Network threat perception defense strategy optimization system and method based on machine learning

Abstract

The invention belongs to the technical field of network security, and discloses a network threat perception defense strategy optimization system and method based on machine learning. The method comprises the following steps: acquiring traffic level data, log level data and user level data in a single session; constructing an original sample based on the traffic level data, the log level data and the user level data, inputting the original sample into a pre-trained anomaly recognition model, and outputting a corresponding network information category; constructing an adversarial sample based on the original sample; combining the adversarial sample and the original sample into an expanded training set, marking the adversarial sample by using a network information category corresponding to the original sample, and performing secondary training on the anomaly recognition model to obtain an anomaly recognition model after adversarial optimization; according to the invention, the network protection capability is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and more specifically, the present invention relates to a network threat perception defense strategy optimization system and method based on machine learning. Background Art

[0002] In the field of network security technology, attackers often use adversarial sample technology to add tiny and carefully designed disturbances to the original network traffic to generate malicious samples that are almost indistinguishable from normal samples.

[0003] The existing Chinese patent application with publication number CN118573405A discloses a network security threat detection and defense system based on artificial intelligence, including an acquisition module, a data processing module, a machine learning model training module, a threat detection module, a defense module and a display module. The acquisition module is data-connected to the data processing module, the data processing module is data-connected to the machine learning model training module, and is electrically connected to the display module. The machine learning model training module is data-connected to the threat detection module, and the threat detection module is data-connected to the defense module. The beneficial effect of the invention is that it realizes automated and intelligent detection and defense of network security threats, reducing the cost and risk of manual intervention.

[0004] The existing Chinese patent with authorization announcement number CN118337526B discloses a method for generating adversarial attack samples. The improved Wasserstein GAN network designed independently is used to learn the characteristics of benign traffic, so as to disguise malicious traffic and generate adversarial attack samples, so as to use adversarial attack samples to better test and upgrade the machine learning-based intrusion detection system. The improved Wasserstein GAN network introduces a multi-generator structure in the Wasserstein GAN network and adds a distortion rate to the generator loss function. The invention has a wider range of application scenarios. It can generate adversarial network traffic without knowing the detailed information of the target model, so that the generated adversarial attack samples conform to the actual attack scenario, thereby being able to more accurately improve the performance of the intrusion detection system.

[0005] The existing technology still has the following problems:

[0006] Through adversarial samples, attackers can bypass security monitoring systems and successfully and continuously carry out various malicious behaviors, while the system is difficult to effectively identify and respond to these threats. In the existing technology, there is still a lack of means to predict network information categories based on adversarial samples at the network level, system level, and application interaction level, set dynamic network defense strategies, and further improve the security of the target network.

[0007] In view of this, the present invention proposes a network threat perception defense strategy optimization system and method based on machine learning to solve the above problems. Summary of the invention

[0008] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions:

[0009] The network threat perception and defense strategy optimization method based on machine learning includes:

[0010] Get traffic-level data, log-level data, and user-level data within a single session;

[0011] Based on the traffic level data, log level data and user level data, the original samples are constructed, the original samples are input into the pre-trained anomaly recognition model, and the corresponding network information category is output;

[0012] Based on the original sample, construct an adversarial sample;

[0013] The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0014] Based on the traffic level data, log level data and user level data, the data is input into the adversarial optimized anomaly recognition model deployed online to output the final network information category;

[0015] Based on the final network information classification, dynamic defense strategies are executed.

[0016] Furthermore, the method for constructing the adversarial sample includes:

[0017] Randomly extract original samples and obtain the corresponding feature vectors; define the perturbation strategy in combination with the black-box strategy; adjust the feature vector according to the perturbation strategy to generate adversarial samples.

