Network threat perception and defense strategy optimization system and method based on machine learning

Abstract

The present invention belongs to the field of network security technology, and discloses a network threat perception and defense strategy optimization system and method based on machine learning; the method comprises: obtaining traffic level data, log level data and user level data in a single session; constructing original samples based on the traffic level data, log level data and user level data, inputting the original samples into a pre-trained anomaly recognition model, and outputting corresponding network information categories; constructing adversarial samples based on the original samples; merging the adversarial samples and the original samples into an expanded training set, annotating the adversarial samples with the network information categories corresponding to the original samples, and then performing secondary training on the anomaly recognition model to obtain an adversarially optimized anomaly recognition model; the present invention effectively improves the protection capability of the network.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and more specifically, the present invention relates to a network threat perception and defense strategy optimization system and method based on machine learning. Background Art

[0002] In the field of network security technology, attackers often use adversarial sample technology to add tiny and carefully designed perturbations to original network traffic to generate malicious samples that are almost indistinguishable from normal samples.

[0003] An existing Chinese patent application, publication number CN118573405A, discloses an AI-based network security threat detection and defense system, comprising an acquisition module, a data processing module, a machine learning model training module, a threat detection module, a defense module, and a display module. The acquisition module is data-connected to the data processing module, which is data-connected to the machine learning model training module and electrically connected to the display module. The machine learning model training module is data-connected to the threat detection module, which is data-connected to the defense module. This invention has the beneficial effect of enabling automated and intelligent detection and defense of network security threats, reducing the cost and risk of manual intervention.

[0004] The existing Chinese patent with authorization announcement number CN118337526B discloses a method for generating adversarial attack samples. This method utilizes an independently designed improved Wasserstein GAN network to learn the characteristics of benign traffic, which is then used to disguise malicious traffic and generate adversarial attack samples. The adversarial attack samples are then used to better test and upgrade machine learning-based intrusion detection systems. The improved Wasserstein GAN network introduces a multi-generator structure into the Wasserstein GAN network and adds a distortion rate to the generator loss function. This invention has a wider range of application scenarios. It can generate adversarial network traffic without knowing the detailed information of the target model. This ensures that the generated adversarial attack samples conform to the actual attack scenario, thereby more accurately improving the performance of the intrusion detection system.

[0005] The existing technology still has the following problems:

[0006] Adversarial examples allow attackers to bypass security monitoring systems and successfully and persistently carry out various malicious behaviors, making it difficult for the system to effectively identify and respond to these threats. Existing technologies lack the ability to predict network information categories based on adversarial examples at the network, system, and application interaction levels, and to set dynamic network defense strategies, thereby further improving the security of target networks.

[0007] In view of this, the present invention proposes a network threat perception and defense strategy optimization system and method based on machine learning to solve the above problems. Summary of the Invention

[0008] In order to overcome the above-mentioned defects of the prior art and achieve the above-mentioned objectives, the present invention provides the following technical solutions:

[0009] The network threat perception and defense strategy optimization method based on machine learning includes:

[0010] Obtain traffic-level data, log-level data, and user-level data within a single session;

[0011] Based on traffic-level data, log-level data, and user-level data, we construct original samples, input them into the pre-trained anomaly recognition model, and output the corresponding network information category.

[0012] Construct adversarial samples based on the original samples;

[0013] The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0014] Based on traffic, log, and user data, the data is fed into the adversarially optimized anomaly recognition model deployed online, which then outputs the final network information category.

[0015] Based on the final network information classification, dynamic defense strategies are executed.

[0016] Furthermore, the method for constructing the adversarial sample includes:

[0017] Randomly extract original samples and obtain the corresponding feature vectors; define the perturbation strategy in combination with the black-box strategy; adjust the feature vector according to the perturbation strategy to generate adversarial samples.

