having an associated communication relationship with the target network device are determined, and then the device online status of the multiple associated network devices is obtained, and then according to the multiple device online status, multiple associated online devices are screened from the multiple associated network devices, wherein the multiple associated online devices are associated network devices that are in an online state among the multiple associated network devices.

[0030] Specifically, Figure 3 A flow chart of network device association analysis in the method provided by an embodiment of the present invention is shown.

[0031] Among them, in the preferred implementation manner provided by the present invention, when there is a suspicious anomaly, performing association analysis on the target network device and screening multiple associated online devices specifically includes the following steps: Step S1021, when there is a suspected abnormality, generating a device association instruction; Step S1022, performing association analysis on the target network device according to the device association instruction to determine a plurality of associated network devices; Step S1023, obtaining the device online status of the plurality of associated network devices; Step S1024: Filter multiple associated online devices from the multiple associated network devices according to the online status of the multiple devices.

[0032] Among them, in the preferred implementation manner provided by the present invention, performing association analysis on the target network device according to the device association instruction to determine multiple associated network devices specifically includes the following steps: The network topology graph is constructed by taking network devices as nodes, the connection relationship between network devices as edges, and the physical connection strength between two network devices as edge weights; Acquire the communication data of all network devices, select the target network device, and use cosine similarity to calculate the communication similarity of the communication data between the target network device and other network devices; The edge weights are used to calculate the association strength of communication similarity in a weighted manner to obtain the comprehensive association strength score between the target network device and other network devices; An association strength threshold is set, the comprehensive association strength score is normalized, and then the normalized comprehensive association strength score is screened according to the association strength threshold to obtain a list of devices ranked by association strength, and the list of devices ranked by association strength is used as strongly associated devices of the target device.

[0033] In the embodiment of the present invention, the physical connection information of network devices (network topology diagram) is used, and the communication mode (traffic similarity) between devices is also considered. The two complement each other and improve the comprehensiveness and accuracy of the association analysis. By weighting the communication similarity and topology weight, the flexibility of data analysis can be guaranteed, and the focus can be adjusted according to the actual scenario, which is suitable for different types of network structures.

[0034] Furthermore, the anomaly detection method for network security also includes the following steps: Step S103, acquiring device operation data of the plurality of associated online devices, analyzing the plurality of device operation data, and selecting an auxiliary network device from the plurality of associated online devices.

[0035] In an embodiment of the present invention, by acquiring device operation data of multiple associated online devices, and then analyzing the multiple device operation data, the CPU occupancy ratio, network occupancy ratio, memory occupancy ratio, etc. in the multiple device operation data are evenly calculated and processed to obtain the operation occupancy average of the multiple associated online devices, and by comparing the multiple operation occupancy averages, the minimum occupancy average is selected, and then the associated online device corresponding to the minimum occupancy average is screened and marked as an auxiliary network device.

[0036] Specifically, Figure 4 A flow chart of screening auxiliary network devices in the method provided by an embodiment of the present invention is shown.

[0037] Among them, in the preferred implementation manner provided by the present invention, the acquiring of the device operation data of the plurality of associated online devices, analyzing the plurality of the device operation data, and selecting the auxiliary network device from the plurality of associated online devices specifically comprises the following steps: Step S1031, obtaining device operation data of a plurality of associated online devices; Step S1032, analyzing the operation data of the plurality of devices, and calculating the average operation occupancy of the plurality of associated online devices; Step S1033, comparing the plurality of running occupancy averages, and selecting the minimum occupancy average; Step S1034: filter and mark the associated online devices corresponding to the minimum occupancy average as auxiliary network devices.

