A real-time network security monitoring and protection method and system based on deep learning

Abstract

The application provides a real-time network security monitoring and protection method and system based on deep learning, which extracts local features of network traffic through a convolutional neural network, analyzes time sequence features of abnormal network traffic by using a long short-term memory network, and identifies network attack types; the intensity of network attacks is calculated based on the flow rate, duration and source IP number of network attacks, the risk score is calculated based on the local features of network traffic, and the comprehensive score is calculated by weighting the risk score and the intensity of network attacks; different network attack protection measures are executed in response to different types of network attacks and in combination with the comprehensive scores of different types of network attacks, the protection level is adjusted in real time according to the intensity and risk score of network attacks, network attack information and protection measures are recorded, and a security log is generated. The application can analyze network traffic in real time, identify network attack types and take corresponding protection measures, improve the accuracy of network attack detection, and reduce risks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security protection, and particularly relates to a real-time network security monitoring and protection method and system based on deep learning. BACKGROUND

[0002] With the rapid development of the Internet and the wide application of information technology, network security problems are increasingly prominent, and traditional security defense technologies are often difficult to cope with complex and variable network attacks, such as advanced persistent threat (APT) attacks, phishing attacks, etc., which have caused great threats to the security environment of the network. In addition, the traditional network attack defense technology cannot analyze the network attack in real time and automatically take corresponding protection measures, and cannot adjust the protection measures according to the real-time network attack situation. Therefore, it is of great significance to develop an intelligent network security system capable of monitoring network traffic in real time, automatically identifying attack types and taking protection measures for network security.

[0003] To solve the above problems, the present application provides a real-time network security monitoring and protection method and system based on deep learning. SUMMARY

[0004] The present application proposes the following technical solutions in view of one or more technical defects in the prior art.

[0005] Based on the first aspect of the present application, a real-time network security monitoring and protection method based on deep learning is provided, comprising:

[0006] S1: extracting local features of network traffic by a convolutional neural network (CNN), judging whether the network traffic is abnormal, performing time series feature analysis on abnormal network traffic by a long short-term memory network (LSTM), and identifying the type of network attack;

[0007] S2: calculating the intensity of the network attack based on the flow rate, duration and source IP number of the network attack, and dividing the intensity of the network attack into low intensity, medium intensity and high intensity;

[0008] The calculation formula of the intensity of the network attack is:

[0009] Ascore=W R ×R+W T ×T+W I ×I;

[0010] Wherein, Ascore is the intensity of the network attack, W R is the weight of the flow rate, W T is the weight of the network attack duration, and W Ia weight of the number of source IPs of the network attack; R is a traffic rate, T is a network attack duration, and I is the number of source IPs of the network attack;

[0011] S3: calculating a risk score based on the local features of the network traffic, and classifying the attack risk of the network traffic into low risk, medium risk, and high risk;

[0012] The calculation formula of the risk score is:

[0013] Rscore=Wx1×x1+Wx2×x2+……+Wx n ×x n ;

[0014] wherein Rscore is the risk score, Wx1, Wx2, Wx n are weights of the local features of the network traffic, x1, x2, x n are the local features of the network traffic;

[0015] S4: calculating a comprehensive score by weighting the risk score and the intensity of the network attack;

[0016] The calculation formula of the comprehensive score is:

[0017] Tscore=(W1×Ascore)+(W2×Rscore)

[0018] wherein W1 is a weight of the intensity of the network attack, and W2 is a weight of the risk score;

[0019] S5: in response to different types of network attacks, and in combination with the comprehensive scores of different types of network attacks, performing different network attack protection measures, specifically,

[0020] For network attacks caused by malicious behaviors of suspicious IPs or IP segments, iptables or firewalld is used to limit network access of suspicious IPs or IP segments, and GeoIP is used to block traffic from regions where suspicious IPs or IP segments belong to;

[0021] For network attacks caused by malicious requests of XSS and SQL injection, a Web Application Firewall is used to define rules to block malicious requests, and Ngnix is used to limit the frequency of malicious requests from the same IP;

[0022] For large-scale DDoS attacks, network attack traffic is redirected to a third-party cleaning service to filter malicious traffic;

[0023] For network attacks caused by abnormal traffic, configure request limits for abnormal traffic in the web server, and limit the number of requests for abnormal traffic through the Apache mod_evasive module;

[0024] S6: Real-time adjustment of protection level according to the intensity of the network attack and the risk score, real-time recording of network attack information and protection measures and generation of security logs.

