A Network Attack Recognition Method Based on the Snd-LSTM Network Model

Abstract

The present invention discloses a network attack recognition method based on the Snd-LSTM network model, which relates to the technical field of network models. It collects network traffic data in real time and preprocesses the network traffic data using a data cleaning algorithm; designs the structure of the Snd-LSTM network model to capture the temporal features in the network traffic; uses the preprocessed network traffic data to train the Snd-LSTM network model, and then analyzes the dynamic change trend of the network traffic; inputs the network traffic data to be detected into the trained Snd-LSTM model, performs inference calculations according to the network traffic feature pattern, and outputs a probability vector representing the probabilities of different network attack types. The present invention utilizes Snd-LSTM to effectively distinguish normal traffic from abnormal attack traffic by learning the patterns in historical data, not only improving the accuracy of attack detection, but also significantly enhancing the detection efficiency, enabling the system to quickly respond to potential threats in a real-time environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network models, and in particular to a network attack identification method based on an Snd-LSTM network model. Background Art

[0002] With the widespread use of the internet and the development of information technology, network attacks are becoming increasingly diverse and complex. For example, DDoS attacks, SQL injections, malware, phishing attacks, and data leaks have become common network security threats. Each attack has distinct characteristics and intrusion methods. In recent years, deep learning (particularly LSTM) has become a key technology in network attack identification due to its powerful capabilities in time series data modeling and pattern recognition. LSTM networks excel at processing time series information such as network traffic data, intrusion logs, and protocol data. They can capture long-term temporal dependencies and identify potential attack behaviors.

[0003] In the existing technology, it is difficult to detect and warn of network attacks in real time in high-speed network traffic for real-time traffic analysis in a network environment, resulting in a certain delay in the identification and warning of network attacks. In addition, it is difficult to implement corresponding processing methods according to the type of network attack. Therefore, a network attack identification method based on the Snd-LSTM network model is proposed to solve the above problems. Summary of the Invention

[0004] The purpose of the present invention is to provide a network attack identification method based on the Snd-LSTM network model to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A network attack identification method based on the Snd-LSTM network model includes the following steps:

[0007] Step 1: Collect network traffic data in real time and pre-process it using a data cleaning algorithm;

[0008] Step 2: Design the structure of the Snd-LSTM network model to capture the temporal characteristics of network traffic and model long-term dependencies;

[0009] Step 3: Use the preprocessed network traffic data to train the Snd-LSTM network model, and continuously adjust the model parameters through the back propagation algorithm to minimize the loss function, and then analyze the dynamic change trend of network traffic;

[0010] Step 4: Input the network traffic data to be detected into the trained Snd-LSTM model, perform inference and calculation according to the network traffic feature pattern, and output a probability vector representing the probabilities of different network attack types.

[0011] Step 5: Preset a warning threshold. Combine the output result of the Snd-LSTM model to determine whether the maximum probability category output by the model exceeds the preset warning threshold. If it exceeds, it is determined as the corresponding network attack type and the warning mechanism is triggered. Otherwise, it is regarded as normal traffic.

[0012] Step 6: Take corresponding handling measures according to the risk level of the warning, implement automatic blocking, traffic diversion and other measures to deal with the confirmed attack events. After the attack event ends, conduct a detailed analysis of the data of the entire attack process to form an attack report, providing a basis for optimizing network security policies and improving the Snd-LSTM model.

[0013] A further improvement of the technical solution of the present invention lies in: In step 1, the process of network traffic data collection and preprocessing is as follows:

[0014] Determine the network area to be monitored according to requirements, including but not limited to specific subnets, servers, routers, etc., and use the network packet capture tool Wireshark to select the corresponding network interface for listening to capture the network traffic data of the network area.

[0015] Temporarily store the captured network traffic data in a specified directory on the local disk, with the file format being PCAP (Packet Capture), and use the command-line tool tshark of Wireshark to parse the PCAP file, extract the high-level protocol information, and then extract the key fields including source IP address, destination IP address, timestamp and packet size from the parsed data, and save the extracted data in CSV format for subsequent analysis preparation.

[0016] Perform preprocessing on the parsed network traffic data, including data cleaning and data normalization processing.

