Problem Line Determination Method Based on IP Address Classification

Abstract

The present invention relates to the field of network security and discloses a method for identifying problematic routes based on IP address classification and identification, comprising the following steps: collecting public IP behavior data from network traffic logs, extracting multi-dimensional features such as temporal regularity entropy, protocol diversity ratio, target port dispersion, and request rate change rate, and constructing an IP association graph that integrates feature similarity, time synchronization, and physical location constraints; using a community partitioning algorithm to identify abnormal IP groups, combined with a dynamic threshold adjustment mechanism based on a PID feedback control model, to adaptively optimize detection sensitivity based on real-time network load and historical false alarm rate; determining the attack type through protocol-port mapping and Mahalanobis distance statistics, generating alarm information containing a list of abnormal IPs, a time window, and classification results, and linking with security equipment to execute defense strategies. The present invention overcomes the shortcomings of traditional methods in multi-dimensional attack identification, dynamic environment adaptation, and collaborative attack detection.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for determining problematic lines based on IP address classification and identification. Background Art

[0002] As network attacks become more complex and widespread, traditional security detection methods based on traffic thresholds or static rules are gradually exposing their limitations. Existing technologies typically use single-dimensional features (such as request frequency and port access count) to identify anomalies, making it difficult to effectively identify low-frequency, covert attacks or attacks involving mixed protocols. For example, traditional methods are prone to missed detections due to the decentralized nature of source IP addresses and their disguised behavior in distributed denial of service (DDoS) attacks, or they can generate a large number of false positives due to fixed thresholds under dynamic network loads.

[0003] Furthermore, existing solutions often focus on behavioral analysis of individual IP addresses, lacking the ability to identify associations within coordinated attack groups, making them incapable of addressing emerging threats such as cross-IP coordinated port scanning and cross-protocol attacks. Regarding detection efficiency, the conflict between the need for real-time processing of massive amounts of IP data and the consumption of computing resources is becoming increasingly prominent. This is particularly true in cloud environments or large enterprise networks, where traditional centralized detection architectures struggle to balance detection accuracy and real-time requirements.

[0004] The above defects make the existing technology unable to meet the needs of accurately identifying problem lines and adaptively defending against collaborative attacks in complex network environments. There is an urgent need for a comprehensive solution that integrates multi-dimensional behavior analysis, dynamic threshold adjustment and efficient group detection. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for determining problem lines based on IP address classification identification, which overcomes the shortcomings of existing methods in multi-dimensional attack behavior identification, dynamic threshold adaptation and collaborative attack group detection.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0007] The method for determining a problem line based on IP address classification identification includes the following steps:

[0008] Collect IP address behavior data from network traffic logs, including timestamps, protocol types, destination ports, and physical locations;

[0009] Extracting multi-dimensional features of each IP address based on the behavioral data, wherein the multi-dimensional features include at least a temporal regularity entropy value, a protocol diversity ratio, a target port dispersion, and a request rate change rate;

[0010] Constructing an IP association graph based on the multi-dimensional features, where nodes represent IP addresses and edge weights are calculated by fusing feature similarity, time synchronization, and physical location distance;

[0011] Perform community division on the IP association graph to detect abnormal IP groups with similar behavior patterns;

[0012] Dynamically adjust the detection threshold based on historical false alarm rates and real-time network load, and the dynamic adjustment is achieved through a feedback control mechanism;

[0013] Based on the detection threshold and the statistical characteristics of the abnormal IP group, the problem line is determined and an alarm message is generated.

[0014] Preferably, when collecting IP address behavior data in the network traffic log, the intranet IP addresses are filtered and only the public IP addresses are retained for analysis.

[0015] Preferably, in the step of extracting multi-dimensional features of each IP address based on the behavioral data:

[0016] Temporal regularity entropy: Calculates the entropy of time interval distribution based on binned statistics of IP request timestamps.

[0017] Protocol diversity ratio: Statistics on the ratio of HTTP and HTTPS protocol requests to the total number of IP requests;

[0018] Target port dispersion: The variance of the target port numbers accessed by IP addresses is calculated to measure the concentration of port accesses.

[0019] Request rate change rate: Quantifies the degree of sudden change in the request rate through the second-order derivative of the request volume within the sliding window.