[0038] Among them, in the preferred implementation manner provided by the present invention, the analyzing of the operation data of the plurality of the devices and the calculation of the operation occupancy average of the plurality of the associated online devices specifically include the following steps: Obtain device operation data and normalize the device operation data; the device operation data is multi-dimensional data, including traffic load occupancy, CPU occupancy, memory occupancy, bandwidth usage, device health score, and historical abnormality rate; The traffic load occupancy rate is transformed nonlinearly using the Sigmoid function to obtain the traffic load occupancy feature; The CPU occupancy rate is transformed nonlinearly using Sigmoid function to obtain the CPU occupancy feature; The memory occupancy rate is transformed nonlinearly using the Sigmoid function to obtain the memory occupancy feature; The bandwidth usage rate is transformed nonlinearly using a logarithmic function to obtain the bandwidth usage characteristics; The equipment health score is inverted, and then the Sigmoid function is used for nonlinear transformation to obtain the equipment health characteristics; The historical anomaly rate is transformed nonlinearly using a square function to obtain the historical anomaly characteristics; Calculate the average of the traffic load occupancy, CPU occupancy, memory occupancy, bandwidth usage, device health score, and historical abnormality rate of all associated online devices to obtain the average value of each dimension; The weight of each dimension is dynamically calculated based on the average value of each dimension of all currently associated online devices to obtain the dimension weight; The traffic load occupancy features, CPU occupancy features, memory occupancy features, bandwidth usage features, device health features, and historical abnormal features are weighted and summed with the dimension weights to obtain the comprehensive feature value of the associated online device, and the comprehensive feature value is compressed using an activation function to obtain the compressed comprehensive feature value; Input the equipment operation data into the pre-trained regression model to predict the future operation load trend of each associated online equipment; The future operating load trend is normalized and mapped into a correction factor, which is then used to adjust the compressed comprehensive eigenvalue to obtain the final occupancy share of each device.

[0039] In the embodiment of the present invention, six main dimensions, including traffic load, CPU occupancy, memory occupancy, bandwidth usage, device health score, and historical anomaly rate, are integrated. Each dimension reflects different aspects of the device operating status. Judgment is no longer dependent on a single indicator, but rather a comprehensive analysis of multi-dimensional data is performed to ensure that the evaluation of the device operating status is more scientific and comprehensive.

[0040] In addition, predictive logic is introduced to use the historical operating data of the equipment to predict future load trends, so that the occupancy distribution calculation is not only based on the current status, but also effectively considers the future performance of the equipment. Through predictive correction, it is ensured that the selected auxiliary equipment will remain reliable for a period of time in the future, reducing potential risks to network operation.

[0041] Furthermore, the anomaly detection method for network security also includes the following steps: Step S104, obtaining network monitoring data of the target network device, and transmitting the network monitoring data to the auxiliary network device in an associated manner.

[0042] In the embodiment of the present invention, the network monitoring data of the target network device is acquired to generate an associated transmission instruction, and then the network monitoring data is associated and transmitted to the auxiliary network device according to the associated transmission instruction.

[0043] Specifically, Figure 5 A flow chart of monitoring data association transmission in the method provided by an embodiment of the present invention is shown.

[0044] Among them, in the preferred implementation manner provided by the present invention, the obtaining of the network monitoring data of the target network device and the associative transmission of the network monitoring data to the auxiliary network device specifically include the following steps: Step S1041, obtaining network monitoring data of the target network device; Step S1042, generating an associated transmission instruction; Step S1043: according to the associated transmission instruction, the network monitoring data is associated and transmitted to the auxiliary network device.

[0045] Furthermore, the anomaly detection method for network security also includes the following steps: Step S105, performing anomaly detection on the network monitoring data through the auxiliary network device, generating anomaly detection results and performing corresponding anomaly processing.

[0046] In an embodiment of the present invention, an anomaly detection is performed on the network monitoring data through an auxiliary network device, and the anomaly detection result is obtained and fed back and transmitted, so that the anomaly detection result fed back and transmitted by the auxiliary network device can be received, and then the anomaly detection result is analyzed to determine whether there is a network security anomaly. In the case of a network security anomaly, a security anomaly alarm is issued on the target network device.

[0047] Specifically, Figure 6 A flowchart of anomaly detection and anomaly processing in the method provided by an embodiment of the present invention is shown.

[0048] Among them, in the preferred implementation mode provided by the present invention, the performing of anomaly detection on the network monitoring data by the auxiliary network device, generating anomaly detection results and performing corresponding anomaly processing specifically includes the following steps: Step S1051, performing abnormality detection and feedback on the network monitoring data through the auxiliary network device; Step S1052, obtaining an abnormality detection result transmitted by the auxiliary network device feedback; Step S1053, analyzing the anomaly detection result to determine whether there is a network security anomaly; Step S1054: when there is a network security anomaly, a security anomaly alarm is issued through the target network device.