[0017] A further improvement of the technical solution of the present invention lies in: In step 2, the process of designing the Snd-LSTM network model structure is as follows:

[0018] Sort the preprocessed network traffic data in chronological order and create a sliding window to generate time series data, where the size of the sliding window is determined according to the characteristics of the network traffic and the analysis requirements.

[0019] Design the structure of the Snd-LSTM network model, including an input layer, an LSTM layer, a fully connected layer and an output layer.

[0020] Among them, the input layer: accepts the preprocessed time series data as input. The shape of the input data is the number of samples, the number of time steps, and the number of features. By adjusting the number of LSTM layers, the number of units in each LSTM layer, as well as using optimization algorithms and learning rate scheduling strategies, the modeling ability of the model for long-term dependence relationships can be improved;

[0021] LSTM layer: uses multiple LSTM units to capture temporal features. Calculate the number of LSTM layer units. The number of units in each LSTM layer (i.e., the number of hidden units) is determined according to data complexity and computing resources, and uses dropout regularization to calculate the dropout regularization rate to prevent overfitting;

[0022] Fully connected layer: After the LSTM layer, one or more fully connected layers need to be added for feature combination and decision-making;

[0023] Output layer: Select the corresponding output layer according to the task type, which is used to classify different attack types. For a binary classification task (normal / abnormal), the output layer has one neuron and uses the sigmoid activation function. For a multi-classification task, there are multiple neurons corresponding to different types of attacks and uses the softmax activation function.

[0024] A further improvement of the technical solution of the present invention lies in: the calculation expression of the sliding window size is:

[0025]

[0026] In the formula, W is the sliding window size, which is the number of time steps, N is the total number of samples in the dataset, representing the overall scale of the data, σ is the standard deviation of the data noise, which can be obtained by calculating the change amount at each time point in the dataset;

[0027] The calculation expression of the number of LSTM layer units is:

[0028]

[0029] In the formula, H is the number of units in each LSTM layer, C is a measure of data complexity, which can be obtained by calculating the entropy between different features in the dataset, K is the limit of computing resources, based on the GPU memory size or CPU computing power, and α is a tuning parameter used to control the rate of change of the number of units with complexity and resource limitations;

[0030] The calculation expression of the dropout regularization rate is:

[0031]

[0032] Where D is the dropout regularization rate, representing the ratio of dropout regularization, M is the number of samples in the dataset, and β is a tuning parameter used to control the rate at which the dropout ratio changes with the dataset size.

[0033] A further improvement of the technical solution of the present invention lies in that: in the step three, the training process of the Snd-LSTM network model is as follows:

[0034] Ensure that the network traffic data has been sorted in chronological order and generate time series data of sliding windows, and divide the dataset into a training set, a validation set, and a test set, with a division ratio of 70% for the training set, 15% for the validation set, and 15% for the test set. Among them, the training set is used to train the model, the validation set is used to adjust the model parameters and select the best model, and the test set is used to evaluate the performance of the model;

[0035] Assign corresponding labels of specific attack types to each sample according to the multi-classification task type, and perform model compilation. Among them, model compilation includes selecting a loss function, selecting an optimizer, and configuring evaluation metrics. For the multi-classification task type, categorical_crossentropy is used, the Adam optimizer is selected by default, and the evaluation metrics configured include metrics such as accuracy, recall, and F1 score;

[0036] Input the training set data into the Snd-LSTM network model, calculate the value of the loss function through forward propagation, calculate the gradient through the backpropagation algorithm, and use the optimization algorithm to update the model parameters. Repeat this process until the value of the loss function reaches the preset number of iterations. Evaluate the performance of the model on the validation set, adjust the model parameters (such as the number of LSTM layers, the number of units, the dropout regularization rate, etc.) according to the validation results, retrain the model, evaluate the performance of the final model on the test set, and calculate evaluation metrics such as accuracy, recall, and F1 score;

[0037] Use the trained Snd-LSTM network model to predict and analyze the network traffic data, and identify the dynamic change trend of abnormal behaviors in the network traffic.

