A method and system for detecting threats to network transmission and process activities

Abstract

The present invention provides a method and system for detecting threats in network transmission and process activities, relating to the field of network security technology. The method comprises: collecting network transmission and process activity data, preprocessing the data to obtain network transmission and process activity data; extracting traffic characteristics and physical characteristics based on the network transmission and process activity data; fusing the extracted traffic characteristics and physical characteristics to obtain fused feature data; constructing a threat rule library based on historical data using a genetic algorithm to obtain normal behavior and known threat patterns, setting a first reference point as a feature mean vector of a normal behavior pattern, and a second reference point as a feature mean vector of a known threat pattern. The present invention achieves efficient and accurate detection of threats in network transmission and process activities through comprehensive data collection and preprocessing, key feature extraction, feature fusion, construction of a threat rule library, optimization of distance difference calculation, and matching analysis using KNN.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for detecting threats to network transmission and process activities. Background Art

[0002] With the rapid development of information technology, the internet has become an indispensable infrastructure for the functioning of modern society and personal life. The widespread use of network technology has greatly improved information transmission efficiency, facilitated resource sharing, and facilitated collaborative work. However, network security issues have also become increasingly prominent, becoming a key factor hindering the further development of the internet. Abnormal behavior in network transmission and process activities, such as data leakage, malware infection, and DDoS attacks, have become a major source of network security threats. These threats not only lead to the leakage of personal privacy and the loss of corporate assets, but also have serious impacts on national security and social stability.

[0003] There are many types of network threats, including viruses, Trojans, worms, ransomware, spyware, and more, with new threats constantly emerging. Network transmission and process activity generate enormous amounts of data in diverse formats, including text, images, and videos. Normal and abnormal behavior in the data are often intertwined, making it difficult to distinguish using simple rules or patterns. Network security threats are real-time, requiring threat detection systems to process and analyze data in real time or near real time to detect and respond to threats promptly. Threat detection accuracy is a key metric for evaluating detection system performance. However, due to the diversity of threats and the complexity of data, some existing detection methods lack accuracy. False positives and false negatives are common problems in threat detection, leading to a waste of security resources or the exposure of security vulnerabilities. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a threat detection method for network transmission and process activities. By comprehensively collecting and preprocessing data, extracting key features, fusing features, building a threat rule library, optimizing distance difference calculation, and using KNN for matching analysis, efficient and accurate detection of threats in network transmission and process activities is achieved.

[0005] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0006] In a first aspect, a method for detecting threats to network transmission and process activities is provided, the method comprising:

[0007] Collect network transmission and process activity data, pre-process the data, and obtain network transmission and process activity data;

[0008] Extract traffic characteristics and physical characteristics based on network transmission and process activity data;

[0009] The extracted traffic features and physical features are fused to obtain fused feature data;

[0010] Based on historical data, a threat rule library is constructed using a genetic algorithm to obtain normal behavior and known threat patterns. The first reference point is set as the feature mean vector of the normal behavior pattern, and the second reference point is set as the feature mean vector of the known threat pattern.

[0011] For each fused feature data, the distance difference between the two reference points is calculated, and the nonlinear transformation of the distance difference is optimized by the L-BFGS algorithm to generate new features;

[0012] According to the threat rule base, new features are matched and analyzed through KNN, and matching results are obtained by identifying threat data to achieve threat detection of network transmission and process activities.

[0013] Furthermore, data on network transmission and process activities is collected and preprocessed to obtain data on network transmission and process activities, including:

[0014] Collect raw data on network transmission and process activities;

[0015] By cleaning the collected raw data, removing noise, outliers and erroneous data, we obtain the preprocessed network transmission and process activity data.

[0016] Furthermore, based on the data of network transmission and process activities, traffic characteristics and physical characteristics are extracted, including:

[0017] Based on the pre-processed data, traffic features are extracted from network transmission and physical features are extracted from process activities;

[0018] By extracting flow characteristics and physical characteristics and performing dimensionality reduction processing, optimized flow characteristics and physical characteristics are obtained.

[0019] Furthermore, the extracted traffic features and physical features are fused to obtain fused feature data, including:

[0020] Perform feature selection based on the extracted flow characteristics and physical characteristics to obtain selected feature data;

[0021] The selected feature data is weightedly fused, and the traffic features and physical features are directly concatenated into a long vector to generate fused feature data.