[0020] Preferably, the calculation formula for the edge weight in the IP association graph is:

[0021]

[0022] in, Indicates an IP address and The eigenvector of Represents the feature vector and The cosine similarity of Indicates an IP address and Request time series data within a time window; is the time synchronization coefficient, which indicates the time correlation of the two IP request behaviors; Indicates an IP address and The longitude and latitude coordinates of the physical location; Indicates the spherical geographic distance calculated based on latitude and longitude coordinates; is a non-negative weight parameter.

[0023] Preferably, the step of dividing the IP association graph into communities and detecting abnormal IP groups with similar behavior patterns includes:

[0024] Use the Louvain algorithm to discover communities on the IP association graph and output a set of IP groups with strong associations;

[0025] Calculate the protocol entropy of IP addresses in each community. The protocol entropy is used to measure the randomness of the distribution of network protocol types in the community.

[0026] If the protocol entropy is lower than the preset threshold, the current time window length is shortened to improve detection sensitivity;

[0027] Secondary clustering is performed on the IP addresses within each community, combining time synchronization and behavioral feature similarity to identify sudden abnormal subgroups.

[0028] Preferably, the step of dynamically adjusting the detection threshold according to the historical false alarm rate and the real-time network load includes:

[0029] A feedback control model is established, whose input is the real-time false alarm rate and the size of the abnormal IP group, and the output is the detection threshold adjustment;

[0030] The threshold adjustment amount is calculated based on the PID control mechanism, and the formula is:

[0031]

[0032] in, is the detection threshold at the next moment; is the detection threshold at the current moment; , is the initial proportional coefficient, is the current size of the abnormal IP group, is the total number of active IPs; is the integration coefficient; is the differential coefficient; Real-time false alarm rate, defined as the ratio of the number of false alarms to the total number of alarms; The integral of the historical false alarm rate from the initial moment to the current moment; is the rate of change of false alarm rate over time;

[0033] The threshold is compensated according to the real-time network load. When the load exceeds the preset safety value, the detection threshold is reduced proportionally:

[0034]

[0035] in, is the final detection threshold after load compensation; For real-time network load; It is the preset network load safety threshold; The maximum load threshold allowed by the network.

[0036] Preferably, the initial proportional coefficient , integral coefficient , differential coefficient Obtained through training with historical attack data;

[0037] When the network topology changes, the initial proportional coefficient is retrained based on the false alarm rate and attack data within a preset time period. , integral coefficient , differential coefficient .

[0038] Preferably, the statistical feature is determined to be a problem line when it meets any of the following conditions:

[0039] The size of the abnormal IP group exceeds the current detection threshold;

[0040] The Mahalanobis distance between abnormal group behavior and normal patterns exceeds a preset multiple of the standard deviation.

[0041] Preferably, the alarm information includes an abnormal IP list, an associated time window, and an attack type classification.

[0042] The present invention also provides a device for determining a problem line based on IP address classification identification, comprising:

[0043] Data collection module, used to filter and divide IP behavior data in network traffic logs;

[0044] Feature extraction module, used to calculate multi-dimensional features and generate feature matrix;

[0045] Association graph construction module, used to calculate the edge weights between IP nodes and generate an association graph;

[0046] Community detection module, used to divide abnormal IP groups and dynamically adjust time windows;

[0047] Dynamic parameter adjustment module, used to optimize the detection threshold through PID feedback mechanism;

[0048] The alarm output module generates problem line alarms based on thresholds and statistical features.

[0049] In summary, the present invention includes at least one of the following beneficial technical effects:

[0050] 1. This invention integrates heterogeneous features such as temporal regularity entropy and protocol diversity ratios to construct an IP association graph for group behavior analysis, overcoming the detection blind spots caused by traditional methods' reliance on single features. Compared to detection methods based solely on traffic thresholds or protocol statistics, this multi-dimensional feature collaborative analysis can more comprehensively identify covert attacks (such as low-frequency, slow attacks and mixed-protocol scanning), significantly improving the detection rate of abnormal behavior.

[0051] 2. This invention introduces a dynamic threshold adjustment mechanism based on PID feedback control and network load compensation to address the conflict between false alarms and missed detections caused by fixed thresholds in traffic fluctuations. By using real-time false alarm rate and attack data feedback, the threshold can be intelligently adjusted based on attack intensity and network load, maintaining detection sensitivity in high-concurrency traffic while avoiding excessive alerts during low-load conditions.