[0038] A further improvement of the technical solution of the present invention lies in that: the calculation expression of the dynamic change trend of the abnormal behavior is:

[0039]

[0040] Where A(t) is the quantization value of the dynamic change trend of the abnormal behavior at time t, F iis the network traffic value at time i, μ is the average value of recent traffic values, which is the mean within a sliding window, W is the size of the sliding window, thr is a preset abnormal behavior threshold for detecting the significance of traffic changes, k is an adjustment parameter for controlling the decay rate of outliers over time, ΔF(t) is the difference in traffic values between time t and the previous moment, and the value range of A(t) is between 0 and 1. When the traffic change is very significant and continuous, A(t) approaches 1. When the traffic change is not significant or within the normal range, A(t) approaches 0.

[0041] A further improvement of the technical solution of the present invention lies in: in the step four, the output process of the probability vector is as follows:

[0042] Collect real-time network traffic data from the network monitoring system and extract features including packet size, packet arrival interval, protocol type, source / destination IP address, and port number from it;

[0043] Load the trained Snd-LSTM model to make the loaded model compatible with the feature set extracted from the real-time network traffic data, and batch input the preprocessed network traffic data into the model;

[0044] Perform forward propagation calculation through the Snd-LSTM model. The Snd-LSTM model gradually calculates the hidden state based on the input features and the learned weights, and finally outputs a probability vector. Each element in the probability vector corresponds to a specific attack type.

[0045] A further improvement of the technical solution of the present invention lies in: the calculation expression of the probability vector is:

[0046]

[0047] z j = min(θ·ReLU(W j ·h T + b j ), δ);

[0048] In the formula, P j is the probability vector of the j-th type of attack, z j is the linear combination value before passing through the fully connected layer and the activation function, τ is the smoothing parameter, h T is the hidden state vector of the LSTM unit at time step T, W j and b j are respectively the weight matrix and the bias vector of the fully connected layer, θ is the scaling factor for adjusting the dynamic range of z j , δ is the upper limit value for preventing z j from being too large, and each P jThe value range of is [0, 1], and the sum of all P j is 1.

[0049] A further improvement of the technical solution of the present invention lies in that: in the fifth step, the triggering process of the early warning mechanism is as follows:

[0050] According to the network attack early warning requirements, combined with historical data, business requirements, and security policies, analyze the risk levels of network attack types, classify them into low-risk attacks, medium-risk attacks, and high-risk attacks, and set different early warning thresholds for each type of network attack. Among them, normal traffic does not trigger an early warning, and there is no need to set an early warning threshold. The early warning threshold for low-risk attacks is 0.7, the early warning threshold for medium-risk attacks is 0.85, and the early warning threshold for high-risk attacks is 0.95;

[0051] Find the maximum probability value from the output probability vector, and compare it with the early warning threshold to determine whether the maximum probability value exceeds the preset early warning threshold;

[0052] If the maximum probability value does not exceed the early warning threshold, it is regarded as normal traffic and no early warning operation is performed. If the maximum probability value exceeds the early warning threshold, it is determined as a network attack, and the corresponding network attack type is matched, and then the early warning mechanism is triggered. Among them, the early warning mechanism includes sending an alarm, recording a log, and blocking the connection.

[0053] A further improvement of the technical solution of the present invention lies in that: in the sixth step, the formation process of the attack report is as follows:

[0054] According to the output probability of the Snd-LSTM model and the preset early warning threshold, determine the risk level of the attack event, and implement corresponding emergency response measures according to the risk level. Among them, for network attack events of high-risk attacks, immediately start the automatic blocking mechanism to cut off the connection between the attack source and the system to prevent the attack from spreading. For network attack events of medium-risk attacks, divert the attacked traffic to a standby system or a sandbox environment for analysis and processing to reduce the pressure on the main system and collect more attack information. For network attack events of all-risk attacks, real-time monitoring and log recording are required for subsequent analysis and tracking;

[0055] After blocking the attack source, isolate the affected system components, start the recovery process to ensure that the business resumes normal operation as soon as possible, and according to the attack type and means, strengthen the security of the system, repair vulnerabilities, and improve the defense ability;

[0056] After the attack event ends, collect and analyze the data of the entire attack process, including the attack source, attack means, attack path, and system response. Then, based on the results of the attack data analysis, prepare a detailed attack report, including an attack overview, impact analysis, emergency response measures, security reinforcement suggestions, and future defense strategies. Furthermore, according to the suggestions in the attack report, optimize the network security strategy, including updating firewall rules, strengthening the configuration of intrusion detection systems (IDS) and intrusion prevention systems (IPS), etc., and improve the Snd-LSTM model, including adjusting model parameters, increasing the diversity of training data, introducing new features, etc., to improve the model's detection ability for new types of attacks.