[0018] Furthermore, the traffic level data includes IP address, port number, protocol type, traffic size and data packet arrival time; the log level data includes login success rate and number of system calls; the user level data includes user session duration and number of access paths corresponding to a single session;

[0019] The definition method of the disturbance strategy includes:

[0020] For traffic level data, characters in the request header of the data packet are adjusted;

[0021] For log-level data, the login success rate and system call count are adjusted to a minimum within the preset range.

[0022] For user-level data, the user session duration is randomly perturbed with a preset perturbation amplitude; the number of access paths is adjusted to a preset suspicious threshold.

[0023] Furthermore, the training method of the anomaly recognition model includes:

[0024] Step B1, collecting historical raw data; the historical raw data includes traffic level data, log level data and user level data;

[0025] Step B2: extract features from historical original data to obtain feature vectors corresponding to the original samples;

[0026] Step B3, marking the network information category corresponding to the feature vector;

[0027] Step B4: taking the feature vector and the corresponding network information category as a sample set, and randomly selecting a test set from the sample set according to a preset ratio; constructing a classifier, taking the feature vector as input data, and taking the corresponding network information category as output data, training the classifier to obtain an initial classifier, testing the initial classifier using the test set, and outputting the initial classifier that meets the preset evaluation index as an anomaly recognition model, wherein the classifier is a multilayer perceptron.

[0028] Furthermore, the method of aggregating the traffic level data, log level data and user level data into a single session includes:

[0029] Step A1: When the application server responds, a Session ID corresponding to the current session is generated to identify the conversation; the Session ID is stored in a Cookie, and subsequent action requests of the session are automatically accompanied by Cookie: Session;

[0030] Step A2: Decode the HTTP request header using a packet capture tool, and record the traffic level data corresponding to the Session in the packet capture log;

[0031] Step A3: Map the log level data and user level data to the corresponding Session ID identifier;

[0032] Step A4: Use Session ID as the primary key to associate and aggregate traffic level data, log level data, and user level data.

[0033] Furthermore, the network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack; the marking method of the network information categories includes: normal is marked as 1; DDoS attack is marked as 2; SQL injection is marked as 3; automated attack script is marked as 4; combined attack is marked as 5.

[0034] Furthermore, the dynamic defense strategy includes:

[0035] If the network information category is normal, maintain the existing protection status;

[0036] If the network information category is DDoS attack, block the source IP address and enable traffic cleaning;

[0037] If the network information category is SQL injection, update the Web application firewall rules and perform data tampering checks on the affected databases;

[0038] If the network information category is an automated attack script, the source IP address corresponding to the session is added to the firewall blacklist to restrict access to specific ports and services;

[0039] If the network information category is a combined attack, the session data is recorded and the threat source is traced, and the corresponding data is used for continuous optimization of subsequent anomaly recognition models.

[0040] Furthermore, the IP address includes a source IP address and a destination IP address; the IP address is recorded as an integer value; the port number includes a source port and a destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP; the protocol type is mapped to a number; the traffic size is the length of the data packet, and the recording method is a floating point type.

[0041] Furthermore, the feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration and number of access paths; the length of the feature vector is 11.

[0042] A network threat perception defense strategy optimization system based on machine learning, implementing the network threat perception defense strategy optimization method based on machine learning, including:

[0043] A data acquisition module is used to acquire traffic level data, log level data and user level data within a single session;

[0044] The anomaly recognition module constructs original samples based on traffic level data, log level data and user level data, inputs the original samples into the pre-trained anomaly recognition model, and outputs the corresponding network information category;

[0045] The adversarial generation module constructs adversarial samples based on the original samples;

[0046] The adversarial training module combines the adversarial samples and the original samples into an expanded training set. After annotating the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain an adversarially optimized anomaly recognition model.

[0047] The online deployment module inputs the traffic level data, log level data and user level data into the adversarial optimized anomaly recognition model deployed online, and outputs the final network information category;

[0048] The defense execution module executes dynamic defense strategies based on the final network information category.