[0052] 3. This invention uses a protocol-port mapping table and Mahalanobis distance statistics to automatically classify attack types (such as DDoS and port scanning). Combining a list of abnormal IP addresses with associated time window information, it supports rapid location of attack sources and analysis of attack chain traceability, providing data support for subsequent defense strategy development and shortening security incident response cycles.

[0053] 4. This invention employs a detection architecture that combines community partitioning with secondary clustering, performing fine-grained subpopulation analysis based on coarse-grained community partitioning. This layered detection strategy effectively reduces computational complexity and, through dynamic time window adjustment driven by protocol entropy, enhances the ability to capture sudden attacks in real time, making it suitable for efficient detection in large-scale network environments.

[0054] 5. This invention integrates alarm information with the APIs of third-party security devices (such as firewalls and traffic cleaning systems) to enable actions such as automatic blocking of attacking IP addresses and abnormal traffic diversion. This closed-loop linkage between detection and action reduces manual intervention delays and enhances the proactive defense capabilities of the network security protection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 Schematic diagram of the method flow of the present invention;

[0056] Figure 2 Schematic diagram of the device structure of the present invention.

[0057] Among them, 10, data acquisition module; 20, feature extraction module; 30, association graph construction module; 40, community detection module; 50, dynamic parameter adjustment module; 60, alarm output module. DETAILED DESCRIPTION

[0058] The following is combined with Figure 1 -Attached Figure 2 , the present invention is described in further detail.

[0059] The present invention provides a method for determining problem lines based on IP address classification and identification, which realizes accurate detection and alarm of abnormal network lines through multi-dimensional feature fusion, dynamic threshold adjustment and group behavior analysis.

[0060] like Figure 1 As shown, the method for determining a problem line based on IP address classification identification may include the following steps:

[0061] S1, collect IP address behavior data in network traffic logs and preprocess them;

[0062] S2. Extract multi-dimensional features of each IP address based on behavioral data;

[0063] S3, build IP association graph based on multi-dimensional features;

[0064] S4. Divide the IP association graph into communities and detect abnormal IP groups with similar behavior patterns;

[0065] S5. Dynamically adjust the detection threshold based on the historical false alarm rate and real-time network load. Dynamic adjustment is achieved through a feedback control mechanism.

[0066] S6. Based on the detection threshold and the statistical characteristics of the abnormal IP group, the problem line is determined and an alarm information is generated.

[0067] The following is a detailed description of each step in the method of the present invention, which comprehensively explains the specific implementation principles, technical details and processes of each step.

[0068] Regarding step S1, in this embodiment, the collection and preprocessing of IP address behavior data in the network traffic log is achieved by the following method:

[0069] Specifically, the raw data of the network traffic log comes from the core switch mirror port and the session recording module of the border firewall in the network infrastructure, and is obtained in real time through a preset data collection interface.

[0070] Behavioral data fields include but are not limited to: timestamp (recording accuracy is millisecond level), protocol type (including TCP, UDP, HTTP, HTTPS, ICMP, etc.), target port number (range 1-65535), and IP address physical location information.

[0071] Among them, the physical location information is mapped to latitude and longitude coordinates by calling a third-party IP address location query interface and stored as geo-tag data.

[0072] Furthermore, during the data preprocessing phase, raw logs are filtered using the intranet IP address range defined by RFC 1918. Preferably, intranet IP addresses include reserved address ranges such as 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16, enabling efficient filtering through regular expression matching. After this processing, only public IP addresses are retained for subsequent analysis, preventing normal communication behavior of intranet devices from interfering with anomaly detection.

[0073] To adapt to dynamic network traffic characteristics, the collected log data is preferably divided into time windows. This time window mechanism uses a sliding window mechanism, with an initial window length of 1 hour and a sliding step of 5 minutes. This mechanism divides the continuous time series log data into overlapping time slices, thereby balancing the real-time detection and the integrity of the behavior pattern. For example, for traffic data with a timestamp of t, the corresponding time window covers the interval [t-1 hour, t], and the next window slides to [t-55 minutes, t+5 minutes].

[0074] Furthermore, data blocks within a time window are further standardized for storage. Preferably, a columnar database is used to index fields such as timestamps and protocol types to support efficient feature extraction queries. For large-scale network environments, a distributed storage architecture is used to process highly concurrent traffic logs, ensuring data collection throughput and system scalability.