[0057] Due to the adoption of the above technical solution, the technical progress achieved by the present invention compared with the prior art is as follows:

[0058] 1. The present invention provides a network attack recognition method based on the Snd-LSTM network model. Through its sequence processing ability, the Snd-LSTM model can capture the temporal dependence and long-distance correlation in network traffic data, and can effectively distinguish normal traffic from abnormal attack traffic by learning the patterns in historical data. This not only improves the accuracy of attack detection but also significantly enhances the detection efficiency, enabling the system to quickly respond to potential threats in a real-time environment.

[0059] 2. The present invention provides a network attack recognition method based on the Snd-LSTM network model. By combining the output probability of the Snd-LSTM model and a preset warning threshold, accurate early warnings for attack events at different levels can be realized. This not only improves the sensitivity and accuracy of early warnings but also enables the system to adopt different levels of response strategies according to the nature and severity of the attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present invention, and those of ordinary skill in the art can also obtain other drawings based on these drawings.

[0061] Figure 1 It is a schematic flow chart of the method of the present invention;

[0062] Figure 2 It is a schematic flow chart of the output of the probability vector of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0064] Embodiment 1, as Figure 1 shown, the present invention provides a network attack recognition method based on the Snd-LSTM network model, including the following steps:

[0065] Step 1: Collect network traffic data in real time, and preprocess the network traffic data using a data cleaning algorithm. Determine the network area to be monitored according to requirements, including but not limited to specific subnets, servers, routers, etc., and use the network packet capture tool Wireshark to select the corresponding network interface for listening, capture the network traffic data in the network area, temporarily store the captured network traffic data in a specified directory on the local disk, and the file format is PCAP (Packet Capture). Use the command-line tool tshark of Wireshark to parse the PCAP file, extract the high-level protocol information, and then extract the key fields including the source IP address, destination IP address, timestamp, and packet size from the parsed data. Save the extracted data in CSV format for subsequent analysis. Preprocess the parsed network traffic data, including data cleaning and data normalization. Among them, analyze the network traffic data, identify and delete unnecessary or duplicate information to simplify the data set and improve the efficiency of subsequent processing. For data entries with missing values, use mean filling or interpolation method for filling. Normalize the features of the network traffic data to convert data of different scales to the same range, ensuring that the data values of different features are in the same order of magnitude for better learning and recognition by the model;

[0066] Step 2: Design the structure of the Snd-LSTM network model to capture the temporal features in the network traffic and model the long-term dependence relationship. Sort the preprocessed network traffic data in chronological order and create a sliding window to generate time series data. Among them, the size of the sliding window is determined according to the characteristics of the network traffic and the analysis requirements. Design the structure of the Snd-LSTM network model, including an input layer, an LSTM layer, a fully connected layer, and an output layer;

[0067] Among them, the input layer: accepts the preprocessed time series data as input. The shape of the input data is the number of samples, the number of time steps, and the number of features. By adjusting the number of LSTM layers, the number of units in each LSTM layer, as well as using optimization algorithms and learning rate scheduling strategies, the modeling ability of the model for long-term dependency relationships can be improved. LSTM layer: uses multiple layers of LSTM units to capture temporal features. Calculate the number of LSTM layer units. The number of units in each LSTM layer (i.e., the number of hidden units) is determined according to data complexity and computing resources, and dropout regularization is used to calculate the dropout regularization rate to prevent overfitting. Fully connected layer: After the LSTM layer, one or more fully connected layers need to be added for feature combination and decision-making. Output layer: Select the corresponding output layer according to the task type for classifying different attack types. For binary classification tasks (normal / abnormal), the output layer has one neuron and uses the sigmoid activation function. For multi-classification tasks, there are multiple neurons corresponding to different types of attacks and use the softmax activation function;

[0068] Furthermore, the calculation expression for the sliding window size is:

[0069]

[0070] In the formula, W is the sliding window size, which is the number of time steps. N is the total number of samples in the dataset, representing the overall scale of the data. σ is the standard deviation of the data noise, which can be obtained by calculating the change amount at each time point in the dataset. When the total number of samples N in the dataset increases, the sliding window size W tends to increase to capture more temporal information. When the standard deviation σ of the data noise increases, the sliding window size N tends to decrease to reduce the impact of noise on the model;