[0049] Among them, in the preferred implementation manner provided by the present invention, the analysis of the abnormality detection result to determine whether there is a network security abnormality specifically includes the following steps: According to the communication relationship between devices, an interaction matrix is ​​constructed, and each element in the interaction matrix represents the communication strength between two devices; Calculate the probability of anomalies propagating from the source device to the target device based on the communication strength and communication behavior; Screen out high-risk transmission paths based on the probability of transmission and the importance of the equipment; Based on the network topology, recursive jump propagation is performed starting from the abnormal source device, and the propagation probability is updated in a decaying manner during each recursive process; After the recursion is completed, the propagation range is obtained, and the propagation impact score is obtained based on the importance of the devices in the propagation range and the propagation probability; Extracting abnormal features from the abnormality detection results, the abnormal features include abnormality severity, abnormality frequency and abnormality type; The severity, frequency and type of anomaly are weighted and summed, and the weighted sum result is integrated with the propagation impact score to obtain a comprehensive impact score. The comprehensive impact score is nonlinearly amplified and then corrected using the historical anomaly trend as a reference to obtain a corrected comprehensive impact score. Whether there is a network security anomaly is determined based on the corrected comprehensive impact score.

[0050] In the embodiment of the present invention, risks are comprehensively considered from multiple dimensions, so as to more comprehensively reflect the security status of network devices. Through comprehensive analysis of multiple features, the model avoids misjudgment that may be caused by a single factor. For example, focusing only on abnormal frequency may ignore low-frequency but high-risk attacks, while over-reliance on device importance may underestimate the risk of continuous attacks on ordinary devices.

[0051] Furthermore, traditional risk assessment models usually only evaluate a single device or a single event, while ignoring the chain reaction that anomalies may have on the entire network. The present invention models and corrects the propagation of anomalies, so that the model can better detect and warn of large-scale network anomalies (such as DDoS attacks, worm propagation, etc.) and take preventive measures at the early stages of the problem. By correcting and calculating historical anomaly trends, the model can more accurately assess current risks: if historical data shows that the risk of a device has gradually increased over a period of time, the model will give priority to warning, even if the current real-time data is not significant. The system can capture the periodicity and persistence of anomalies and improve the ability to predict potential threats. Furthermore, Figure 7 The application architecture diagram of the system provided by the embodiment of the present invention is shown.

[0052] In another preferred embodiment of the present invention, a network security anomaly detection system includes: The initial abnormality analysis unit 101 is used to perform real-time network occupancy monitoring on the target network device, obtain occupancy monitoring data, perform initial abnormality analysis on the occupancy monitoring data, and determine whether there is a suspicious abnormality.

[0053] In an embodiment of the present invention, the initial anomaly analysis unit 101 generates a target detection instruction by determining a target network device that needs to be monitored for network security anomalies, performs real-time network occupancy monitoring on the target network device according to the target detection instruction, obtains occupancy monitoring data, and performs real-time operation detection on the target network device according to the target detection instruction, obtains operation monitoring data, compares the occupancy monitoring data with the operation monitoring data, and determines whether the actual network occupancy meets the network occupancy required for the current operation of the target network device according to the comparison result, and then determines whether there is a suspicious anomaly. Specifically: when the actual network occupancy meets the network occupancy required for the current operation of the target network device, it is determined that there is no suspicious anomaly; when the actual network occupancy does not meet the network occupancy required for the current operation of the target network device, it is determined that there is a suspicious anomaly.

[0054] Specifically, Figure 8 The structure block diagram of the initial abnormality analysis unit 101 in the system provided by the embodiment of the present invention is shown.

[0055] Among them, in the preferred embodiment provided by the present invention, the initial abnormality analysis unit 101 specifically includes: A detection instruction generating module 1011 is used to determine a target network device and generate a target detection instruction; The occupancy monitoring module 1012 is used to perform real-time network occupancy monitoring on the target network device according to the target detection instruction and obtain occupancy monitoring data; The operation detection module 1013 is used to perform real-time operation detection on the target network device according to the target detection instruction and obtain operation monitoring data; The initial abnormality analysis module 1014 is used to perform an initial abnormality analysis on the occupancy monitoring data according to the operation monitoring data to determine whether there is a suspicious abnormality.

[0056] Furthermore, the logistics order dispatching system based on path optimization also includes: The device association analysis unit 102 is used to perform association analysis on the target network device and screen multiple associated online devices when there is a suspicious anomaly.