[0075] It should be noted that the acquisition of physical location information must meet data privacy compliance requirements. Preferably, during the mapping process between IP addresses and latitude and longitude coordinates, desensitization technology is used to retain only city-level positioning accuracy (for example, rounding latitude and longitude coordinates to two decimal places) to avoid the risk of leaking precise geographic location information.

[0076] Furthermore, the preprocessed data is used as input for multi-dimensional feature calculations. Through time window partitioning and sliding mechanisms, we can effectively capture the temporal variation characteristics of IP address behavior, such as periodic access patterns or sudden request peaks, providing basic data support for the subsequent construction of IP association graphs.

[0077] Regarding step S2, in this embodiment, the extraction of multi-dimensional features of the IP address is achieved by:

[0078] In this embodiment, the multi-dimensional features include at least the temporal regularity entropy value, the protocol diversity ratio, the target port dispersion, and the request rate change rate.

[0079] The calculation of the temporal regularity entropy value is based on the distribution characteristics of the IP address request behavior within the time window. Preferably, the time window is divided into multiple equally spaced bins, the number of requests in each bin is counted, and its probability distribution is calculated. Furthermore, the information entropy is used to quantify the randomness of the temporal distribution, and the calculation formula is:

[0080]

[0081] in, is the total number of bins, Indicates the The proportion of requests for each bin, is the number of requests for this bin, The total number of requests within the time window. This entropy value can effectively characterize the periodicity and regularity of IP address access behavior. For example, a high entropy value reflects a random access pattern, while a low entropy value suggests regular behavior.

[0082] The protocol diversity ratio is used to measure the tendency of IP addresses to choose application layer protocols. Preferably, the number of HTTP (port 80) and HTTPS (port 443) requests is counted and their proportion to the total number of requests is calculated:

[0083]

[0084] in, 、 The ratios are the number of requests for the corresponding protocols. This ratio can be used to identify abnormal protocol usage. For example, malicious scans are often accompanied by high-frequency access to non-standard protocols or ports.

[0085] The target port dispersion quantifies the concentration of IP address access ports through variance. Specifically, the target port number sequence of all IP addresses accessed within the time window is counted. , and calculate its variance:

[0086]

[0087] in, is the mean of the port numbers. A high variance indicates dispersed port access, which may correspond to normal users accessing multiple services; a low variance indicates concentrated port access, which may be related to port scanning or brute force attacks.

[0088] The request rate change rate is used to capture the sudden characteristics of IP address request behavior. Preferably, a sliding window mechanism is used to obtain the request time series. , and calculate its second-order derivative:

[0089]

[0090] in, is the sliding window step size. The second-order derivative can reflect the acceleration of the request rate, such as a sudden increase or decrease, and thus identify transient abnormal behaviors such as DDoS attacks.

[0091] It should be noted that the above multi-dimensional features need to be normalized after calculation. Preferably, the Z-score normalization method is used to map each feature value to the same dimension to avoid model deviation caused by differences in numerical ranges. The normalization formula is:

[0092]

[0093] in, 、 are the mean and standard deviation of the feature in historical data respectively.

[0094] The fusion of these multi-dimensional features comprehensively characterizes the behavioral patterns of IP addresses, providing heterogeneous feature input for the subsequent construction of IP association graphs. For example, the temporal regularity entropy and the request rate change rate jointly reflect the characteristics of temporal behavior, while the protocol diversity ratio and target port dispersion characterize differences in application-layer behavior, thus supporting the multi-dimensional fusion calculation of edge weights in the association graph.

[0095] Regarding step S3, in this embodiment, the construction of the IP association graph is achieved by integrating multi-dimensional behavioral features with spatiotemporal correlation, as follows:

[0096] The IP association graph uses a preprocessed set of public IP addresses as nodes, and the strength of the association between nodes is quantified using edge weights. Preferably, if two IP addresses communicate at least once within the same time window (for example, a successful TCP handshake or UDP packet exchange), a corresponding edge connection is established, thus avoiding the computational complexity of a fully connected graph.