[0049] The technical effects and advantages of the network threat perception defense strategy optimization system and method based on machine learning of the present invention are as follows:

[0050] The present invention combines network-level data, system-level data and user-level data, and integrates them into a single session in three dimensions. Then, the original samples consisting of the network-level data, system-level data and user-level data corresponding to the single session are input into the multi-layer perceptron model, and the network information category is output. Then, adversarial samples are constructed based on the original samples, and the multi-layer perceptron model, i.e., the anomaly recognition model, is adversarially optimized to improve the robustness of the anomaly recognition model and the ability to resist adversarial attacks. Finally, a dynamic defense strategy is output according to the anomaly recognition model after adversarial optimization, thereby realizing intelligent and real-time network security protection and effectively improving the overall security and protection level of the target network.

[0051] At the same time, the present invention aggregates and analyzes data based on a single session, optimizes the data processing flow, improves the utilization efficiency of system resources, and can effectively adapt to high-concurrency and large-scale network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a schematic diagram of a network threat perception defense strategy optimization system based on machine learning according to Embodiment 1 of the present invention;

[0053] Figure 2 This is a flow chart of a network threat perception defense strategy optimization method based on machine learning according to Embodiment 2 of the present invention;

[0054] Figure 3 This is a schematic diagram of anomaly recognition model training according to Embodiment 1 of the present invention;

[0055] Figure 4 This is a schematic diagram of the system interface for implementing dynamic defense strategies based on network information categories in Example 1 of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Example 1

[0058] See also Figure 1 As shown, the network threat perception defense strategy optimization system based on machine learning described in this embodiment includes: a first acquisition module, a second acquisition module, a third acquisition module, an anomaly identification module, an adversarial generation module, an adversarial training module, an online deployment module and a defense execution module, and each module is connected by wired and / or wireless connection.

[0059] The first acquisition module is used to obtain the traffic level data of the target network within a single session, and the traffic level data includes IP address, port number, protocol type, traffic size and data packet arrival time; the IP address includes source IP address and destination IP address; the IP address is recorded as an integer value; the port number includes source port and destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP, etc.; the protocol type is mapped to a number, for example, TCP is recorded as 1, UDP is recorded as 2, and ICMP is recorded as 3; the traffic size is the length of the data packet, and the recording method is floating point type.

[0060] It should be noted that a single session is an analysis granularity; the starting point of a single session is when the user / attacker logs in; the process of a single session includes traffic exchange (i.e., traffic-level data), system log records (i.e., log-level data), and user interaction behavior (i.e., user-level data); the end point of a single session is when the user / attacker logs out or disconnects.

[0061] By obtaining the source IP address, the system can trace the address that initiated the communication request; by obtaining the destination IP address, the system can determine the target server of the attack traffic; by obtaining the IP address, it helps to improve the accuracy of anomaly identification in subsequent anomaly identification models; for example, within a single session, if the same source IP address connects to multiple ports multiple times and attempts to traverse different protocol types, it is considered to be an automated attack script, and combined with subsequent log-level data and user-level data to further determine whether it is an automated attack script.

[0062] Some common ports are easy to become attack targets, such as 22 (SSH), 80 / 443 (HTTP / HTTPS), etc. Large-scale scans are usually concentrated on common ports; obtaining the port number can help improve the accuracy of subsequent anomaly recognition models; for example, if a large number of connections to unconventional ports appear in a short period of time in a single session, it is considered to be a malicious traffic attack. Combined with subsequent log-level data and user-level data, it can be further determined whether it is a malicious traffic attack.

[0063] Different protocol types have different common attack methods. For example, UDP flood attacks and ICMP flood attacks are common methods of DDoS attacks. Protocol type is an important discrete feature. By obtaining the protocol type, it helps the subsequent anomaly recognition model to distinguish network communication scenarios, thereby improving the accuracy of identifying network information categories.