[0025] The present application can analyze the traffic of network data in real time, identify the attack type and take corresponding protection measures, improve the accuracy of network attack detection and classification, and reduce the risk of network security.

[0026] Further, the real-time adjustment of the protection level according to the intensity of the network attack and the risk score specifically,

[0027] When the intensity of the network attack is low (Ascore < 20), log recording and alarm triggering are performed;

[0028] When the intensity of the network attack is medium (20 ≤ Ascore < 50), the frequency of malicious requests of the IP is limited or the network bandwidth is increased;

[0029] When the intensity of the network attack is high (Ascore ≥ 50), firewall definition rule measures, traffic cleaning services or temporary isolation of part of the network nodes are enabled.

[0030] Real-time different levels of protection measures for different intensities of network attacks help to concentrate network resources to attack network attacks and reasonably arrange network resources.

[0031] Further, the real-time adjustment of the protection level according to the intensity of the network attack and the risk score further includes:

[0032] When the risk score is low (Rscore < 3), no measures are taken;

[0033] When the risk score is medium (3 ≤ Rscore < 6), limit the request of abnormal traffic;

[0034] When the risk score is high (Rscore ≥ 6), execute traffic cleaning or DDos protection measures.

[0035] Different levels of protection are taken for different risks, which is conducive to the reasonable adjustment of network resources, and resources are concentrated to attack when the network risk is too high, and further waiting for network attacks and making a response when the network risk is low.

[0036] Further, a local feature of the network traffic is extracted by a convolutional neural network CNN to determine whether the network traffic is abnormal, specifically, user behavior features and network topology features are converted into numerical feature vectors by a one-hot encoding or embedding method, the numerical feature vectors are combined with the local feature of the network traffic to obtain a feature matrix, and the feature matrix is input into the convolutional neural network CNN to determine and extract abnormal behaviors of the network traffic.

[0037] The convolutional neural network is used to identify abnormal behaviors of the network traffic, which can adaptively adjust network training parameters when facing different attack types, set different reward functions, and achieve the best abnormal behavior detection effect to identify static features of the network traffic.

[0038] Further, the abnormal network traffic is analyzed for time sequence features by a long short-term memory network LSTM, specifically, the abnormal network traffic data is divided into fixed-length time windows, features of the number of data packets, byte size, traffic average size, network protocol usage frequency, and connection number of the network traffic are extracted and standardized in the time windows, and the LSTM network is used to analyze network traffic trends and network attacks in a future time period and capture behavior features and time sequence features of the network attacks.

[0039] The long short-term memory network LSTM is used to capture attack behavior features of the network traffic at different times, identify time dependencies in the network traffic data, and recognize complex and continuous attack patterns.

[0040] Further, the content of the security log includes a log ID, a network attack event timestamp, a network attack event type, network attack information, a protective measure taken against the network attack, a response time of the network attack event, and an impact range of the network attack event.

[0041] Further, the network attack information includes a network attack source IP and a target IP, a network attack time, and a network attack manner.

[0042] Based on the second aspect of the application, a real-time network security monitoring and protection system based on deep learning is also provided, which includes an identification module a, a strength module b, a risk module c, a comprehensive module d, a response module e, and a log module f.

[0043] In specific embodiments, the identification module a is configured to extract a local feature of the network traffic by a convolutional neural network CNN to determine whether the network traffic is abnormal, analyze time sequence features of the abnormal network traffic by a long short-term memory network LSTM, and identify a type of network attack.

[0044] In specific embodiments, the intensity module b is configured to: calculate the intensity of the network attack based on the traffic rate, duration and source IP number of the network attack, and divide the intensity of the network attack into low intensity, medium intensity and high intensity;

[0045] The formula for calculating the intensity of the network attack is:

[0046] Ascore=W R xR+W T xT+W I xI;

[0047] Wherein, Ascore is the intensity of the network attack, W R is the weight of the traffic rate, W T is the weight of the network attack duration, W I is the weight of the source IP number of the network attack; R is the traffic rate, T is the network attack duration, and I is the source IP number of the network attack.

[0048] In specific embodiments, the risk module c is configured to: calculate a risk score based on the local features of the network traffic, and divide the attack risk of the network traffic into low risk, medium risk and high risk;

[0049] The formula for calculating the risk score is:

[0050] Rscore=Wx1x1+Wx2x2+…+Wx n x n ;

[0051] Wherein, Rscore is the risk score, Wx1, Wx2, Wx n is the weight of the local features of the network traffic, x1, x2, x n is the local feature of the network traffic.