[0097] Furthermore, the edge weight calculation is based on a comprehensive evaluation of feature similarity, time synchronization, and physical location distance. Specifically, the edge weight calculation formula is defined as:

[0098]

[0099] The meaning and calculation method of each component are as follows:

[0100] Indicates an IP address and The cosine similarity of the multidimensional feature vector of . Preferably, the feature vector The temporal regularity entropy value extracted by step S2 , protocol diversity ratio , target port dispersion and request rate change rate The calculation formula is:

[0101]

[0102] This component can effectively measure the similarity between the behavior patterns of two IP addresses. For example, the traffic generated by the same attack tool usually has similar characteristic distribution.

[0103] It is used to quantify the synergy of the request behavior of two IP addresses within a time window. Preferably, the time window is divided into multiple sub-windows (for example, each 5 minutes is a sub-window), and the request count sequence of the two IP addresses in each sub-window is counted. and , and calculate its Pearson correlation coefficient:

[0104]

[0105] in, 、 is the average number of requests. This component can identify coordinated attack behaviors. For example, in a distributed denial of service (DDoS) attack, burst traffic from multiple IP addresses often exhibits time synchronization.

[0106] Represents the spherical distance between the physical locations of two IP addresses. Preferably, based on latitude and longitude coordinates and , calculated using the Haversine formula:

[0107]

[0108] in, is the radius of the Earth, , This component is used to suppress misassociation of IP addresses in close geographical locations due to network topology, such as a normal server cluster in the same data center.

[0109] Weight parameter Used to adjust the contribution ratio of each component. Preferably, based on the known abnormal IP associated samples in the historical attack data, the parameter combination is optimized by the gradient descent method so that the edge weight of the abnormal group is significantly higher than that of the normal group. In addition, This is used to avoid abnormal weight amplification caused by the denominator approaching zero when the geographical distance is too close.

[0110] It's important to note that the fusion calculation of edge weights not only encompasses behavioral features and time dimensions but also incorporates physical location constraints, overcoming the limitations of single-feature associations. For example, traditional methods that rely solely on protocol or port similarity can lead to misjudgments. However, this solution, through multi-dimensional fusion, can more accurately distinguish between coordinated attacks and the accidental similarities of normal user groups.

[0111] Furthermore, the IP association graph is stored in an adjacency list structure, suitable for efficient graph traversal and community delineation algorithms in large-scale network environments. Preferably, a sparse matrix compression format is used to reduce memory usage, and a distributed graph computing framework is used to achieve horizontal scalability to support real-time association analysis of massive IP addresses.

[0112] Regarding step S4, in this embodiment, community division and anomaly detection of the IP association graph are achieved through multi-stage collaborative analysis, as follows:

[0113] Specifically, the community division adopts the Louvain algorithm based on modularity optimization. Preferably, the IP association graph is divided into multiple communities by iteratively merging nodes to maximize the modularity index, and the edge weight between nodes in each community is significantly higher than the connection weight between communities. The modularity calculation formula is:

[0114]

[0115] in, is the sum of all edge weights in the graph, 、 Node and The weighted degree, 、 is the community to which the node belongs, If the communities are the same, the value is 1; otherwise, the value is 0. This algorithm can effectively identify IP groups with strong correlations, such as coordinated attack groups or normal users in the same service cluster.

[0116] Furthermore, protocol entropy analysis is performed for each community. Protocol entropy is used to quantify the diversity of network protocols used within the community. The calculation formula is:

[0117]

[0118] in, Protocol type The probability of occurrence in the community. When it is lower than the preset threshold, it is determined to be a low protocol diversity scenario (for example, a single protocol is widely used in DDoS attacks). At this time, the current time window length is dynamically shortened to improve detection sensitivity. It should be noted that the shortening ratio of the time window is positively correlated with the deviation degree of protocol entropy. For example, when When , the window length is adjusted to 50% of the original value to capture more fine-grained burst behaviors.

[0119] In order to solve the local anomalies that may be missed by coarse-grained community division, the present invention introduces secondary clustering analysis. Similarity to behavioral characteristics Construct a two-dimensional feature space and use a density clustering algorithm (such as DBSCAN) to identify dense subgroups. Specifically, if the subgroups meet the following conditions at the same time:

[0120] 1. Time synchronization (Preferably, );

[0121] 2. Feature similarity (Preferably, );

[0122] This step can effectively distinguish local abnormal behaviors within a normal community, such as highly coordinated port scanning attacks in a short period of time.