[0064] Traffic size is an important data distribution feature. For example, if a large number of fixed-size packets are detected in a single session, the system considers them to be batch requests from automated attack scripts. If a packet whose length is not within the preset range is detected in a single session, the system considers them to be a pay-l oad anomaly during SQL injection.

[0065] Network attacks usually have the characteristic of "extraordinary rates"; the time interval between malicious traffic and normal traffic is usually shorter; by obtaining the arrival time of the data packet and combining it with the traffic size characteristics in the subsequent anomaly recognition model, it helps to determine the bandwidth usage and improve the accuracy of identifying DDoS attacks.

[0066] It should be noted that the unit of the data packet arrival time is milliseconds or microseconds.

[0067] The IP address is located in the IP header of the data packet and is obtained through a packet capture tool; the port number is obtained through a network layer log or a packet capture tool; the protocol type, traffic size and data packet arrival time are obtained through a packet capture tool; the packet capture tool may be Wi reshark, NetF l ow, etc.

[0068] The second acquisition module is used to obtain the log-level data of the target network, and the log-level data includes the login success rate and the number of system calls; the login success rate is the percentage of successful logins in a single session to all login attempts; the number of system calls refers to the frequency of the target host calling the operating system kernel in a single session; the calls include file reading and writing, process creation, network requests and registry operations, etc.

[0069] It should be noted that if the number of login attempts made by a source IP address in a single session is greater than the preset login threshold, and the login success rate is less than the preset success rate threshold, it means that the other party (i.e. the client corresponding to the source IP address) is performing brute force cracking or vulnerability scanning; by obtaining the login success rate, it helps the subsequent anomaly recognition model to distinguish between "repeated trial and error without success (network attack behavior)" and "high concurrency of successful normal business logins (crawlers or legitimate loads)", thereby effectively improving the discrimination ability of the anomaly recognition model.

[0070] Exemplarily, the preset login number threshold is 10 times, the preset success rate threshold is 20%, and there are 50 login attempts in a single session, only 1 is successful, and the login success rate is 2%, which means that the other party is performing brute force cracking.

[0071] It should be noted that relying solely on network traffic data may not be able to determine whether internal processes or file operations are abnormal; the number of system calls can be closer to the internal operations of the host and help identify malicious activities performed locally. Especially in cloud host or container scenarios, the number of system calls is an important security monitoring indicator.

[0072] Malware usually calls system resources at a high frequency, such as encrypting, modifying, or continuously creating child processes for scanning a large number of files in a short period of time. If the system calls in a single session exceed the call threshold, it means that the host corresponding to the system has been implanted with malicious scripts. By obtaining the number of system calls, it helps the subsequent anomaly recognition model adapt to different host scenarios, thereby improving the robustness of the anomaly recognition model.

[0073] The method for obtaining the login success rate includes: counting the number of successful logins and the total number of attempted logins in a single session, dividing the number of successful logins by the total number of attempted logins, and calculating the login success rate; the number of successful logins and the total number of attempted logins are obtained through system logs.

[0074] The number of system calls is obtained through a Windows event log or a security component of a container platform; the security component may be Falco in a Docker container platform, etc.

[0075] The third acquisition module is used to obtain user-level data of the target network, where the user-level data includes the user session duration and the number of access paths corresponding to a single session; the user session duration is the time difference from user login to user logout, in milliseconds; the number of access paths is the number of clicks of the user in a single session.

[0076] It should be noted that network-level data cannot directly reflect session duration; log-level data can indicate whether a login is successful, but it cannot reflect session duration; and user session duration is the most intuitive indicator of user access behavior. Combining network-level data and log-level data can help improve the accuracy of subsequent anomaly identification models in judging abnormal user behavior; for example, if the user session duration is greater than the preset duration threshold, and the number of system calls is greater than the preset number threshold, it means that the user has remained active for a long time and maintained an ultra-high frequency of call operations, which means that the infiltration attacker has been conducting a long-term survey in the system.