[0052] In specific embodiments, the comprehensive module d is configured to: calculate a comprehensive score by weighting the risk score and the intensity of the network attack;

[0053] The formula for calculating the comprehensive score is:

[0054] Tscore=(W1xAscore)+(W2xRscore)

[0055] Wherein, W1 is the weight of the intensity of the network attack, and W2 is the weight of the risk score.

[0056] In specific embodiments, the response module e is configured to: in response to different types of network attacks, and in combination with the comprehensive score of different types of network attacks, perform different network attack protection measures, specifically,

[0057] For network attacks caused by malicious behaviors of suspicious IPs or IP segments, use iptables or firewalld to limit network access of suspicious IPs or IP segments, and use GeoIP to block traffic from regions where suspicious IPs or IP segments belong to;

[0058] For network attacks caused by malicious requests of XSS and SQL injection, define rules through a Web Application Firewall to block malicious requests, and use Ngnix to limit the frequency of malicious requests from the same IP;

[0059] For large-scale DDoS attacks, redirect network attack traffic to a third-party cleaning service to filter malicious traffic;

[0060] For network attacks caused by abnormal traffic, configure request limits for abnormal traffic in a Web server, and limit the number of requests for abnormal traffic through the mod_evasive module of Apache.

[0061] In specific embodiments, the log module f is configured to: adjust the protection level in real time according to the intensity of the network attack and the risk score, record network attack information and protection measures in real time and generate security logs.

[0062] Based on the third aspect of the application, a computer program product having one or more computer programs embodied thereon is also proposed, which, when executed by a computer processor, implements the method according to any one of the above.

[0063] The technical effect of the present application is that by analyzing network traffic in real time, the overall efficiency and accuracy of network security management are improved, network attacks can be detected, analyzed and responded to in real time, and through data mining and predictive analysis, the protection measures for network attacks can be optimized according to the intensity and risk level of network attacks, the accuracy of attack detection and classification is improved, the risk of network security is reduced, and the network attack protection is flexible according to different network environments and security requirements. BRIEF DESCRIPTION OF DRAWINGS

[0064] Other features, objects and advantages of the present application will become more apparent from the following detailed description of non-limiting embodiments, made with reference to the accompanying drawings.

[0065] Figure 1is a flow chart of a deep learning-based real-time network security monitoring and protection method according to an embodiment of the present application.

[0066] Figure 2 is a framework diagram of a deep learning-based real-time network security monitoring and protection system according to an embodiment of the present application.

[0067] Figure 3 A structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application is shown. DETAILED DESCRIPTION

[0068] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that, for the sake of description, only the parts related to the application are shown in the drawings.

[0069] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0070] Figure 1 A deep learning-based real-time network security monitoring and protection method is proposed in the present application, which comprises:

[0071] S1: extracting local features of network traffic through a convolutional neural network (CNN), judging whether the network traffic is abnormal, performing time series feature analysis on abnormal network traffic using a long short-term memory network (LSTM), and identifying the type of network attack;

[0072] S2: calculating the intensity of the network attack based on the traffic rate, duration and number of source IPs of the network attack, and dividing the intensity of the network attack into low, medium and high intensity;

[0073] The calculation formula of the intensity of the network attack is:

[0074] Ascore=W R ×R+W T ×T+W I ×I;

[0075] Wherein, Ascore is the intensity of the network attack, W R is the weight of the traffic rate, W T is the weight of the network attack duration, and W I is the weight of the number of source IPs of the network attack; R is the traffic rate, T is the network attack duration, and I is the number of source IPs of the network attack;

[0076] S3: calculating a risk score based on the local features of the network traffic, and dividing the attack risk of the network traffic into low risk, medium risk and high risk;

[0077] The calculation formula of the risk score is:

[0078] Rscore = Wx1 x x1 + Wx2 x x2 + … + Wx n x x n ;

[0079] Wherein, Rscore is the risk score, Wx1, Wx2, Wx n is the weight of the local feature of the network traffic, x1, x2, x n is the local feature of the network traffic;

[0080] S4: calculating a comprehensive score by weighting the risk score and the intensity of the network attack;

[0081] The calculation formula of the comprehensive score is:

[0082] Tscore = (W1 x Ascore) + (W2 x Rscore)