[0123] It's important to note that the synergistic mechanism of dynamic time window adjustment and secondary clustering can address the limited adaptability of traditional static detection methods in complex network environments. For example, in scenarios with low protocol diversity, shortening the time window allows for a quicker response to attacks, while secondary clustering, through multi-feature constraints, avoids the risk of missed detections caused by overly coarse community divisions.

[0124] Furthermore, the output of abnormal IP groups includes community identification, sub-cluster labels, and associated time window ranges, providing a data foundation for subsequent threshold adjustment and alarm generation. Preferably, a graph database is used to store community structure and attribute information, supporting traceability queries and visualization based on time windows.

[0125] Regarding step S5, in this embodiment, the dynamic adjustment of the detection threshold is achieved through a feedback control mechanism and network load adaptive compensation, as follows:

[0126] Feedback control model with real-time false alarm rate and the size of abnormal IP groups is the input variable, and the output detection threshold adjustment Preferably, a proportional-integral-derivative (PID) control mechanism is adopted, and its mathematical expression is:

[0127]

[0128] The components are defined as follows:

[0129] Proportional term: Used to quickly respond to real-time false alarm rate deviations. Preferably, the proportional coefficient Dynamically associated anomaly group size:

[0130]

[0131] in, is the initial proportional coefficient, = is the total number of currently active IP addresses. As the size of the abnormal group increases, the proportional coefficient increases proportionally, thereby increasing sensitivity to large-scale attacks.

[0132] Integral item: It is used to eliminate the accumulated errors of historical false alarm rates. For example, the long-standing steady-state deviation of false alarm rates can be gradually corrected through the integral term to prevent the threshold from continuously deviating from the reasonable range.

[0133] Differential term: Used to suppress transient mutation interference of false alarm rate, such as false alarm rate spikes caused by short-term network fluctuations.

[0134] It should be noted that the PID control parameters 、 、 The initial value of is obtained by training with historical attack data. Preferably, a supervised learning method is used, with the optimization goal of minimizing the historical false alarm rate and the attack missed detection rate, and the optimal parameter combination is iteratively solved by the gradient descent method.

[0135] Furthermore, real-time network load It is introduced as a threshold compensation factor. Preferably, the network load is measured by bandwidth utilization or the number of concurrent connections. When the load exceeds the preset safety threshold When the detection threshold is lowered according to the excess ratio:

[0136]

[0137] in, is the maximum load threshold allowed by the network. For example, when When , the threshold remains unchanged; when Approaching When , the threshold decreases linearly to prevent the risk of missed detection in high-load scenarios.

[0138] It's important to emphasize that PID parameters are continuously updated during system operation. Ideally, when the network topology changes (such as adding a new server cluster or adjusting firewall policies), the parameters are retrained based on false alarm rates and attack data from a preset time period. For example, a sliding time window mechanism can be used, using the last 24 hours of data as the training set, to ensure the model adapts to changes in the network environment.

[0139] Through this dynamic adjustment mechanism, the detection threshold can adapt to changes in network status and attack dynamics. For example, when the load is low and the false alarm rate is stable, the threshold remains high to reduce false alarms; while in high-load or sudden attack scenarios, the threshold automatically decreases to improve detection sensitivity.

[0140] Regarding step S6, in this embodiment, the determination of the problem line and the generation of the alarm information are implemented through a multi-condition joint decision-making mechanism, as follows:

[0141] The judgment condition is based on the combined analysis of the detection threshold dynamically adjusted in step S5 and the statistical characteristics of the abnormal IP group. When any of the following conditions is met, the current line is judged to be a problem line:

[0142] 1. The size of the abnormal IP group exceeds the limit:

[0143] If the size of the abnormal IP group Exceeds the final detection threshold after load compensation ,Right now

[0144]

[0145] This condition directly reflects whether the scale of the attack has reached the preset risk level. For example, in a large-scale DDoS attack, the number of abnormal IP addresses significantly exceeds the normal business traffic threshold.

[0146] 2. Group behavior deviates from normal patterns:

[0147] If the Mahalanobis distance between the abnormal group behavior and the normal mode exceeds the dynamic judgment threshold,

[0148]

[0149] in, is the Mahalanobis distance, is the characteristic vector of the current abnormal group (including temporal regularity entropy, protocol diversity ratio, etc.), 、 are the mean vector and covariance matrix of historical normal population characteristics, is the standard deviation of the normal mode, is a multiplication factor dynamically calculated based on the historical attack frequency. Adaptive adjustment is performed by counting the attack frequency through a sliding window, such as automatically increasing the attack frequency during high attack frequency periods. To reduce false positives.