[0077] It should be noted that there are usually two ways of network attacks. One is that automated scripts perform covert operations in the background; the other is that real malicious users posing as normal users carry out latent attacks. By obtaining user session duration and access path data, the actual situation of human-computer interaction can be reflected, which helps the subsequent anomaly recognition model to distinguish between "legitimate large-volume access", "malicious automated attacks" and "unreasonable user behavior", thereby outputting different network information categories and improving the accuracy of the anomaly recognition model.

[0078] It should be noted that the number of system calls is a host-level indicator, which focuses on the process's calling behavior on the host system resources, which helps to identify malicious scripts or ransomware operations inside the host in subsequent anomaly identification models; the number of access paths is an application-level indicator, which focuses on user clicks and page requests on the target network, etc., which helps to identify high-frequency crawlers, scans and abnormal clicks in subsequent anomaly identification models; using the number of system calls and the number of access paths as input features of the subsequent anomaly identification model greatly improves the accuracy of the anomaly identification model.

[0079] The method for obtaining the user session duration includes:

[0080] The absolute value of the difference between the timestamp when the user logged in and the timestamp when the user logged out is taken to calculate the user session duration; the timestamps are obtained through the application server log or the system's Session management.

[0081] The number of access paths is obtained through the Web server access log.

[0082] Aggregate the traffic level data, log level data and user level data into the same session dimension and associate them with the Session ID; the association method includes:

[0083] Step A1: When the application server responds, it generates a Session ID corresponding to the current session to identify the dialog; the Session ID is stored in a Cookie, and subsequent behavior requests of the session automatically carry Cookie: Session, ensuring that all requests belonging to the session carry the same identifier.

[0084] Step A2: Decode the HTTP request header through the packet capture tool, and record the traffic level data corresponding to the Session in the packet capture log; thereby realizing the marking of "one session corresponds to one Session ID" in the traffic level data.

[0085] Step A3: Map the log level data and user level data to the corresponding Session ID identifier.

[0086] Step A4: Using Session ID as the primary key, associate and aggregate the traffic level data, log level data, and user level data to obtain complete information on the same session in three dimensions: network level, system level, and application interaction level.

[0087] The anomaly recognition module constructs original samples based on traffic level data, log level data and user level data, inputs the original samples into a pre-trained anomaly recognition model, and outputs corresponding network information categories; the network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack.

[0088] The normal means that no malicious features are detected in the session; the DDoS attack means that the main behavioral features of the session are related to distributed denial of service, such as protocol flooding; the SQL injection means that suspicious database query requests appear in the session, such as injection statements included in http parameters; the automated attack script means that the characteristics of the session are consistent with the automated script activities, such as large-scale access in a short period of time and a large number of fixed-size data packets; the combined attack means that two or more attack methods of DDoS attack, SQL injection and automated attack script appear in the session at the same time.

[0089] See also Figure 3 As shown, the training method of the anomaly recognition model includes:

[0090] Step B1, collecting historical raw data; the historical raw data includes traffic level data, log level data and user level data.

[0091] Step B2: extract features from historical raw data to obtain a feature vector corresponding to the original sample; the feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration, and number of access paths; the length of the feature vector is 11.

[0092] Step B3, marking the network information category corresponding to the feature vector; the marking method of the network information category includes: normal marking as 1; DDoS attack marking as 2; SQL injection marking as 3; automated attack script marking as 4; combined attack marking as 5.

[0093] It should be noted that the network information category corresponding to the feature vector is annotated by the staff in this field when collecting historical original data; the historical original data is recorded by simulating normal access to the system and various attacks.

[0094] Step B4: taking the feature vector and the corresponding network information category as a sample set, and randomly selecting a test set from the sample set according to a preset ratio; constructing a classifier, taking the feature vector as input data, and taking the corresponding network information category as output data, training the classifier to obtain an initial classifier, testing the initial classifier using the test set, and outputting an initial classifier that meets preset evaluation indicators (such as precision and recall, etc.) as an anomaly recognition model, wherein the classifier is a multilayer perceptron.