[0083] Wherein, W1 is the weight of the intensity of the network attack, and W2 is the weight of the risk score;

[0084] S5: in response to different types of network attacks, and in combination with the comprehensive score of different types of network attacks, different network attack protection measures are performed, specifically,

[0085] For network attacks caused by malicious behaviors of suspicious IPs or IP segments, iptables or firewalld is used to limit the network access of suspicious IPs or IP segments, and GeoIP is used to block traffic from the region where the suspicious IP or IP segment belongs;

[0086] For network attacks caused by malicious requests of XSS and SQL injection, a Web Application Firewall is used to define rules to block malicious requests, and Ngnix is used to limit the frequency of malicious requests from the same IP;

[0087] For large-scale DDoS attacks, network attack traffic is redirected to a third-party cleaning service to filter malicious traffic;

[0088] For network attacks caused by abnormal traffic, request limits for abnormal traffic are configured in the Web server, and the mod_evasive module of Apache is used to limit the number of requests of abnormal traffic;

[0089] S6: Real-time adjustment of protection level according to the intensity of the network attack and the risk score, real-time recording of network attack information and protection measures and generation of security logs.

[0090] It should be noted that the protection level is adjusted in real time according to the intensity of the network attack and the risk score, specifically,

[0091] When the intensity of the network attack is low (Ascore < 20), log recording and alarm triggering are performed;

[0092] When the intensity of the network attack is medium (20 < Ascore < 50), the frequency of malicious requests of IP is limited or the network bandwidth is increased;

[0093] When the intensity of the network attack is high (Ascore > 50), firewall definition rule measures, traffic cleaning service or temporary isolation of part of the network nodes are enabled.

[0094] It should be noted that the protection level is adjusted in real time according to the intensity of the network attack and the risk score, specifically,

[0095] When the risk score is low (Rscore < 3), no measures are taken;

[0096] When the risk score is medium (3 < Rscore < 6), the request of abnormal traffic is limited;

[0097] When the risk score is high (Rscore > 6), traffic cleaning or DDos protection measures are performed.

[0098] It should be noted that the local features of the network traffic are extracted by the convolutional neural network CNN to determine whether the network traffic is abnormal, specifically, the user behavior features and network topology features are converted into numerical feature vectors by one-hot encoding or embedding method, and the numerical feature vectors are combined with the local features of the network traffic to obtain a feature matrix, and the feature matrix is input into the convolutional neural network CNN to determine and extract the abnormal behavior of the network traffic.

[0099] It should be noted that the long short-term memory network LSTM is used to analyze the time sequence features of the abnormal network traffic, specifically, the abnormal network traffic data is divided into fixed length time windows, the number of data packets, byte number, traffic average size, network protocol usage frequency and connection number features of the network traffic are extracted and standardized in the time window, and the network traffic trend and network attack in a certain time period in the future are analyzed by the sliding window of the LSTM network, and the behavior features and time sequence features of the network attack are captured.

[0100] It should be noted that the content of the security log includes log ID, network attack event timestamp, network attack event type, network attack information, protective measures taken against network attacks, response time of the network attack event, and the impact range of the network attack event.

[0101] It should be noted that the network attack information includes network attack source IP and target IP, network attack time and network attack mode.

[0102] Figure 2 A real-time network security monitoring and protection system based on deep learning is shown, which includes an identification module a, a strength module b, a risk module c, a comprehensive module d, a response module e, and a log module f.

[0103] In specific embodiments, the identification module a is configured to extract local features of network traffic through a convolutional neural network (CNN), determine whether the network traffic is abnormal, perform time series feature analysis on abnormal network traffic using a long short-term memory network (LSTM), and identify the type of network attack.

[0104] In specific embodiments, the strength module b is configured to calculate the strength of the network attack based on the traffic rate, duration, and number of source IPs of the network attack, and divide the strength of the network attack into low, medium, and high.

[0105] The formula for calculating the strength of the network attack is:

[0106] Ascore = W R x R + W T x T + W I x I;

[0107] Where Ascore is the strength of the network attack, W R is the weight of the traffic rate, W T is the weight of the network attack duration, and W I is the weight of the number of source IPs of the network attack; R is the traffic rate, T is the network attack duration, and I is the number of source IPs of the network attack.

[0108] In specific embodiments, the risk module c is configured to calculate a risk score based on the local features of the network traffic, and divide the attack risk of the network traffic into low, medium, and high risk.