[0150] It's important to note that the introduction of the Mahalanobis distance effectively eliminates interference caused by dimensional differences and correlations between features. For example, the temporal regularity entropy value and the rate of change of the request rate may be strongly correlated. Directly using the Euclidean distance can lead to misjudgment. However, the Mahalanobis distance decouples features through the inverse operation of the covariance matrix, thereby improving the accuracy of statistical judgments.

[0151] Furthermore, the generation of the alarm information includes the following fields:

[0152] Abnormal IP list: output all IP addresses in the abnormal subgroup detected in step S4, preferably sorted in descending order by activity (number of requests);

[0153] Correlation time window: A time interval accurate to the minute (e.g., 2023-05-22 14:00-14:05), used to locate the attack period;

[0154] Attack type classification: Based on the combination of protocol type and target port, it is mapped to a predefined attack type library. For example, frequent access to SSH port (22) is classified as a brute force attack, while frequent access to the same HTTP port (80) from multiple source IPs is classified as a CC attack.

[0155] Preferably, the attack type library is implemented by a preset protocol-port-threat type mapping table. Specifically, the mapping table contains the following typical entries:

[0156] TCP / 22 (SSH) → brute force;

[0157] UDP / 53 (DNS) → DNS amplification attack;

[0158] TCP / 80 (HTTP) → CC attack or web vulnerability exploitation.

[0159] It's important to emphasize that alert information is stored in a structured format (such as JSON or XML) and integrated into the alert management module of the security operations platform. Preferably, it's pushed to third-party security devices (such as firewalls or traffic scrubbing devices) via an API, triggering automated action such as IP blocking or traffic diversion.

[0160] The aforementioned judgment and alert mechanism enables rapid location of abnormal lines and accurate identification of attack types, providing actionable security event data support for network defense. For example, combining dynamic thresholds and statistical distances as dual judgment criteria avoids the limitations of a single metric while ensuring adaptability to new attack patterns.

[0161] In general, the present invention collects public IP behavior data from network traffic logs, extracts multi-dimensional features including time regularity entropy, protocol diversity ratio, target port dispersion and request rate change rate, constructs an IP association graph that integrates feature similarity, time synchronization and physical location distance, uses a community partitioning algorithm to detect abnormal IP groups, and dynamically adjusts the detection threshold based on historical false alarm rate and real-time network load. Finally, the problem line is determined according to the statistical characteristics of group size exceeding the limit or behavior pattern deviation, and generates alarm information including abnormal IP list, associated time window and attack type classification, so as to realize accurate identification and adaptive defense of abnormal network behavior.

[0162] The apparatus for determining a problematic line based on IP address classification and identification described below and the method for determining a problematic line based on IP address classification and identification described above may refer to each other.

[0163] Please see the attached Figure 2 The present invention also provides a device for determining a problem line based on IP address classification identification, comprising:

[0164] Data collection module 10, used to filter and divide IP behavior data in network traffic logs;

[0165] Feature extraction module 20, used to calculate multi-dimensional features and generate a feature matrix;

[0166] The association graph construction module 30 is used to calculate the edge weights between IP nodes and generate an association graph;

[0167] Community detection module 40, used to divide abnormal IP groups and dynamically adjust the time window;

[0168] A dynamic parameter adjustment module 50 is used to optimize the detection threshold through a PID feedback mechanism;

[0169] The alarm output module 60 generates a problem line alarm based on the threshold and statistical characteristics.

[0170] The device of this embodiment can be used to execute the above method embodiment, and its principles and technical effects are similar, so they will not be repeated here.

[0171] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and alterations may be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is determined by the appended claims and their equivalents.