[0095] The structure of the multilayer perceptron specifically includes:

[0096] The multilayer perceptron includes 1 input layer, 3 hidden layers, and 1 output layer; the dimension of the input layer is 11; the dimension of the output layer is 5.

[0097] It should be noted that the dimensions of the input layer include source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration and number of access paths.

[0098] The adversarial generation module constructs adversarial samples based on the original samples.

[0099] Adversarial samples are samples that add very small perturbations to the original samples to confuse the deep learning model, causing it to produce incorrect outputs. By constructing adversarial samples, the model can see and learn this intentionally added hidden changes during the training phase, making it more robust in actual adversarial situations.

[0100] The method for constructing the adversarial sample includes:

[0101] Randomly extract original samples and obtain the corresponding feature vectors; define the perturbation strategy in combination with the black-box strategy; adjust the feature vector according to the perturbation strategy to generate adversarial samples.

[0102] It should be noted that under the black box strategy, only the prediction interface of the model can be called, and its internal weights are unknown. Therefore, the most effective perturbation is selected by constantly trying various small modifications and observing the changes in the model output.

[0103] It should be noted that after generating adversarial samples, the labels of the original samples are still used (for example, if the original sample is a DDoS attack, the DDoS attack label is retained) so that the anomaly recognition model can adapt to such minor perturbations during optimization training.

[0104] The definition method of the disturbance strategy includes:

[0105] For traffic level data, the characters of the request header of the data packet are adjusted, making it difficult for the anomaly recognition model to rely on the fixed header format to determine the category of network information.

[0106] For example, meaningless fragment characters are inserted into the Cookie field; additional spaces are inserted between the key-value pairs of the HTTP Header without disrupting the protocol parsing.

[0107] For log-level data, the login success rate and system call count are adjusted to a preset minimum, thereby increasing the sensitivity of the anomaly recognition model to log-level data.

[0108] For example, the original login success rate is 10%, and a false login success (login success identifier) ​​is inserted into the log to increase the login success rate, so that the login success rate is increased to 15%.

[0109] Exemplarily, by adding a system call record in the host security log, the number of system calls is increased by a preset amount.

[0110] For user-level data, the user session duration is randomly perturbed with a preset disturbance amplitude; the number of access paths is adjusted to a preset suspicious threshold, making it difficult for the anomaly recognition model to judge the output network information category based on a large number of clicks.

[0111] Exemplarily, if the user session duration is greater than or equal to a first judgment threshold, a maintenance script is inserted to shorten the session duration by a preset amount; if the user session duration is less than a second judgment threshold, the session duration is extended by a preset amount; and the second judgment threshold is much smaller than the first judgment threshold.

[0112] Exemplarily, the number of access paths corresponding to a session is 80 clicks, and the suspicious threshold of the number of access paths is preset to 100 clicks. Then, additional page clicks are simulated through an automated script to adjust the number of access paths corresponding to the session to 100 clicks.

[0113] The adversarial training module combines the adversarial samples and the original samples into an expanded training set. After annotating the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0114] It should be noted that in the testing phase of the adversarial enhanced anomaly recognition model, the original test set and some adversarial test samples are used to evaluate the robustness of the model to small perturbations.

[0115] The online deployment module inputs the traffic level data, log level data and user level data into the adversarial optimized anomaly recognition model deployed online and outputs the final network information category.

[0116] Defense Execution Module, see Figure 4 As shown, dynamic defense strategies are executed based on the final network information category.

[0117] The dynamic defense strategy includes:

[0118] If the network information category is normal, maintain the existing protection status.

[0119] If the network information category is DDoS attack, the source IP address is blocked and traffic cleaning is enabled to reduce the impact of the attack on the network.