[0057] In the embodiment of the present invention, when there is a suspected abnormality, the device association analysis unit 102 generates a device association instruction. At this time, according to the device association instruction, a device association communication analysis is performed on the target network device to determine a plurality of associated network devices having an associated communication relationship with the target network device, and then the device online status of the plurality of associated network devices is obtained, and then according to the plurality of device online statuses, a plurality of associated online devices are screened from the plurality of associated network devices, wherein the plurality of associated online devices are associated network devices that are in an online state among the plurality of associated network devices.

[0058] Specifically, Fig. 9 It shows a structural block diagram of the device association analysis unit 102 in the system provided by an embodiment of the present invention.

[0059] In a preferred embodiment of the present invention, the device association analysis unit 102 specifically includes: The association instruction generation module 1021 is used to generate a device association instruction when there is a suspected abnormality; The association analysis module 1022 is used to perform association analysis on the target network device according to the device association instruction to determine multiple associated network devices; A status acquisition module 1023, used to acquire the device online status of the plurality of associated network devices; The associated screening module 1024 is used to screen a plurality of associated online devices from the plurality of associated network devices according to the online status of the plurality of devices.

[0060] Furthermore, the logistics order dispatching system based on path optimization also includes: The auxiliary device screening unit 103 is used to obtain device operation data of the plurality of associated online devices, analyze the plurality of device operation data, and screen auxiliary network devices from the plurality of associated online devices.

[0061] In an embodiment of the present invention, the auxiliary device screening unit 103 obtains device operation data of multiple associated online devices, analyzes the multiple device operation data, and evenly calculates the CPU occupancy ratio, network occupancy ratio, memory occupancy ratio, etc. in the multiple device operation data to obtain the operation occupancy average of the multiple associated online devices. By comparing the multiple operation occupancy averages, the minimum occupancy average is selected, and then the associated online device corresponding to the minimum occupancy average is screened and marked as an auxiliary network device.

[0062] Specifically, Fig.10 It shows a structural block diagram of the auxiliary device screening unit 103 in the system provided by an embodiment of the present invention.

[0063] Among them, in the preferred embodiment provided by the present invention, the auxiliary device screening unit 103 specifically includes: A data acquisition module 1031 is used to acquire device operation data of a plurality of associated online devices; An average calculation module 1032 is used to analyze the operation data of the plurality of devices and calculate the average operation occupancy of the plurality of associated online devices; An average share comparison module 1033 is used to compare the multiple running occupancy average shares and select the minimum occupancy average share; The auxiliary screening module 1034 is used to screen and mark the associated online devices corresponding to the minimum occupancy as auxiliary network devices.

[0064] Furthermore, the logistics order dispatching system based on path optimization also includes: The data association transmission unit 104 is used to obtain the network monitoring data of the target network device, and associate and transmit the network monitoring data to the auxiliary network device.

[0065] In the embodiment of the present invention, the data association transmission unit 104 generates an association transmission instruction by acquiring the network monitoring data of the target network device, and then associates and transmits the network monitoring data to the auxiliary network device according to the association transmission instruction.

[0066] The anomaly detection processing unit 105 is used to perform anomaly detection on the network monitoring data through the auxiliary network device, generate anomaly detection results and perform corresponding anomaly processing.

[0067] In an embodiment of the present invention, anomaly detection is performed on network monitoring data through auxiliary network equipment, anomaly detection results are obtained and feedback is transmitted, the anomaly detection processing unit 105 can receive the anomaly detection results fed back by the auxiliary network equipment, and then analyze the anomaly detection results to determine whether there are network security anomalies. In the case of network security anomalies, a security anomaly alarm is issued on the target network device.

[0068] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0069] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0070] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for anomaly detection in network security, characterized in that: The method specifically comprises the following steps: Performing real-time network occupancy monitoring on the target network device, obtaining occupancy monitoring data, and performing initial abnormality analysis on the occupancy monitoring data to determine whether there is any suspicious abnormality; When there is a suspicious anomaly, performing correlation analysis on the target network device and screening multiple related online devices; Acquire device operation data of the plurality of associated online devices, analyze the plurality of device operation data, and select auxiliary network devices from the plurality of associated online devices; Acquire network monitoring data of the target network device, and transmit the network monitoring data to the auxiliary network device in association; By means of the auxiliary network device, the network monitoring data is subjected to anomaly detection, anomaly detection results are generated and corresponding anomaly processing is performed; The real-time network occupancy monitoring of the target network device, obtaining occupancy monitoring data, performing initial abnormality analysis on the occupancy monitoring data, and determining whether there is a suspicious abnormality specifically include the following steps: Determine the target network device and generate target detection instructions; According to the target detection instruction, real-time network occupancy monitoring is performed on the target network device to obtain occupancy monitoring data; According to the target detection instruction, real-time operation detection is performed on the target network device to obtain operation monitoring data; Based on the operation monitoring data, an initial abnormality analysis is performed on the occupancy monitoring data to determine whether there is any suspicious abnormality.