[0109] The formula for calculating the risk score is:

[0110] Rscore = Wx1 x x1 + Wx2 x x2 + … + Wx n x x n ;

[0111] wherein Rscore is a risk score, Wx1, Wx2, Wx n are weights of local features of the network traffic, x1, x2, x n are local features of the network traffic.

[0112] In specific embodiments, the comprehensive module d is configured to: calculate a comprehensive score by weighting the risk score and the intensity of the network attack.

[0113] The formula for calculating the comprehensive score is:

[0114] Tscore = (W1 x Ascore) + (W2 x Rscore)

[0115] wherein W1 is a weight of the intensity of the network attack, and W2 is a weight of the risk score.

[0116] In specific embodiments, the response module e is configured to: in response to different types of network attacks, and in combination with the comprehensive scores of different types of network attacks, execute different network attack protection measures, specifically,

[0117] For network attacks caused by malicious behavior of suspicious IPs or IP segments, use iptables or firewalld to limit network access of suspicious IPs or IP segments, and use GeoIP to block traffic from regions where suspicious IPs or IP segments belong to;

[0118] For network attacks caused by malicious requests of XSS and SQL injection, use a Web Application Firewall to define rules to block malicious requests, and use Ngnix to limit the frequency of malicious requests from the same IP;

[0119] For large-scale DDos attacks, redirect network attack traffic to a third-party cleaning service to filter malicious traffic;

[0120] For network attacks caused by abnormal traffic, configure request limits for abnormal traffic in the Web server, and use the Apache mod_evasive module to limit the number of requests for abnormal traffic.

[0121] In specific embodiments, the log module f is configured to: adjust the protection level in real time according to the intensity of the network attack and the risk score, record network attack information and protection measures in real time, and generate security logs.

[0122] It should be noted that the network packets are captured by Wireshark, tcpdump and Zeek tools, combined with hardware devices (such as Packet Shapers) to capture high-throughput network traffic in real time.

[0123] It should be noted that the captured network traffic data is denoised, irrelevant data and erroneous network traffic data is removed, invalid and repeated network traffic records are removed, missing values are filled, and Min-Max Scaling or Z-score standardization methods are used to standardize and normalize the network traffic data, ensuring that the magnitudes of different network traffic data features are similar.

[0124] It should be noted that the user behavior features include user login frequency and user access patterns.

[0125] The network topology features include source IP address, destination IP address and port number.

[0126] The local features of the network traffic include but are not limited to network traffic packet size, network traffic duration, network traffic frequency, traffic rate and standard deviation of network traffic size.

[0127] It should be noted that different features of the network traffic data are mapped to different channels of the matrix to obtain a feature matrix, each feature representing a dimension of the matrix, and the convolutional layer of the convolutional neural network CNN learns the feature correlation of the network traffic data to identify local patterns or abnormal behaviors of the network traffic data features.

[0128] The long short-term memory network LSTM identifies the timing patterns of attack behaviors by processing the time series data of the network traffic, divides the network traffic data into fixed-length time windows, calculates the statistical features within the time window as the input of each time window, and extracts the total number of bytes, the number of packets, the frequency of network protocol usage and the number of connections within each time window.

[0129] In training the convolutional neural network CNN and the long short-term memory network LSTM, network traffic data is used as the training set, a loss function (such as cross-entropy loss function) is defined to evaluate the difference between the model output and the true label, and the model parameters are updated through the backpropagation algorithm. Reinforcement learning is introduced to optimize the hyperparameters of the convolutional neural network CNN and the long short-term memory network LSTM, and the model parameters are continuously adjusted to maximize the reward during the training process, thereby achieving adaptive optimization and improving the accuracy of attack detection and classification.

[0130] It should be noted that the convolutional neural network CNN extracts features of network traffic data and classifies them, can quickly extract meaningful patterns from the static features of network traffic data, preliminarily distinguish normal network traffic and abnormal network traffic, identify hidden malicious patterns in network traffic, and enhance the accuracy of risk assessment; The long short-term memory network LSTM remembers the historical network traffic data information through the cell state and hidden state, identifies the time dependence and continuous complex attack of network traffic data, and distinguishes different network attack types.

[0131] It should be noted that the convolutional neural network CNN is responsible for rough classification of network traffic, and the long short-term memory network LSTM performs further time series analysis after determining that the network traffic is abnormal traffic, and accurately identifies the type of attack.