[0071] The calculation expression for the number of LSTM layer units is:

[0072]

[0073] In the formula, H is the number of units in each LSTM layer. C is a measure of data complexity, which can be obtained by calculating the entropy between different features in the dataset. K is the limit of computing resources, based on the memory size of the GPU or the computing power of the CPU. α is a tuning parameter used to control the rate at which the number of units changes with complexity and resource limitations. When the data complexity increases, the number of LSTM layer units tends to increase to capture more temporal features. When the computing resource limit decreases, the number of LSTM layer units tends to decrease to adapt to limited computing resources;

[0074] The calculation expression for the dropout regularization rate is:

[0075]

[0076] In the formula, D is the dropout regularization rate, representing the ratio of dropout regularization. M is the number of samples in the dataset, and β is a tuning parameter used to control the rate at which the dropout ratio changes with the dataset size. When the number of samples in the dataset increases, the dropout ratio tends to decrease because more data helps reduce the risk of overfitting. The value of β affects the sensitivity of D to changes in M. A larger value of β will result in a higher dropout ratio, while a smaller value of β will result in a lower dropout ratio;

[0077] Step 3: Use the preprocessed network traffic data to train the Snd-LSTM network model, and continuously adjust the model parameters through the backpropagation algorithm to minimize the loss function. Then, analyze the dynamic change trend of the network traffic, ensure that the network traffic data has been sorted in chronological order and generate time series data with a sliding window, and divide the dataset into a training set, a validation set, and a test set. The division ratio is 70% for the training set, 15% for the validation set, and 15% for the test set. Among them, the training set is used to train the model, the validation set is used to adjust the model parameters and select the best model, and the test set is used to evaluate the performance of the model. Assign corresponding labels of specific attack types to each sample according to the multi-classification task type, and perform model compilation. Among them, model compilation includes selecting a loss function, selecting an optimizer, and configuring evaluation metrics. For the multi-classification task type, use categorical_crossentropy, and by default, select the Adam optimizer. The configured evaluation metrics include indicators such as accuracy, recall, and F1 score. Input the training set data into the Snd-LSTM network model, calculate the value of the loss function through forward propagation, calculate the gradient through the backpropagation algorithm, and use the optimization algorithm to update the model parameters. Repeat this process until the value of the loss function reaches the preset number of iterations. Evaluate the performance of the model on the validation set, adjust the model parameters (such as the number of LSTM layers, the number of units, the dropout regularization rate, etc.) according to the validation results, retrain the model, evaluate the performance of the final model on the test set, and calculate evaluation metrics such as accuracy, recall, and F1 score. Use the trained Snd-LSTM network model to predict and analyze the network traffic data to identify the dynamic change trend of abnormal behaviors in the network traffic;

[0078] Furthermore, the calculation expression for the dynamic change trend of abnormal behaviors is:

[0079]

[0080] In the formula, A(t) is the quantization value of the dynamic change trend of abnormal behaviors at time t, F iis the network traffic value at time i, μ is the average value of recent traffic values, which is the mean within a sliding window, W is the size of the sliding window, thr is a preset abnormal behavior threshold for detecting the significance of traffic changes, k is an adjustment parameter for controlling the decay rate of outliers over time, ΔF(t) is the difference between the traffic value at time t and the traffic value at the previous moment, and the value range of A(t) is between 0 and 1. When the traffic change is very significant and continuous, A(t) approaches 1. When the traffic change is not significant or within the normal range, A(t) approaches 0;

[0081] Step Four: Input the network traffic data to be detected into the trained Snd-LSTM model, perform inference calculations based on the network traffic feature pattern, and output a probability vector representing the probabilities of different network attack types;

[0082] Step Five: Preset a warning threshold. Combining the output result of the Snd-LSTM model, determine whether the maximum probability category output by the model exceeds the preset warning threshold. If it exceeds, it is determined as the corresponding network attack type and the warning mechanism is triggered. Otherwise, it is regarded as normal traffic;

[0083] Step Six: Take corresponding handling measures according to the risk level of the warning, implement measures such as automatic blocking and traffic diversion to deal with the confirmed attack events. After the attack event ends, conduct a detailed analysis of the data of the entire attack process to form an attack report, providing a basis for optimizing network security strategies and improving the Snd-LSTM model.