[0022] Furthermore, based on historical data, a threat rule base is constructed through a genetic algorithm to obtain normal behavior and known threat patterns. The first reference point is set as the feature mean vector of the normal behavior pattern, and the second reference point is set as the feature mean vector of the known threat pattern, including:

[0023] Based on historical network traffic and process activity data, an initial population is generated through a genetic algorithm, where each individual represents a potential threat rule;

[0024] Perform crossover and mutation operations on the selected individuals to generate new individuals. The crossover operation generates new individuals by exchanging some genes of two individuals, while the mutation operation introduces diversity by randomly changing some genes of the individuals. Repeat the evaluation and optimization process to reach the maximum number of iterations.

[0025] Organize the optimized individuals into a threat rule library;

[0026] According to the normal behavior pattern and known threat pattern in the threat rule library, the feature mean vector of the normal behavior pattern is set as the first reference point , the feature mean vector of the known threat pattern is set as the second reference point ;

[0027] According to each feature in the normal behavior pattern, the average value of all samples on this feature is calculated to obtain the feature mean vector of the normal behavior pattern. , For each feature in , calculate the average value of all samples on this feature to obtain the feature mean vector of the threat pattern .

[0028] Furthermore, for each fused feature data, the distance difference between the two reference points is calculated, and the nonlinear transformation of the distance difference is optimized by the L-BFGS algorithm to generate new features, including:

[0029] According to each fusion feature data, the Euclidean distance of the first reference point is calculated Calculate the Euclidean distance of the second reference point, , get the distance difference between the two reference points, where is the Euclidean distance to the first reference point, is the Euclidean distance to the second reference point;

[0030] According to the distance difference between the two reference points, a nonlinear transformation function of the distance difference is constructed. ;

[0031] By optimizing the objective function Get the optimized nonlinear transformation function

[0032] Through the optimized nonlinear transformation function Perform the transformation to obtain the new eigenvalues.

[0033] Furthermore, based on the threat rule base, the new features are matched and analyzed using KNN. By identifying threat data, matching results are obtained to achieve threat detection for network transmission and process activities, including:

[0034] Through the threat rule base and the new feature data, the Euclidean distance is used to calculate the distance between the new feature and each feature vector in the threat rule base;

[0035] Based on the distance of each eigenvector, the statistical results of the threat type are obtained through the distance matrix and the K value. The K value represents the number of nearest neighbors that need to be considered in the KNN algorithm.

[0036] According to the statistical results of the threat type, check whether the number of threat types is included in the statistical results of the threat type to obtain a matching result;

[0037] Based on the matching results, threat detection of network transmission and process activities can be achieved.

[0038] In a second aspect, a threat detection system for network transmission and process activities includes:

[0039] The acquisition module is used to collect data on network transmission and process activities, pre-process the data, and obtain the data on network transmission and process activities;

[0040] The extraction module is used to extract traffic features and physical features based on the data of network transmission and process activities; and fuse the extracted traffic features and physical features to obtain fused feature data;

[0041] The processing module is used to build a threat rule base based on historical data through a genetic algorithm, obtain normal behavior and known threat patterns, set the first reference point as the feature mean vector of the normal behavior pattern, and the second reference point as the feature mean vector of the known threat pattern; for each fused feature data, calculate the distance difference with the two reference points, and optimize the nonlinear transformation of the distance difference through the L-BFGS algorithm to generate new features; according to the threat rule base, the new features are matched and analyzed through KNN, and the matching results are obtained by identifying the threat data.

[0042] According to a third aspect, a computing device includes:

[0043] one or more processors;

[0044] The storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0045] In a fourth aspect, a computer-readable storage medium stores a program, which implements the method when executed by a processor.