[0018] Furthermore, the traffic level data includes IP address, port number, protocol type, traffic volume and packet arrival time; the log level data includes login success rate and number of system calls; the user level data includes user session duration and number of access paths corresponding to a single session;

[0019] The method for defining the disturbance strategy includes:

[0020] For traffic-level data, perform character adjustment on the request header of the data packet;

[0021] For log-level data, minimize changes to the login success rate and system call count by a preset adjustment range;

[0022] For user-level data, the user session duration is randomly perturbed with a preset perturbation amplitude; the number of access paths is adjusted to a preset suspicious threshold.

[0023] Furthermore, the training method of the anomaly recognition model includes:

[0024] Step B1: Collect historical raw data; the historical raw data includes traffic level data, log level data, and user level data;

[0025] Step B2: Extract features from the historical original data to obtain feature vectors corresponding to the original samples;

[0026] Step B3: label the network information category corresponding to the feature vector;

[0027] Step B4: Take the feature vector and the corresponding network information category as a sample set, and randomly select a test set from the sample set according to a preset ratio; construct a classifier, take the feature vector as input data, and the corresponding network information category as output data, train the classifier to obtain an initial classifier, test the initial classifier using the test set, and output the initial classifier that meets the preset evaluation indicators as the anomaly recognition model, wherein the classifier is a multilayer perceptron.

[0028] Furthermore, the method of aggregating the traffic level data, log level data, and user level data into a single session includes:

[0029] Step A1: When the application server responds, it generates a Session ID corresponding to the current session to identify the conversation; the Session ID is stored in a cookie, and subsequent action requests for the session automatically carry Cookie ie: Session;

[0030] Step A2: Decode the HTTP request header using a packet capture tool and record the traffic level data corresponding to the session in the packet capture log.

[0031] Step A3: Map the log level data and user level data to the corresponding Session ID identifiers;

[0032] Step A4: Use Session ID as the primary key to associate and aggregate traffic-level data, log-level data, and user-level data.

[0033] Furthermore, the network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack; the marking method of the network information category includes: normal is marked as 1; DDoS attack is marked as 2; SQL injection is marked as 3; automated attack script is marked as 4; combined attack is marked as 5.

[0034] Furthermore, the dynamic defense strategy includes:

[0035] If the network information category is normal, the existing protection status will be maintained;

[0036] If the network information category is DDoS attack, block the source IP address and enable traffic scrubbing;

[0037] If the network information category is SQL injection, update the web application firewall rules and perform data tampering checks on the affected database;

[0038] If the network information category is an automated attack script, the source IP address corresponding to the session will be added to the firewall blacklist to restrict access to specific ports and services;

[0039] If the network information category is a combined attack, the session data will be recorded and the threat source will be traced. At the same time, the corresponding data will be used for continuous optimization of subsequent anomaly identification models.

[0040] Furthermore, the IP address includes a source IP address and a destination IP address; the IP address is recorded as an integer value; the port number includes a source port and a destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP; the protocol type is mapped to a number; the traffic size is the length of the data packet, and the recording method is floating point type.

[0041] Furthermore, the feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration and number of access paths; the length of the feature vector is 11.

[0042] A network threat perception and defense strategy optimization system based on machine learning, which implements the network threat perception and defense strategy optimization method based on machine learning, includes:

[0043] Data acquisition module, used to obtain traffic level data, log level data and user level data within a single session;

[0044] The anomaly recognition module constructs original samples based on traffic level data, log level data, and user level data, inputs the original samples into the pre-trained anomaly recognition model, and outputs the corresponding network information category;

[0045] The adversarial generation module constructs adversarial samples based on the original samples;

[0046] The adversarial training module combines the adversarial samples and the original samples into an expanded training set. After annotating the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain an adversarially optimized anomaly recognition model.

[0047] The online deployment module inputs traffic-level data, log-level data, and user-level data into the online adversarial optimized anomaly recognition model and outputs the final network information category;

[0048] The defense execution module executes dynamic defense strategies based on the final network information category.