[0084] Example 2, as Figure 2 shown, on the basis of Example 1, the present invention provides a technical solution: Preferably, in Step Four, the output process of the probability vector is as follows:

[0085] Collect real-time network traffic data from the network monitoring system, extract features including packet size, packet arrival interval, protocol type, source / destination IP address, and port number from it, load the trained Snd-LSTM model to make the loaded model compatible with the feature set extracted from the real-time network traffic data, batch input the preprocessed network traffic data into the model, perform forward propagation calculations through the Snd-LSTM model. The Snd-LSTM model gradually calculates the hidden state based on the input features and the learned weights, and finally outputs a probability vector. Each element in the probability vector corresponds to a specific attack type;

[0086] Further, the calculation expression of the probability vector is:

[0087]

[0088] z j = min(θ·ReLU(Wj ·h T +b j ), δ);

[0089] Wherein, P j is the probability vector of the j-th type of attack, z j is the linear combination value before passing through the fully connected layer and the activation function, τ is the smoothing parameter, h T is the hidden state vector of the LSTM cell at time step T, W j and b j are the weight matrix and bias vector of the fully connected layer respectively, θ is the scaling factor used to adjust the dynamic range of z j , and δ is the upper limit value used to prevent z j from being too large. The value range of each P j is [0, 1], and the sum of all P j is 1. When z j is large, the value of P j will increase significantly; when z j is small, the value of P j will approach 0. By adjusting the values of τ, θ, and δ, the discrimination between different categories can be controlled;

[0090] In step five, the triggering process of the early warning mechanism is as follows:

[0091] According to the network attack early warning requirements, combined with historical data, business requirements, and security policies, analyze the risk levels of network attack types, classify them into low-risk attacks, medium-risk attacks, and high-risk attacks, and set different early warning thresholds for each type of network attack. Among them, normal traffic does not trigger an early warning, and no early warning threshold needs to be set. The early warning threshold for low-risk attacks is 0.7, the early warning threshold for medium-risk attacks is 0.85, and the early warning threshold for high-risk attacks is 0.95. Find the maximum probability value from the output probability vector and compare it with the early warning threshold to determine whether the maximum probability value exceeds the preset early warning threshold. If the maximum probability value does not exceed the early warning threshold, it is regarded as normal traffic and no early warning operation is performed. If the maximum probability value exceeds the early warning threshold, it is determined as a network attack, and the corresponding network attack type is matched, and then the early warning mechanism is triggered. Among them, the early warning mechanism includes sending an alarm, recording a log, and blocking a connection. Send an alarm notification to relevant personnel by email, text message, or system notification, record the detected attack event in detail in the log file for subsequent analysis and auditing. For high-risk attack types, immediately take measures to block the relevant connection to prevent further harm;

[0092] In step six, the formation process of the attack report is as follows:

[0093] Based on the output probability of the Snd-LSTM model and a preset warning threshold, determine the risk level of the attack event, and implement corresponding emergency response measures according to the risk level. Among them, for network attack events with high-risk attacks, immediately activate the automatic blocking mechanism to cut off the connection between the attack source and the system to prevent the spread of the attack. For network attack events with medium-risk attacks, divert the attacked traffic to a backup system or a sandbox environment for analysis and processing to relieve the pressure on the main system and collect more attack information. For all network attack events with risk attacks, real-time monitoring and logging are required for subsequent analysis and tracking. After blocking the attack source, isolate the affected system components, start the recovery process to ensure that the business resumes normal operation as soon as possible, and according to the attack type and means, strengthen the security of the system, repair vulnerabilities, and improve the defense ability. After the attack event ends, collect and analyze the data of the entire attack process, including the attack source, attack means, attack path, and system response, and based on the results of the attack data analysis, compile a detailed attack report, including an attack overview, impact analysis, emergency response measures, security strengthening suggestions, and future defense strategies. Furthermore, according to the suggestions in the attack report, optimize the network security strategy, including updating firewall rules, strengthening the configuration of intrusion detection systems (IDS) and intrusion prevention systems (IPS), etc., and improve the Snd-LSTM model, including adjusting model parameters, increasing the diversity of training data, introducing new features, etc., to improve the model's detection ability for new types of attacks.