2. The anomaly detection method for network security according to claim 1, characterized in that: The performing of initial abnormality analysis on the occupancy monitoring data according to the operation monitoring data to determine whether there is a suspicious abnormality specifically comprises the following steps: Standardizing the operation monitoring data and the occupancy monitoring data to obtain standardized operation data and standardized occupancy data; The normalized operation data and the normalized occupancy data are combined to form a feature matrix; The radial basis function RBF kernel function is used to map the feature matrix to a high-dimensional feature space; In the high-dimensional feature space, the similarity between each data point in the feature matrix is ​​calculated to form a kernel matrix; Centralize the kernel matrix, perform eigenvalue decomposition on the centralized kernel matrix, and calculate the eigenvalues ​​and eigenvectors; According to the size of the eigenvalue, the eigenvectors corresponding to the first few eigenvalues ​​are selected as the principal components; Determine the contribution of each principal component according to the size of the eigenvalue, and standardize the contribution to obtain the dynamic weight of each principal component; The principal components are weighted by dynamic weights to obtain weighted principal components; The isolation forest algorithm is used to detect anomalies on the weighted principal components and obtain several abnormal points; The weighted principal components are used to calculate the entropy value of each data point to quantify its complexity and uncertainty and obtain the impact score; A dynamic threshold is constructed based on a combination of the mean and standard deviation of the impact score; The impact score is compared with the dynamic threshold, and the comparison result is combined with the abnormal point to obtain the judgment result.

3. The anomaly detection method for network security according to claim 2, characterized in that: When there is a suspicious anomaly, performing association analysis on the target network device and screening multiple associated online devices specifically includes the following steps: When there is a suspected abnormality, a device association instruction is generated; According to the device association instruction, performing association analysis on the target network device to determine a plurality of associated network devices; Obtaining device online status of a plurality of the associated network devices; According to the online status of the plurality of devices, a plurality of associated online devices are screened from the plurality of associated network devices.

4. The anomaly detection method for network security according to claim 3, characterized in that: The performing association analysis on the target network device according to the device association instruction to determine a plurality of associated network devices specifically comprises the following steps: The network topology graph is constructed by taking network devices as nodes, the connection relationship between network devices as edges, and the physical connection strength between two network devices as edge weights; Acquire the communication data of all network devices, select the target network device, and use cosine similarity to calculate the communication similarity of the communication data between the target network device and other network devices; The edge weights are used to calculate the association strength of communication similarity in a weighted manner to obtain the comprehensive association strength score between the target network device and other network devices; An association strength threshold is set, the comprehensive association strength score is normalized, and then the normalized comprehensive association strength score is screened according to the association strength threshold to obtain a list of devices ranked by association strength, and the list of devices ranked by association strength is used as strongly associated devices of the target device.

5. The anomaly detection method for network security according to claim 4, characterized in that: The acquiring of the device operation data of the plurality of associated online devices, analyzing the plurality of device operation data, and selecting the auxiliary network device from the plurality of associated online devices specifically comprises the following steps: Acquire device operation data of a plurality of the associated online devices; Analyze the operation data of the plurality of the devices, and calculate the average operation occupancy of the plurality of the associated online devices; Comparing the plurality of running occupancy averages, and selecting the minimum occupancy average; The associated online devices corresponding to the minimum occupancy are equally divided and screened and marked as auxiliary network devices.