[0049] The technical effects and advantages of the network threat perception and defense strategy optimization system and method based on machine learning of the present invention are as follows:

[0050] The present invention combines network-level data, system-level data and user-level data, and aggregates them into a single session in three dimensions. Then, the original samples consisting of the network-level data, system-level data and user-level data corresponding to the single session are input into the multi-layer perceptron model, and the network information category is output. Then, adversarial samples are constructed based on the original samples, and the multi-layer perceptron model, i.e., the anomaly recognition model, is adversarially optimized to improve the robustness of the anomaly recognition model and its ability to resist adversarial attacks. Finally, a dynamic defense strategy is output based on the anomaly recognition model after adversarial optimization, thereby realizing intelligent and real-time network security protection and effectively improving the overall security and protection level of the target network.

[0051] At the same time, the present invention aggregates and analyzes data based on a single session, optimizes the data processing flow, improves the utilization efficiency of system resources, and can effectively adapt to high-concurrency and large-scale network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a schematic diagram of a network threat perception and defense strategy optimization system based on machine learning according to Example 1 of the present invention;

[0053] Figure 2 This is a flow chart of a method for optimizing network threat perception and defense strategies based on machine learning according to embodiment 2 of the present invention;

[0054] Figure 3 This is a schematic diagram of anomaly recognition model training according to Example 1 of the present invention;

[0055] Figure 4 This is a schematic diagram of the system interface for implementing dynamic defense strategies based on network information categories in Example 1 of the present invention. DETAILED DESCRIPTION

[0056] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0057] Example 1

[0058] See also Figure 1 As shown, the network threat perception and defense strategy optimization system based on machine learning described in this embodiment includes: a first acquisition module, a second acquisition module, a third acquisition module, an anomaly identification module, an adversarial generation module, an adversarial training module, an online deployment module and a defense execution module, and each module is connected by wired and / or wireless connections.

[0059] The first acquisition module is used to obtain the traffic level data of the target network within a single session, and the traffic level data includes IP address, port number, protocol type, traffic size and data packet arrival time; the IP address includes source IP address and destination IP address; the IP address is recorded as an integer value; the port number includes source port and destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP, etc.; the protocol type is mapped to a number, for example, TCP is recorded as 1, UDP is recorded as 2, and ICMP is recorded as 3; the traffic size is the length of the data packet, and is recorded as a floating point type.

[0060] It should be noted that a single session is an analysis granularity; the starting point of a single session is when the user / attacker logs in; the process of a single session includes traffic exchange (i.e., traffic-level data), system log records (i.e., log-level data), and user interaction behavior (i.e., user-level data); the end point of a single session is when the user / attacker logs out or disconnects.

[0061] By obtaining the source IP address, the system can trace the address that initiated the communication request; by obtaining the destination IP address, the system can determine the target server of the attack traffic; by obtaining the IP address, it helps to improve the accuracy of anomaly identification in subsequent anomaly identification models; for example, within a single session, if the same source IP address connects to multiple ports multiple times and attempts to traverse different protocol types, it is considered to be an automated attack script. Combining subsequent log-level data and user-level data can further determine whether it is an automated attack script.

[0062] Some common ports are easy to become attack targets, such as 22 (SSH), 80 / 443 (HTTP / HTTPS), etc. Large-scale scans usually focus on common ports; by obtaining the port number, it helps to improve the accuracy of subsequent anomaly identification models; for example, if a large number of connections to unconventional ports appear in a short period of time in a single session, it is considered to be a malicious traffic attack. Combined with subsequent log-level data and user-level data, it can be further determined whether it is a malicious traffic attack.

[0063] Different protocol types have different common attack methods. For example, UDP flood attacks and ICMP flood attacks are common methods of DDoS attacks. Protocol type is an important discrete feature. By obtaining the protocol type, subsequent anomaly recognition models can distinguish network communication scenarios, thereby improving the accuracy of identifying network information categories.

[0064] Traffic size is an important data distribution feature. For example, if a large number of fixed-size packets are detected in a single session, the system may consider them to be batch requests from an automated attack script. If a packet with a length outside the preset range is detected in a single session, the system may consider it to be a payload anomaly during SQL injection.