[0094] As described above, this is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should all be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claimed rights.

Claims

1. A network attack recognition method based on the Snd-LSTM network model, characterized in that, It includes the following steps: Step 1: Collect network traffic data in real time and preprocess the network traffic data using a data cleaning algorithm; Step 2: Design the structure of the Snd-LSTM network model to capture the temporal features in network traffic. The process of designing the Snd-LSTM network model is as follows: Sort the preprocessed network traffic data in chronological order and create a sliding window to generate time series data, where the size of the sliding window is determined according to the characteristics of the network traffic and the analysis requirements; Design the structure of the Snd-LSTM network model, including an input layer, an LSTM layer, a fully connected layer, and an output layer; Among them, the input layer: accepts the preprocessed time series data as input, and the shape of the input data is the number of samples, the number of time steps, and the number of features; The LSTM layer: uses multiple LSTM units to capture temporal features, calculates the number of LSTM layer units, and uses dropout regularization to calculate the dropout regularization rate to prevent overfitting; The fully connected layer: after the LSTM layer, one or more fully connected layers need to be added for feature combination and decision-making; The output layer: selects the corresponding output layer according to the task type for classifying different attack types. For a binary classification task, the output layer has one neuron and uses the sigmoid activation function. For a multi-classification task, there are multiple neurons corresponding to different types of attacks and uses the softmax activation function; Step 3: Use the preprocessed network traffic data to train the Snd-LSTM network model, and then analyze the dynamic change trend of the network traffic; Step 4: Input the network traffic data to be detected into the trained Snd-LSTM model, perform inference calculations according to the network traffic feature pattern, and output a probability vector representing the probabilities of different network attack types. The output process of the probability vector is as follows: Collect real-time network traffic data from the network monitoring system and extract features including packet size, packet arrival interval, protocol type, source / destination IP address, and port number; Load the trained Snd-LSTM model to make the loaded model compatible with the feature set extracted from the real-time network traffic data, and batch input the preprocessed network traffic data into the model; Perform forward propagation calculations through the Snd-LSTM model. The Snd-LSTM model gradually calculates the hidden states based on the input features and the learned weights, and finally outputs a probability vector. Each element in the probability vector corresponds to a specific attack type; Step 5: Preset a warning threshold. Combine the output result of the Snd-LSTM model to determine whether the maximum probability category output by the model exceeds the preset warning threshold. If it exceeds, it is determined as the corresponding network attack type and the warning mechanism is triggered. Otherwise, it is regarded as normal traffic; Step 6: Take corresponding handling measures according to the risk level of the warning, and after the attack event ends, analyze the data of the entire attack process to form an attack report.

2. The network attack recognition method based on the Snd-LSTM network model according to claim 1, characterized in that: In the said Step 1, the process of network traffic data collection and preprocessing is: Determine the network area to be monitored according to requirements, and use the network packet capture tool Wireshark to select the corresponding network interface for listening to capture the network traffic data in the network area; Temporarily store the captured network traffic data in a specified directory on the local disk. The file format is PCAP, and use the command-line tool tshark of Wireshark to parse the PCAP file, extract the high-level protocol information, and then extract the key fields including source IP address, destination IP address, timestamp, and packet size from the parsed data, and save the extracted data in CSV format; Preprocess the parsed network traffic data, including data cleaning and data normalization.

3. The network attack recognition method based on the Snd-LSTM network model according to claim 1, characterized in that: The calculation expression for the sliding window size is: In the formula, W is the sliding window size, which is the time step, N is the total number of samples in the dataset, and σ is the standard deviation of the data noise; The calculation expression for the number of LSTM layer units is: In the formula, H is the number of units in each LSTM layer, C is a measure of data complexity, K is the limit of computing resources, and α is a tuning parameter used to control the rate at which the number of units changes with complexity and resource limitations; The calculation expression for the dropout regularization rate is: In the formula, D is the dropout regularization rate, representing the ratio of dropout regularization, M is the number of samples in the dataset, and β is a tuning parameter used to control the rate at which the dropout ratio changes with the dataset size.