[0132] It should be noted that in the process of combining convolutional neural network CNN and long short-term memory network LSTM, intrusion detection systems and intrusion prevention systems can be identified to identify known types of attacks, and with the help of professional systems, multi-level protection can be achieved, and attacks can be identified with higher precision and faster response measures.

[0133] It should be noted that the comprehensive score can be adjusted according to the priority of different evaluation modes, and the intensity of network attack directly affects the actual load of network attack, so it generally has a larger weight, and the result of the risk score is generally used as a background reference.

[0134] Low-intensity network attack has less traffic, short duration and less impact.

[0135] The network attack of medium intensity has moderate traffic and longer duration, which may affect part of the service.

[0136] High-intensity network attack has huge traffic and longer duration, which may cause network service to be paralyzed.

[0137] In specific embodiments, for network attacks caused by malicious behavior of suspicious IP or IP segment, iptables or firewalld is used to limit network access of suspicious IP or IP segment, and GeoIP is used to block traffic from the region where the suspicious IP or IP segment belongs to. The code is:

[0138] "Sudo iptables -A INPUT -s <attacker_ip> -j DROP";

[0139] For network attacks caused by malicious requests of XSS and SQL injection, the code for blocking malicious requests through the rules defined by the Web Application Firewall is:

[0140] "SecRu le ARGS|ARGS_NAMES|REQUEST_HEADERS|XML: / *"@rx un ion.*select.*from"

[0141] "id:1000001,phase:2,deny,status:403,msg:'SQL I nject ion AttackDetected'"”;

[0142] The code for limiting the frequency of malicious requests from the same IP using Ngnix is as follows:

[0143]

[0144] In specific embodiments, the defense strength is automatically adjusted according to the duration and traffic size of network attacks, for example, a relaxed traffic limit can be set at the initial stage of a DDoS attack, while a strict traffic limit can be set when the attack intensifies, and firewall rules, Nginx configurations, etc. are adjusted through automated tools (Ansible, SaltStack, etc.) to quickly respond to emerging attacks.

[0145] It should be noted that for network attack event related logs, structured log data is stored in a relational database, large-scale, unstructured log data is stored in a NoSQL database, large-scale log files are stored in a distributed file system, and large-scale logs are stored in a cloud storage service for a long time.

[0146] It should be noted that log data is written to persistent storage to avoid data loss, and data security is ensured through regular backups, redundant storage, etc.; batch writing, asynchronous writing, etc. are used to improve storage efficiency, and when the amount of log data is large, a distributed log collection system (such as Kafka) can be used to alleviate high-concurrency writing pressure; for infrequently accessed historical logs, regular compression and archival storage can be performed to reduce storage costs.

[0147] It should be noted that the application can set a visual monitoring interface to understand the current network traffic, attack events and abnormal traffic information in real time, and generate dynamic icons for real-time monitoring to enable administrators to quickly respond; for example, using a traffic monitoring chart to display real-time network traffic, using a line chart or stacked chart to represent traffic trends (uplink, downlink, total traffic, etc.); graphically display the number and severity of different attack types (such as DDoS, malicious scanning, SQL injection, etc.) of the current ongoing attack events; display the geographical location of the attack source through the attack source map, identify the attack source location through the heat map or IP geographical distribution map; and the network device state monitoring displays the state of the network device (such as switch, router, firewall, etc.) in real time, including traffic, CPU, memory, load and other information.

[0148] Reference will now be made to the following description Figure 3 which shows a structural schematic diagram of a computer system of an electronic device suitable for implementing embodiments of the application. Figure 3 The electronic device shown is merely an example and should not impose any limitation on the functions and use range of embodiments of the application.

[0149] As shown in Figure 3 , the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 302 or programs loaded from a storage portion 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for system operation are also stored. The CPU 301, the ROM 302, and the RAM 303 are connected to each other through a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0150] The following components are connected to the I / O interface 305: an input portion 306 including a keyboard, a mouse, and the like; an output portion 307 including a liquid crystal display (LCD), a speaker, and the like; a storage portion 308 including a hard disk, and the like; and a communication portion 309 including a network interface card such as a LAN card, a modem, and the like. The communication portion 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to the I / O interface 305 as necessary. A removable medium 311 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is mounted on the drive 310 as necessary, so that a computer program read therefrom is installed in the storage portion 308 as necessary.