[0065] Network attacks are often characterized by "extraordinary rates." The time intervals between malicious traffic and normal traffic are typically shorter. Obtaining the packet arrival time and combining it with traffic size characteristics in subsequent anomaly identification models helps determine bandwidth usage and improves the accuracy of identifying DDoS attacks.

[0066] It should be noted that the unit of the data packet arrival time is milliseconds or microseconds.

[0067] The IP address is located in the IP header of the data packet and is obtained through a packet capture tool; the port number is obtained through a network layer log or a packet capture tool; the protocol type, traffic size and data packet arrival time are obtained through a packet capture tool; the packet capture tool can be Wi reshark, NetF low, etc.

[0068] The second acquisition module is used to obtain log-level data of the target network, and the log-level data includes login success rate and number of system calls; the login success rate is the percentage of successful logins in a single session to all login attempts; the number of system calls refers to the frequency of calls of the target host to the operating system kernel in a single session; the calls include file reading and writing, process creation, network requests and registry operations, etc.

[0069] It should be noted that if the number of login attempts made by a source IP address in a single session is greater than the preset login threshold, and the login success rate is less than the preset success rate threshold, it means that the other party (i.e. the client corresponding to the source IP address) is performing brute force cracking or vulnerability scanning; by obtaining the login success rate, it helps the subsequent anomaly recognition model to distinguish between "repeated trial and error without success (network attack behavior)" and "high concurrency of successful normal business logins (crawlers or legitimate loads)", thereby effectively improving the discrimination ability of the anomaly recognition model.

[0070] For example, the preset login threshold is 10 times, the preset success rate threshold is 20%, and there are 50 login attempts in a single session, only 1 is successful, and the login success rate is 2%, which means that the other party is performing brute force cracking.

[0071] It should be noted that relying solely on network traffic data may not be enough to determine whether internal processes or file operations are abnormal. The number of system calls can more closely reflect the internal operations of the host and help identify malicious activities performed locally. Especially in cloud host or container scenarios, the number of system calls is an important security monitoring indicator.

[0072] Malware typically calls system resources at a high frequency, such as encrypting or modifying a large number of files in a short period of time or continuously creating child processes for scanning. If the system calls within a single session exceed the call threshold, it means that the host corresponding to the system has been implanted with malicious scripts. By obtaining the number of system calls, subsequent anomaly recognition models can be helped to adapt to different host scenarios, thereby improving the robustness of the anomaly recognition model.

[0073] The method for obtaining the login success rate includes: counting the number of successful logins and the total number of attempted logins in a single session, dividing the number of successful logins by the total number of attempted logins, and calculating the login success rate; the number of successful logins and the total number of attempted logins are obtained through system logs.

[0074] The number of system calls is obtained through a Windows event log or a security component of a container platform; the security component may be Fa l co in a Docker container platform, etc.

[0075] The third acquisition module is used to obtain user-level data of the target network. The user-level data includes the user session duration and the number of access paths corresponding to a single session. The user session duration is the time difference between the user's login and logout, in milliseconds. The number of access paths is the number of clicks of the user in a single session.

[0076] It should be noted that network-level data cannot directly reflect the duration of a session; log-level data can indicate whether a login is successful, but it cannot reflect the duration of a session; and user session duration is the most intuitive indicator of user access behavior. Combining network-level data and log-level data can help improve the accuracy of subsequent anomaly identification models in judging abnormal user behavior; for example, if the user session duration is greater than the preset duration threshold, and the number of system calls is greater than the preset number threshold, it means that the user has remained active for a long time and maintained an ultra-high frequency of call operations, which means that the infiltration attacker has been conducting a long-term survey in the system.