4. The network attack recognition method based on the Snd-LSTM network model according to claim 3, wherein: In the third step, the training process of the Snd-LSTM network model is as follows: Ensure that the network traffic data has been sorted in chronological order and generate the time series data of the sliding window, and divide the dataset into a training set, a validation set, and a test set, with a division ratio of 70% for the training set, 15% for the validation set, and 15% for the test set; Assign corresponding labels of specific attack types to each sample according to the multi-classification task type, and perform model compilation. Among them, model compilation includes selecting a loss function, selecting an optimizer, and configuring evaluation metrics; Input the training set data into the Snd-LSTM network model, calculate the value of the loss function through forward propagation, calculate the gradient through the backpropagation algorithm, and use the optimization algorithm to update the model parameters. Repeat this process until the value of the loss function reaches the preset number of iterations, evaluate the performance of the model on the validation set, adjust the model parameters according to the validation results, retrain the model, and evaluate the performance of the final model on the test set; Use the trained Snd-LSTM network model to predict and analyze the network traffic data to identify the dynamic change trend of abnormal behavior in the network traffic.

5. The network attack recognition method based on the Snd-LSTM network model according to claim 4, wherein: The calculation expression for the dynamic change trend of the abnormal behavior is: Wherein, A(t) is the quantization value of the dynamic change trend of abnormal behavior at time t, F i is the network traffic value at time i, μ is the average value of recent traffic values, which is the mean value within a sliding window, W is the size of the sliding window, thr is the preset abnormal behavior threshold, k is an adjustment parameter used to control the attenuation speed of the abnormal value over time, ΔF(t) is the difference between the traffic value at time t and the traffic value at the previous moment, and the value range of A(t) is between 0 and 1.

6. The network attack recognition method based on the Snd-LSTM network model according to claim 1, characterized in that: The calculation expression for the probability vector is: Where, P j is the probability vector of the j-th type of attack, z j is the linear combination value before passing through the fully connected layer and the activation function, τ is the smoothing parameter, h T is the hidden state vector of the LSTM cell at time step T, W j and b j are the weight matrix and the bias vector of the fully connected layer respectively, is the scaling factor used to adjust the dynamic range of z j and δ is the upper limit value.

7. The network attack recognition method based on the Snd-LSTM network model according to claim 6, wherein: In the fifth step, the triggering process of the early warning mechanism is: According to the requirements of network attack early warning, combine historical data, business requirements, and security policies to analyze the risk levels of network attack types, classify them into low-risk attacks, medium-risk attacks, and high-risk attacks, and set different early warning thresholds for each type of network attack. Among them, normal traffic does not trigger an early warning, and there is no need to set an early warning threshold. The early warning threshold for low-risk attacks is 0.7, the early warning threshold for medium-risk attacks is 0.85, and the early warning threshold for high-risk attacks is 0.95; Find the maximum probability value from the output probability vector and compare it with the early warning threshold to determine whether the maximum probability value exceeds the preset early warning threshold; If the maximum probability value does not exceed the early warning threshold, it is regarded as normal traffic and no early warning operation is performed. If the maximum probability value exceeds the early warning threshold, it is determined as a network attack, and the corresponding network attack type is matched, and then the early warning mechanism is triggered. Among them, the early warning mechanism includes sending an alarm, recording a log, and blocking the connection.

8. A network attack recognition method based on the Snd-LSTM network model according to claim 7, characterized in that: In step six mentioned above, the formation process of the attack report is as follows: According to the output probability of the Snd-LSTM model and the preset early warning threshold, determine the risk level of the attack event, and implement corresponding emergency response measures according to the risk level. Among them, for network attack events with high-risk attacks, immediately start the automatic blocking mechanism. For network attack events with medium-risk attacks, divert the attacked traffic to a standby system or sandbox environment for analysis and processing. For all network attack events with risk attacks, real-time monitoring and log recording are required; After blocking the attack source, isolate the affected system components, start the recovery process, and perform security reinforcement on the system according to the attack type and means to repair vulnerabilities; After the attack event ends, collect and analyze the data of the entire attack process, including the attack source, attack means, attack path, and system response, and write an attack report according to the results of the attack data analysis, including an attack overview, impact analysis, emergency response measures, security reinforcement suggestions, and future defense strategies. Then, optimize the network security policy according to the suggestions in the attack report.

Images