[0151] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable storage medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 309, and / or installed from the removable medium 311. When the computer program is executed by the central processing unit (CPU) 301, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable storage medium of the present application can be either a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be - but is not limited to - an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal that is propagated in baseband or as part of a carrier wave, in which the computer readable program code is carried. Such propagated data signal can take a variety of forms, including but not limited to electro-magnetic, optical or any suitable combination of the above. The computer readable signal medium can also be any computer readable storage medium that can be used to carry or store program code in the form of instructions or data structures that can be accessed by a computer. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0152] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0153] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0154] The modules involved in the embodiments of the present application can be implemented in the form of software, or can be implemented in the form of hardware.

[0155] As another aspect, the application also provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist independently without being assembled into the electronic device. The computer readable storage medium carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device is caused to: extract local features of network traffic through a convolutional neural network, analyze time sequence features of abnormal network traffic by using a long short-term memory network, and identify a network attack type; calculate a strength of the network attack based on a traffic rate, a duration and a number of source IPs of the network attack, calculate a risk score based on the local features of the network traffic, and calculate a comprehensive score by weighting the risk score and the strength of the network attack; in response to different types of network attacks and in combination with the comprehensive scores of the different types of network attacks, perform different network attack protection measures, adjust a protection level in real time according to the strength of the network attack and the risk score, and record network attack information and protection measures and generate a security log.

[0156] Finally, it should be noted that the above description is merely preferred embodiments of the application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application disclosed in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or equivalent features without departing from the above inventive concept. For example, the above features are replaced with each other to form a technical solution with similar functions disclosed in the present application (but not limited to).

Claims

1. A real-time network security monitoring and protection method based on deep learning, characterized in that, include: S1: Extract local features of network traffic through a convolutional neural network (CNN) to determine whether the network traffic is abnormal. Use a long short-term memory (LSTM) network to perform temporal feature analysis on the abnormal network traffic to identify the type of network attack. S2: Calculate the strength of the network attack based on the traffic rate, duration, and number of source IPs of the network attack, and classify the strength of the network attack into low strength, medium strength, and high strength; The formula for calculating the strength of the network attack is: Ascore=W R ×R+W T ×T+W I ×I; Where Ascore represents the strength of the network attack, W R W is the weight for the flow rate. T W is the weight for the duration of a cyberattack. I The weights for the number of source IPs in a network attack are: R = traffic rate, T = duration of the network attack, and I = number of source IPs in the network attack. S3: Calculate a risk score based on the local characteristics of the network traffic, and classify the attack risk of the network traffic into low risk, medium risk and high risk; The formula for calculating the risk score is as follows: Rscore=Wx1×x1+Wx2×x2+……+Wx n ×x n ; Where Rscore is the risk score, Wx1, Wx2, Wx n The weights of the local features of the network traffic are x1, x2, x... n These are local characteristics of the network traffic; S4: The risk score and the intensity of the network attack are weighted and calculated to obtain a comprehensive score; The formula for calculating the comprehensive score is as follows: Tscore=(W1×Ascore)+(W2×Rscore) Where W1 is the weight of the intensity of the network attack, and W2 is the weight of the risk score; S5: In response to different types of network attacks, and based on the comprehensive score of each type of network attack, implement different network attack protection measures. Specifically, For network attacks caused by malicious behavior of suspicious IPs or IP ranges, use iptables or firewalld to restrict network access of suspicious IPs or IP ranges, and use GeoIP to block traffic from the zone to which the suspicious IPs or IP ranges belong; For network attacks caused by malicious requests from XSS and SQL injection, rules are defined through a web application firewall to block malicious requests, and Ngnix is ​​used to limit the frequency of malicious requests from the same IP address. For large-scale DDoS attacks, redirect network attack traffic to third-party cleaning services to filter malicious traffic; To prevent network attacks caused by abnormal traffic, configure request limits for abnormal traffic in the web server and limit the number of abnormal traffic requests through Apache's mod_evasive module. S6: Adjust the protection level in real time based on the intensity of the network attack and the risk score, record network attack information and protection measures in real time, and generate a security log.

2. The method according to claim 1, characterized in that, The protection level is adjusted in real time based on the intensity and risk score of the network attack. Specifically, When Ascore < 20, the network attack is considered low-intensity, and logs are generated and an alarm is triggered. When 20 ≤ Ascore < 50, the network attack is of medium strength, and the frequency of malicious requests from the IP address should be limited or the network bandwidth should be increased. When Ascore ≥ 50, the network attack is considered high-intensity, and firewall rules, traffic scrubbing services, or temporary isolation of certain network nodes should be implemented.