[0077] It should be noted that network attacks usually occur in two ways. One is that automated scripts perform covert operations in the background; the other is that real malicious users posing as normal users carry out latent attacks. By obtaining user session duration and access path data, the actual situation of human-computer interaction can be reflected, which helps subsequent anomaly recognition models distinguish between "legitimate large-volume access", "malicious automated attacks" and "unreasonable user behavior", thereby outputting different network information categories and improving the accuracy of the anomaly recognition model.

[0078] It should be noted that the number of system calls is a host-level indicator, focusing on the process's calling behavior on the host system resources, which helps to identify malicious scripts or ransomware operations within the host in subsequent anomaly identification models; the number of access paths is an application-level indicator, focusing on user clicks and page requests on the target network, etc., which helps to identify high-frequency crawlers, scans and abnormal clicks in subsequent anomaly identification models; using the number of system calls and the number of access paths as input features of the subsequent anomaly identification model greatly improves the accuracy of the anomaly identification model.

[0079] The method for obtaining the user session duration includes:

[0080] The user session duration is calculated by taking the absolute value of the difference between the timestamp when the user logs in and the timestamp when the user logs out. The timestamps are obtained through the application server log or the system's Session management.

[0081] The number of access paths is obtained through the Web server access log.

[0082] Aggregate the traffic level data, log level data, and user level data into the same session dimension and associate them with the Session ID. The association method includes:

[0083] Step A1: When the application server responds, it generates a Session ID corresponding to the current session to identify the conversation. The Session ID is stored in a cookie, and subsequent action requests for the session automatically carry Cookie: Session, ensuring that all requests belonging to the session carry the same identifier.

[0084] Step A2: Decode the HTTP request header using a packet capture tool and record the traffic-level data corresponding to the Session in the packet capture log; thereby achieving the marking of "one session corresponds to one Session ID" in the traffic-level data.

[0085] Step A3: Map the log level data and user level data to the corresponding Session ID identifiers.

[0086] Step A4: Using the Session ID as the primary key, correlate and aggregate the traffic-level data, log-level data, and user-level data to obtain complete information on the same session at the network level, system level, and application interaction level.

[0087] The anomaly recognition module constructs original samples based on traffic level data, log level data and user level data, inputs the original samples into the pre-trained anomaly recognition model, and outputs the corresponding network information categories; the network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack.

[0088] The term "normal" indicates that no malicious features were detected in the session; the term "DDoS attack" indicates that the main behavioral features of the session are related to distributed denial of service, such as protocol flooding; the term "SQL injection" indicates that suspicious database query requests appear in the session, such as injection statements contained in http parameters; the term "automated attack script" indicates that the characteristics of the session are consistent with automated script activities, such as large-scale access in a short period of time and a large number of fixed-size data packets; the term "combined attack" indicates that two or more attack methods of DDoS attack, SQL injection and automated attack script appear in the session at the same time.

[0089] See also Figure 3 As shown, the training method of the anomaly recognition model includes:

[0090] Step B1: Collect historical raw data; the historical raw data includes traffic level data, log level data and user level data.

[0091] Step B2: Extract features from historical raw data to obtain a feature vector corresponding to the original sample; the feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration, and number of access paths; the length of the feature vector is 11.

[0092] Step B3: label the network information category corresponding to the feature vector; the labeling method of the network information category includes: normal labeling as 1; DDoS attack labeling as 2; SQL injection labeling as 3; automated attack script labeling as 4; combined attack labeling as 5.

[0093] It should be noted that the network information category corresponding to the feature vector is marked by the staff in this field when collecting historical original data; the historical original data is recorded by simulating normal access to the system and various attacks.

[0094] Step B4: Take the feature vector and the corresponding network information category as a sample set, and randomly select a test set from the sample set according to a preset ratio; construct a classifier, take the feature vector as input data, and the corresponding network information category as output data, train the classifier to obtain an initial classifier, test the initial classifier using the test set, and output the initial classifier that meets preset evaluation indicators (such as precision and recall rate, etc.) as the anomaly recognition model, wherein the classifier is a multilayer perceptron.