[0120] If the network information category is SQL injection, update the Web application firewall rules and perform data tampering checks on the affected database.

[0121] If the network information category is an automated attack script, the source IP address corresponding to the session will be added to the firewall blacklist to restrict its access to specific ports and services; the specific ports include 22 (SSH), 80 / 443 (HTTP / HTTPS), etc.

[0122] If the network information category is a combined attack, the session data will be recorded and the threat will be traced to ensure that the attack is completely contained. At the same time, the corresponding data will be used for continuous optimization of subsequent anomaly recognition models.

[0123] Example 2

[0124] See also Figure 2 As shown, this embodiment provides a network threat perception defense strategy optimization method based on machine learning, including:

[0125] Get traffic-level data, log-level data, and user-level data within a single session;

[0126] Based on the traffic level data, log level data and user level data, the original samples are constructed, the original samples are input into the pre-trained anomaly recognition model, and the corresponding network information category is output;

[0127] Based on the original sample, construct an adversarial sample;

[0128] The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0129] Based on the traffic level data, log level data and user level data, the data is input into the adversarial optimized anomaly recognition model deployed online to output the final network information category;

[0130] Based on the final network information classification, dynamic defense strategies are executed.

[0131] Example 3

[0132] In a real environment, attackers can only observe the model judgment results through network interfaces or API calls; constructing adversarial samples based on black-box strategies helps to better simulate network attack information during real adversarial situations; but since black-box strategies usually require repeated trials of small changes and continuous querying of model outputs, the efficiency of constructing adversarial samples still needs to be further improved; this embodiment further improves on the basis of embodiment 1, constructs adversarial samples based on the white-box PGD algorithm, and supplements the number of adversarial samples in embodiment 1; the method for constructing adversarial samples also includes:

[0133]

[0134] Among them, x is the feature vector corresponding to the original sample; is the adversarial sample at the tth iteration; t is the number of iterations; is the adversarial sample at the t+1th iteration; α is the update step size of each iteration; θ is the model parameter in the anomaly recognition model trained based on the original sample; y is the network information category; It is the loss function of the anomaly recognition model trained based on the original samples, which is obtained by reading the model parameter file after training. is the gradient of the loss function with respect to x, which indicates the probability of misjudgment for a small perturbation in each dimension of x, and is calculated using the automatic differentiation formula in pytorch; is a symbolic function used to maximize the effect of a small perturbation in each dimension of x on the loss; ε is a preset perturbation norm constraint; It is a projection operation, which is used to limit the updated original sample (i.e., adversarial sample) to a region that is no more than ε from the original sample to avoid excessive perturbation.

[0135] By constructing adversarial samples based on the white-box PGD algorithm to further supplement the total number of adversarial samples, it helps to improve the efficiency of data set acquisition during secondary training. At the same time, it effectively expands the data set during secondary training and improves the accuracy of the final anomaly recognition model, thereby improving the rationality of the execution of dynamic defense strategies and further improving the security of network defense.

[0136] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A network threat perception defense strategy optimization method based on machine learning, characterized in that: include: Get traffic-level data, log-level data, and user-level data within a single session; Based on the traffic level data, log level data and user level data, the original samples are constructed, the original samples are input into the pre-trained anomaly recognition model, and the corresponding network information category is output; Based on the original sample, construct an adversarial sample; The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model. Based on the traffic level data, log level data and user level data, the data is input into the adversarial optimized anomaly recognition model deployed online to output the final network information category; Based on the final network information classification, dynamic defense strategies are executed.

2. The network threat perception defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The method for constructing the adversarial sample includes: Randomly extract original samples and obtain the corresponding feature vectors; define the perturbation strategy in combination with the black-box strategy; adjust the feature vector according to the perturbation strategy to generate adversarial samples.