3. The method according to claim 1, characterized in that, The protection level is adjusted in real time based on the intensity and risk score of the network attack, and also includes: When Rscore < 3, the risk score is low risk, and no action is taken. When 3 ≤ Rscore < 6, the risk score is medium risk, and requests with abnormal traffic are restricted; When Rscore ≥ 6, the risk score is high risk, and traffic scrubbing or DDoS protection measures should be implemented.

4. The method according to claim 1, characterized in that, To extract local features of network traffic using a convolutional neural network (CNN) and determine whether the network traffic is abnormal, the method involves converting user behavior features and network topology features into numerical feature vectors using one-hot encoding or embedding methods, merging the numerical feature vectors with the local features of the network traffic to obtain a feature matrix, and inputting the feature matrix into the CNN to determine and extract abnormal behavior of the network traffic.

5. The method according to claim 1, characterized in that, The method of using a Long Short-Term Memory (LSTM) network to perform time-series feature analysis on abnormal network traffic involves dividing the abnormal network traffic data into fixed-length time windows, extracting and standardizing features such as the number of data packets, the number of bytes, the average traffic size, the frequency of network protocol usage, and the number of connections within these time windows, and then analyzing network traffic trends and network attacks over a certain period of time using a sliding window of the LSTM network, thereby capturing the behavioral and temporal characteristics of network attacks.

6. The method according to claim 1, characterized in that, The security log includes the log ID, timestamp of the network attack event, type of network attack event, network attack information, protective measures taken against the network attack, response time of the network attack event, and scope of impact of the network attack event.

7. The method according to claim 6, characterized in that, The network attack information includes the source IP and target IP of the network attack, the time of the network attack, and the method of the network attack.

8. A real-time network security monitoring and protection system based on deep learning, characterized in that, include: Identification module: Extracts local features of network traffic through convolutional neural network (CNN) to determine whether the network traffic is abnormal, and uses long short-term memory network (LSTM) to perform temporal feature analysis on abnormal network traffic to identify the type of network attack; Strength module: Calculates the strength of the network attack based on the traffic rate, duration, and number of source IPs, and classifies the strength of the network attack into low, medium, and high strength. The formula for calculating the strength of the network attack is: Ascore=W R ×R+W T ×T+W I ×I; Where Ascore represents the strength of the network attack, W R W is the weight for the flow rate. T W is the weight for the duration of a cyberattack. I The weights for the number of source IPs in a network attack are: R = traffic rate, T = duration of the network attack, and I = number of source IPs in the network attack. Risk module: Calculates a risk score based on the local characteristics of the network traffic, and classifies the attack risk of the network traffic into low risk, medium risk and high risk; The formula for calculating the risk score is as follows: Rscore=Wx1×x1+Wx2×x2+……+Wx n ×x n ; Where Rscore is the risk score, Wx1, Wx2, Wx n The weights of the local features of the network traffic are x1, x2, x... n These are local characteristics of the network traffic; Comprehensive module: The comprehensive score is obtained by weighting the risk score and the intensity of the network attack; The formula for calculating the comprehensive score is as follows: Tscore=(W1×Ascore)+(W2×Rscore) Where W1 is the weight of the intensity of the network attack, and W2 is the weight of the risk score; Response module: Responds to different types of network attacks and, based on a comprehensive score of each type of attack, implements different network attack protection measures. Specifically, For network attacks caused by malicious behavior of suspicious IPs or IP ranges, use iptables or firewalld to restrict network access of suspicious IPs or IP ranges, and use GeoIP to block traffic from the zone to which the suspicious IPs or IP ranges belong; For network attacks caused by malicious requests from XSS and SQL injection, rules are defined through a web application firewall to block malicious requests, and Ngnix is ​​used to limit the frequency of malicious requests from the same IP address. For large-scale DDoS attacks, redirect network attack traffic to third-party cleaning services to filter malicious traffic; To prevent network attacks caused by abnormal traffic, configure request limits for abnormal traffic in the web server and limit the number of abnormal traffic requests through Apache's mod_evasive module. Log module: Adjusts the protection level in real time based on the intensity of the network attack and the risk score, records network attack information and protection measures in real time, and generates security logs.

9. A computer program product having one or more computer programs thereon, characterized in that, When the computer program is executed by a computer processor, the method described in any one of claims 1-7 is performed.

Images