[0095] The structure of the multilayer perceptron specifically includes:

[0096] The multilayer perceptron includes 1 input layer, 3 hidden layers, and 1 output layer; the dimension of the input layer is 11; the dimension of the output layer is 5.

[0097] It should be noted that the dimensions of the input layer include source IP address, destination IP address, source port, destination port, protocol type, traffic size, packet arrival time, login success rate, number of system calls, user session duration and number of access paths.

[0098] The adversarial generation module constructs adversarial samples based on the original samples.

[0099] Adversarial samples are samples that add extremely small perturbations to the original samples to confuse the deep learning model, causing it to produce incorrect outputs. By constructing adversarial samples, the model can see and learn these intentionally added hidden changes during the training phase, making it more robust in actual adversarial situations.

[0100] The method for constructing the adversarial sample includes:

[0101] Randomly extract original samples and obtain the corresponding feature vectors; define the perturbation strategy in combination with the black-box strategy; adjust the feature vector according to the perturbation strategy to generate adversarial samples.

[0102] It should be noted that under the black box strategy, only the prediction interface of the model can be called, and its internal weights are unknown. Therefore, the most effective perturbation is selected by constantly trying various small modifications and observing the changes in the model output.

[0103] It should be noted that after generating adversarial samples, the labels of the original samples are still used (for example, if the original sample is a DDoS attack, the DDoS attack label is retained) so that the anomaly recognition model can adapt to such minor perturbations during optimized training.

[0104] The method for defining the disturbance strategy includes:

[0105] For traffic-level data, the characters in the request header of the data packet are adjusted, making it difficult for the anomaly recognition model to rely on the fixed header format to determine the category of network information.

[0106] For example, meaningless fragment characters are inserted into the Cookie field; additional spaces are inserted between the key-value pairs of the HTTP Header without disrupting protocol parsing.

[0107] For log-level data, minimize changes to the login success rate and number of system calls by preset adjustments, thereby increasing the sensitivity of the anomaly recognition model to log-level data.

[0108] For example, the original login success rate is 10%, and a false login success (login success identifier) ​​is inserted into the log to increase the login success rate, so that the login success rate is increased to 15%.

[0109] Exemplarily, by adding a system call record to the host security log, the number of system calls is increased by a preset amount.

[0110] For user-level data, the user session duration is randomly perturbed with a preset disturbance amplitude; the number of access paths is adjusted to a preset suspicious threshold, making it difficult for the anomaly recognition model to judge and output the network information category based on a large number of clicks.

[0111] Exemplarily, if the user session duration is greater than or equal to a first judgment threshold, a maintenance script is inserted to shorten the session duration by a preset amount; if the user session duration is less than a second judgment threshold, the session duration is extended by a preset amount; the second judgment threshold is much smaller than the first judgment threshold.

[0112] For example, the number of access paths corresponding to a session is 80 clicks, and the suspicious threshold of the number of access paths is preset to 100 clicks. Then, additional page clicks are simulated through an automated script to adjust the number of access paths corresponding to the session to 100 clicks.

[0113] The adversarial training module merges the adversarial samples and the original samples into an expanded training set. After labeling the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0114] It should be noted that in the testing phase of the adversarially reinforced anomaly recognition model, the original test set and some adversarial test samples are used to evaluate the robustness of the model to small perturbations.

[0115] The online deployment module inputs traffic-level data, log-level data, and user-level data into the online-deployed adversarial optimized anomaly recognition model and outputs the final network information category.

[0116] Defense Execution Module, see Figure 4 As shown, dynamic defense strategies are executed based on the final network information categories.

[0117] The dynamic defense strategy includes:

[0118] If the network information category is normal, the existing protection status will be maintained.

[0119] If the network information category is a DDoS attack, block the source IP address and enable traffic scrubbing to mitigate the impact of the attack on the network.

[0120] If the network information category is SQL injection, update the web application firewall rules and perform data tampering checks on the affected database.

[0121] If the network information category is an automated attack script, the source IP address corresponding to the session will be added to the firewall blacklist to restrict its access to specific ports and services; the specific ports include 22 (SSH), 80 / 443 (HTTP / HTTPS), etc.