Claims

1. A method for determining problematic lines based on IP address classification, characterized in that: The following steps are involved: Collect IP address behavior data from network traffic logs, including timestamps, protocol types, destination ports, and physical locations; Extracting multi-dimensional features of each IP address based on the behavioral data, wherein the multi-dimensional features include at least a temporal regularity entropy value, a protocol diversity ratio, a target port dispersion, and a request rate change rate; Constructing an IP association graph based on the multi-dimensional features, where nodes represent IP addresses and edge weights are calculated by fusing feature similarity, time synchronization, and physical location distance; Perform community division on the IP association graph to detect abnormal IP groups with similar behavior patterns; Dynamically adjust the detection threshold based on historical false alarm rates and real-time network load, and the dynamic adjustment is achieved through a feedback control mechanism; Based on the detection threshold and the statistical characteristics of the abnormal IP group, the problem line is determined and an alarm information is generated; In the step of extracting multi-dimensional features of each IP address based on the behavior data: Temporal regularity entropy: Calculates the entropy of time interval distribution based on binned statistics of IP request timestamps. Protocol diversity ratio: Statistics on the ratio of HTTP and HTTPS protocol requests to the total number of IP requests; Target port dispersion: The variance of the target port numbers accessed by IP addresses is calculated to measure the concentration of port accesses. Request rate change rate: quantifies the degree of sudden change in the request rate through the second-order derivative of the request volume within the sliding window; The calculation formula for the edge weight in the IP association graph is: Among them, F i , F j Indicates IP address i and IP j The characteristic vector of S cosine (F i , F j ) represents the eigenvector F i With F j Cosine similarity of T i , T j Indicates IP address i and IP j Request time series data within a time window; S syne (T i , T j ) is the time synchronization coefficient, which indicates the time correlation of two IP request behaviors; L i ,L j Indicates IP address i and IP j The longitude and latitude coordinates of the physical location; D geo (L i , L j ) represents the spherical geographic distance calculated based on longitude and latitude coordinates; α, β, γ are non-negative weight parameters; The step of dynamically adjusting the detection threshold according to the historical false alarm rate and the real-time network load includes: A feedback control model is established, whose input is the real-time false alarm rate and the size of the abnormal IP group, and the output is the detection threshold adjustment; The detection threshold adjustment is calculated based on the PID control mechanism. The formula is: Wherein, Threshold(t+1) is the detection threshold at the next moment; Threshold(t) is the detection threshold at the current moment; K p0 is the initial proportional coefficient, N abnormal is the current size of the abnormal IP group, N total is the total number of active IPs; K i is the integral coefficient; K d is the differential coefficient; e(t) is the real-time false alarm rate, which is defined as the ratio of the number of false alarms to the total number of alarms; The integral of the historical false alarm rate from the initial moment to the current moment; is the rate of change of false alarm rate over time; The threshold is compensated according to the real-time network load. When the load exceeds the preset safety value, the detection threshold is reduced proportionally: Among them, Threshold final (t) is the final detection threshold after load compensation; L(t) is the real-time network load; L safe is the preset network load safety threshold; L max The maximum load threshold allowed by the network; A line is considered problematic if the statistical characteristics meet any of the following conditions: The size of the abnormal IP group exceeds the current detection threshold; The Mahalanobis distance between abnormal group behavior and normal patterns exceeds a preset multiple of the standard deviation.

2. The method for determining a problem line based on IP address classification identification according to claim 1, characterized in that: When collecting IP address behavior data in the network traffic log, the intranet IP addresses are filtered and only the public IP addresses are retained for analysis.

3. The method for determining a problem line based on IP address classification identification according to claim 1, characterized in that: The step of dividing the IP association graph into communities and detecting abnormal IP groups with similar behavior patterns includes: Use the Louvain algorithm to discover communities on the IP association graph and output a set of IP groups with strong associations; Calculate the protocol entropy of IP addresses in each community. The protocol entropy is used to measure the randomness of the distribution of network protocol types in the community. If the protocol entropy is lower than the preset threshold, the current time window length is shortened to improve detection sensitivity; Secondary clustering is performed on the IP addresses within each community, combining time synchronization and behavioral feature similarity to identify sudden abnormal subgroups.

4. The method for determining a problem line based on IP address classification identification according to claim 1, characterized in that: The initial proportional coefficient K p0 , integral coefficient K i , differential coefficient K d Obtained through training with historical attack data; When the network topology changes, the initial proportional coefficient K is retrained based on the false alarm rate and attack data within a preset time period. p0 , integral coefficient K i , differential coefficient K d .

5. The method for determining a problem line based on IP address classification identification according to claim 1, characterized in that: The alarm information includes a list of abnormal IP addresses, associated time windows, and attack type classifications.

Images