3. The network threat perception defense strategy optimization method based on machine learning according to claim 2 is characterized in that: The traffic level data includes IP address, port number, protocol type, traffic size and data packet arrival time; the log level data includes login success rate and system call times; The user level data includes the user session duration and the number of access paths corresponding to a single session; The definition method of the disturbance strategy includes: For traffic level data, characters in the request header of the data packet are adjusted; For log-level data, the login success rate and system call count are adjusted to a minimum within the preset range. For user-level data, the user session duration is randomly perturbed with a preset perturbation amplitude; the number of access paths is adjusted to a preset suspicious threshold.

4. The network threat perception defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The training method of the anomaly recognition model includes: Step B1, collecting historical raw data; the historical raw data includes traffic level data, log level data and user level data; Step B2: extract features from historical original data to obtain feature vectors corresponding to the original samples; Step B3, marking the network information category corresponding to the feature vector; Step B4: taking the feature vector and the corresponding network information category as a sample set, and randomly selecting a test set from the sample set according to a preset ratio; constructing a classifier, taking the feature vector as input data, and taking the corresponding network information category as output data, training the classifier to obtain an initial classifier, testing the initial classifier using the test set, and outputting the initial classifier that meets the preset evaluation index as an anomaly recognition model, wherein the classifier is a multilayer perceptron.

5. The network threat perception defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The method of aggregating the traffic level data, log level data and user level data into a single session includes: Step A1: When the application server responds, a SessionID corresponding to the current session is generated to identify the conversation; the SessionID is stored in a Cookie, and subsequent behavior requests of the session are automatically accompanied by Cookie: Session; Step A2: Decode the HTTP request header using a packet capture tool, and record the traffic level data corresponding to the Session in the packet capture log; Step A3: Map the log level data and user level data to the corresponding SessionID identifier; Step A4: Use SessionID as the primary key to associate and aggregate the traffic level data, log level data, and user level data.

6. The network threat perception defense strategy optimization method based on machine learning according to claim 4 is characterized in that: The network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack; The marking method of the network information category includes: normal marking is 1; DDoS attack marking is 2; SQL injection marking is 3; automated attack script marking is 4; and combined attack marking is 5.

7. The network threat perception defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The dynamic defense strategy includes: If the network information category is normal, maintain the existing protection status; If the network information category is DDoS attack, block the source IP address and enable traffic cleaning; If the network information category is SQL injection, update the Web application firewall rules and perform data tampering checks on the affected databases; If the network information category is an automated attack script, the source IP address corresponding to the session is added to the firewall blacklist to restrict access to specific ports and services; If the network information category is a combined attack, the session data is recorded and the threat source is traced, and the corresponding data is used for continuous optimization of subsequent anomaly recognition models.

8. The network threat perception defense strategy optimization method based on machine learning according to claim 3 is characterized in that: The IP address includes the source IP address and the destination IP address; the IP address is recorded as an integer value; the port number includes the source port and the destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP; the protocol type is mapped to a number; the traffic size is the length of the data packet, recorded as a floating point type.

9. The network threat perception defense strategy optimization method based on machine learning according to claim 4 is characterized in that: The feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration and number of access paths; the length of the feature vector is 11.

10. A network threat perception defense strategy optimization system based on machine learning, implementing the network threat perception defense strategy optimization method based on machine learning according to any one of claims 1 to 9, characterized in that: include: A data acquisition module is used to acquire traffic level data, log level data and user level data within a single session; The anomaly recognition module constructs original samples based on traffic level data, log level data and user level data, inputs the original samples into the pre-trained anomaly recognition model, and outputs the corresponding network information category; The adversarial generation module constructs adversarial samples based on the original samples; The adversarial training module combines the adversarial samples and the original samples into an expanded training set. After annotating the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain an adversarially optimized anomaly recognition model. The online deployment module inputs the traffic level data, log level data and user level data into the adversarial optimized anomaly recognition model deployed online, and outputs the final network information category; The defense execution module executes dynamic defense strategies based on the final network information category.

Images