[0122] If the network information category is a combined attack, the session data will be recorded and the threat source will be traced to ensure that the attack is completely contained. At the same time, the corresponding data will be used for continuous optimization of subsequent anomaly recognition models.

[0123] Example 2

[0124] See also Figure 2 As shown, this embodiment provides a network threat perception and defense strategy optimization method based on machine learning, including:

[0125] Obtain traffic-level data, log-level data, and user-level data within a single session;

[0126] Based on traffic-level data, log-level data, and user-level data, we construct original samples, input them into the pre-trained anomaly recognition model, and output the corresponding network information category.

[0127] Construct adversarial samples based on the original samples;

[0128] The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model.

[0129] Based on traffic, log, and user data, the data is fed into the adversarially optimized anomaly recognition model deployed online, which then outputs the final network information category.

[0130] Based on the final network information classification, dynamic defense strategies are executed.

[0131] Example 3

[0132] In a real environment, attackers can only observe the model judgment results through network interfaces or API calls; constructing adversarial samples based on black-box strategies helps to better simulate network attack information during real adversarial situations; however, since black-box strategies usually require repeated trials of small changes and continuous querying of model outputs, the efficiency of constructing adversarial samples still needs to be further improved; this embodiment further improves on the basis of Example 1, constructing adversarial samples based on the white-box PGD algorithm, and supplementing the number of adversarial samples in Example 1; the method for constructing adversarial samples also includes:

[0133]

[0134] Among them, x is the feature vector corresponding to the original sample; is the adversarial sample at the tth iteration; t is the number of iterations; is the adversarial sample at the t+1th iteration; α is the update step size of each iteration; θ is the model parameter in the anomaly recognition model trained based on the original sample; y is the network information category; This is the loss function of the anomaly recognition model trained based on the original samples, obtained by reading the model parameter file after training. is the gradient of the loss function with respect to x, which represents the probability of misjudgment for a small perturbation in each dimension of x, and is calculated using the automatic differentiation formula in PyTorch; is a symbolic function that maximizes the effect of a small perturbation on the loss in each dimension of x; ε is a preset perturbation norm constraint; It is a projection operation used to limit the updated original sample (i.e., adversarial sample) to a region that is no more than ε from the original sample to avoid excessive perturbation.

[0135] By constructing adversarial samples based on the white-box PGD algorithm to further supplement the total number of adversarial samples, it helps to improve the efficiency of data set acquisition during secondary training. At the same time, it effectively expands the data set during secondary training and improves the accuracy of the final anomaly recognition model, thereby improving the rationality of the execution of dynamic defense strategies and further improving the security of network defense.

[0136] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A network threat perception and defense strategy optimization method based on machine learning, characterized in that: include: Obtain traffic-level data, log-level data, and user-level data within a single session; Based on traffic-level data, log-level data, and user-level data, we construct original samples, input them into the pre-trained anomaly recognition model, and output the corresponding network information category. Construct adversarial samples based on the original samples; The adversarial samples and original samples are combined into an expanded training set. After the adversarial samples are labeled with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain the adversarially optimized anomaly recognition model. Based on traffic, log, and user data, the data is fed into the adversarially optimized anomaly recognition model deployed online, which then outputs the final network information category. Execute dynamic defense strategies based on the final network information categories; The method for constructing the adversarial sample includes: Randomly extract original samples and obtain corresponding feature vectors; define perturbation strategies based on black-box strategies; adjust feature vectors according to perturbation strategies to generate adversarial samples; The traffic level data includes IP address, port number, protocol type, traffic volume and packet arrival time; the log level data includes login success rate and number of system calls; the user level data includes user session duration and number of access paths corresponding to a single session; The method for defining the disturbance strategy includes: For traffic-level data, perform character adjustment on the request header of the data packet; For log-level data, minimize changes to the login success rate and system call count by a preset adjustment range; For user-level data, the user session duration is randomly perturbed with a preset perturbation amplitude; the number of access paths is adjusted to a preset suspicious threshold.