6. The anomaly detection method for network security according to claim 5, characterized in that: The analyzing of the operation data of the plurality of devices and calculating the average operation occupancy of the plurality of associated online devices specifically comprises the following steps: Obtain device operation data and normalize the device operation data; the device operation data is multi-dimensional data, including traffic load occupancy, CPU occupancy, memory occupancy, bandwidth usage, device health score, and historical abnormality rate; The traffic load occupancy rate is transformed nonlinearly using the Sigmoid function to obtain the traffic load occupancy feature; The CPU occupancy rate is transformed nonlinearly using Sigmoid function to obtain the CPU occupancy feature; The memory occupancy rate is transformed nonlinearly using the Sigmoid function to obtain the memory occupancy feature; The bandwidth usage rate is transformed nonlinearly using a logarithmic function to obtain the bandwidth usage characteristics; The equipment health score is inverted, and then the Sigmoid function is used for nonlinear transformation to obtain the equipment health characteristics. The historical anomaly rate is transformed nonlinearly using a square function to obtain the historical anomaly characteristics; Calculate the average of the traffic load occupancy, CPU occupancy, memory occupancy, bandwidth usage, device health score, and historical abnormality rate of all associated online devices to obtain the average value of each dimension; The weight of each dimension is dynamically calculated based on the average value of each dimension of all currently associated online devices to obtain the dimension weight; The traffic load occupancy features, CPU occupancy features, memory occupancy features, bandwidth usage features, device health features, and historical abnormal features are weighted and summed with the dimension weights to obtain the comprehensive feature value of the associated online device, and the comprehensive feature value is compressed using an activation function to obtain the compressed comprehensive feature value; Input the equipment operation data into the pre-trained regression model to predict the future operation load trend of each associated online equipment; The future operating load trend is normalized and mapped into a correction factor, which is then used to adjust the compressed comprehensive eigenvalue to obtain the final occupancy share of each device.

7. The anomaly detection method for network security according to claim 6, characterized in that: The obtaining of the network monitoring data of the target network device and associating and transmitting the network monitoring data to the auxiliary network device specifically comprises the following steps: Acquire network monitoring data of the target network device; generating associated transfer instructions; According to the associated transmission instruction, the network monitoring data is associated and transmitted to the auxiliary network device.

8. The anomaly detection method for network security according to claim 7, characterized in that: The method of performing anomaly detection on the network monitoring data by the auxiliary network device, generating anomaly detection results and performing corresponding anomaly processing specifically includes the following steps: By means of the auxiliary network device, abnormality detection and feedback are performed on the network monitoring data; Obtaining anomaly detection results transmitted by feedback from the auxiliary network device; Analyze the anomaly detection result to determine whether there is a network security anomaly; When there is a network security anomaly, a security anomaly alarm is issued through the target network device.

9. The anomaly detection method for network security according to claim 8, characterized in that: The analysis of the abnormality detection result to determine whether there is a network security abnormality specifically includes the following steps: According to the communication relationship between devices, an interaction matrix is ​​constructed, and each element in the interaction matrix represents the communication strength between two devices; Calculate the probability of anomalies propagating from the source device to the target device based on the communication strength and communication behavior; Screen out high-risk transmission paths based on the probability of transmission and the importance of the equipment; Based on the network topology, recursive jump propagation is performed starting from the abnormal source device, and the propagation probability is updated in a decaying manner during each recursive process; After the recursion is completed, the propagation range is obtained, and the propagation impact score is obtained based on the importance of the devices in the propagation range and the propagation probability; Extracting abnormal features from the abnormality detection results, the abnormal features include abnormality severity, abnormality frequency and abnormality type; The severity, frequency and type of anomalies are weighted and summed, and the weighted sum result is combined with the propagation impact score to obtain a comprehensive impact score. The comprehensive impact score is nonlinearly amplified, and then corrected using the historical abnormal trend as a reference to obtain a corrected comprehensive impact score. Whether there is a network security anomaly is determined based on the corrected comprehensive impact score.

10. An anomaly detection system for network security, applied to the anomaly detection method for network security according to any one of claims 1 to 9, characterized in that: The system includes an initial anomaly analysis unit, a device association analysis unit, an auxiliary device screening unit, a data association transmission unit and an anomaly detection processing unit, wherein: An initial anomaly analysis unit is used to perform real-time network occupancy monitoring of a target network device, obtain occupancy monitoring data, perform initial anomaly analysis on the occupancy monitoring data, and determine whether there is a suspicious anomaly; A device association analysis unit, used to perform association analysis on the target network device and screen multiple associated online devices when there is a suspicious anomaly; an auxiliary device screening unit, configured to obtain device operation data of a plurality of the associated online devices, analyze the plurality of the device operation data, and screen an auxiliary network device from the plurality of the associated online devices; A data association transmission unit, used for acquiring the network monitoring data of the target network device, and transmitting the network monitoring data to the auxiliary network device in an associated manner; The anomaly detection processing unit is used to perform anomaly detection on the network monitoring data through the auxiliary network device, generate anomaly detection results and perform corresponding anomaly processing.

Images