2. The network threat perception and defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The training method of the anomaly recognition model includes: Step B1: Collect historical raw data; the historical raw data includes traffic level data, log level data, and user level data; Step B2: Extract features from the historical original data to obtain feature vectors corresponding to the original samples; Step B3: label the network information category corresponding to the feature vector; Step B4: Take the feature vector and the corresponding network information category as a sample set, and randomly select a test set from the sample set according to a preset ratio; construct a classifier, take the feature vector as input data, and the corresponding network information category as output data, train the classifier to obtain an initial classifier, test the initial classifier using the test set, and output the initial classifier that meets the preset evaluation indicators as the anomaly recognition model, wherein the classifier is a multilayer perceptron.

3. The network threat perception and defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The method of aggregating the traffic level data, log level data, and user level data into a single session includes: Step A1: When the application server responds, it generates a SessionID corresponding to the current session to identify the conversation; the SessionID is stored in a cookie, and subsequent action requests of the session automatically carry the cookie: Session; Step A2: Decode the HTTP request header using a packet capture tool and record the traffic level data corresponding to the session in the packet capture log; Step A3: Map the log level data and user level data to the corresponding SessionID identifier; Step A4: Use SessionID as the primary key to associate and aggregate traffic-level data, log-level data, and user-level data.

4. The network threat perception and defense strategy optimization method based on machine learning according to claim 2 is characterized in that: The network information categories include normal, DDoS attack, SQL injection, automated attack script and combined attack; The marking method of the network information category includes: normal marking as 1; DDoS attack marking as 2; SQL injection marking as 3; automated attack script marking as 4; and combined attack marking as 5.

5. The network threat perception and defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The dynamic defense strategy includes: If the network information category is normal, the existing protection status will be maintained; If the network information category is DDoS attack, block the source IP address and enable traffic scrubbing; If the network information category is SQL injection, update the web application firewall rules and perform data tampering checks on the affected database; If the network information category is an automated attack script, the source IP address corresponding to the session will be added to the firewall blacklist to restrict access to specific ports and services; If the network information category is a combined attack, the session data will be recorded and the threat source will be traced. At the same time, the corresponding data will be used for continuous optimization of subsequent anomaly identification models.

6. The network threat perception and defense strategy optimization method based on machine learning according to claim 1 is characterized in that: The IP address includes the source IP address and the destination IP address; the IP address is recorded as an integer value; the port number includes the source port and the destination port; the port number is recorded as an integer value; the protocol type includes TCP, UDP and ICMP; the protocol type is mapped to a number; the traffic size is the length of the data packet, and the recording method is floating point type.

7. The network threat perception and defense strategy optimization method based on machine learning according to claim 2 is characterized in that: The feature vector specifically includes the source IP address, destination IP address, source port, destination port, protocol type, traffic size, data packet arrival time, login success rate, number of system calls, user session duration and number of access paths; the length of the feature vector is 11.

8. A network threat perception and defense strategy optimization system based on machine learning, implementing the network threat perception and defense strategy optimization method based on machine learning according to any one of claims 1 to 7, characterized in that: include: Data acquisition module, used to obtain traffic level data, log level data and user level data within a single session; The anomaly recognition module constructs original samples based on traffic level data, log level data, and user level data, inputs the original samples into the pre-trained anomaly recognition model, and outputs the corresponding network information category; The adversarial generation module constructs adversarial samples based on the original samples; The adversarial training module combines the adversarial samples and the original samples into an expanded training set. After annotating the adversarial samples with the network information categories corresponding to the original samples, the anomaly recognition model is trained again to obtain an adversarially optimized anomaly recognition model. The online deployment module inputs traffic-level data, log-level data, and user-level data into the online adversarial optimized anomaly recognition model and outputs the final network information category; The defense execution module executes dynamic defense strategies based on the final network information category.

Images