[0046] The above solution of the present invention includes at least the following beneficial effects:

[0047] Improve detection accuracy. Through multi-source data fusion and feature extraction, the real state of network activities can be more comprehensively reflected, thereby improving detection accuracy. Optimize distance difference calculation and nonlinear transformation, enhance the distinguishing ability of new features, and help identify threats more accurately. Use genetic algorithms to build a flexible threat rule base that can adapt to changes in different network environments and attack methods. KNN matching analysis is fast and suitable for real-time threat detection. Through precise feature extraction and matching analysis, false positives and missed positives can be reduced, and reliability can be improved. The construction of the threat rule base is based on historical data and genetic algorithm optimization, which helps to more accurately identify normal and threatening behaviors. By combining multi-source data fusion, genetic algorithms, KNN matching analysis and other technical means, this method has strong adaptability, high efficiency and low false alarm rate for network transmission and process activity threat detection, providing strong support for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The present invention provides a flowchart of a method for detecting threats to network transmission and process activities.

[0049] Figure 2 This is a schematic diagram of a threat detection system for network transmission and process activities provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0051] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting threats to network transmission and process activities, the method comprising the following steps:

[0052] Step 11: Collect network transmission and process activity data, pre-process the data, and obtain network transmission and process activity data;

[0053] Step 12: Extract traffic characteristics and physical characteristics based on the data of network transmission and process activities;

[0054] Step 13: Fusing the extracted traffic features and physical features to obtain fused feature data;

[0055] Step 14: Based on historical data, a threat rule base is constructed using a genetic algorithm to obtain normal behavior and known threat patterns. The first reference point is set as the feature mean vector of the normal behavior pattern, and the second reference point is set as the feature mean vector of the known threat pattern.

[0056] Step 15: For each fused feature data, calculate the distance difference between the two reference points, and optimize the nonlinear transformation of the distance difference using the L-BFGS algorithm to generate a new feature;

[0057] In step 16, the new features are matched and analyzed through KNN according to the threat rule base, and the matching results are obtained by identifying the threat data to achieve threat detection of network transmission and process activities.

[0058] In embodiments of the present invention, by collecting network transmission and process activity data, comprehensive coverage of various behaviors in the network environment is achieved. Extracting traffic and physical features can capture key information about network transmission and process activity, helping to more accurately identify abnormal behavior. These features can reflect the essential characteristics of network activity. Fusion of traffic and physical features comprehensively considers multiple aspects of network transmission and process activity, improving the comprehensiveness of threat detection. The fused feature data can enhance the ability to identify abnormal behavior. A threat rule base constructed using a genetic algorithm can learn normal behavior and known threat patterns from historical data, improving the intelligence level of threat detection. The feature mean vectors of normal behavior patterns and known threat patterns are set as reference points. Calculating the distance difference between the fused feature data and the reference point can sensitively reflect differences between the data and help identify potential threats. Optimizing the nonlinear transformation of the distance difference using the L-BFGS algorithm can more accurately reflect complex relationships between the data, improving the accuracy of threat detection. The KNN algorithm is simple, effective, and easy to implement, making it suitable for real-time or near-real-time threat detection scenarios. KNN matching analysis of new features can accurately identify threat data and obtain matching results, enabling threat detection of network transmission and process activity.

[0059] In a preferred embodiment of the present invention, the above step 11 may include:

[0060] Step 111, collecting raw data of network transmission and process activities;

[0061] Step 112 , by cleaning the collected raw data to remove noise, outliers and erroneous data, obtain pre-processed network transmission and process activity data.

[0062] In the embodiments of the present invention, the data cleaning process significantly improves data quality. Raw data often contains a large amount of noise, outliers, and erroneous data, which can interfere with subsequent analysis and processing. By removing useless data through cleaning, the data dimension and computational complexity can be reduced, thereby increasing processing speed and enabling the system to respond to security incidents more quickly. By improving data quality, increasing processing efficiency, and facilitating data integration and expansion, it provides strong support for threat detection in network transmission and process activities.

[0063] In a specific embodiment of the present invention, the specific steps include:

[0064] Step 111, obtain process activity data through the collected network transmission data, such as network traffic, packet information, connection logs, etc., and deploy data collection agents at the network boundary and key servers to ensure the comprehensiveness and real-time nature of the data.

[0065] Step 112 cleans the collected raw data, corrects, deletes, or marks detected outliers to avoid interference with subsequent analysis, checks the integrity, consistency, and rationality of the data, such as IP address format, timestamp sequence, etc., and converts the data into a unified format and unit.

[0066] In a preferred embodiment of the present invention, the above step 12 may include:

[0067] Step 121 , extracting traffic features from network transmission and physical features from process activities based on the pre-processed data;

[0068] Step 122 : extracting flow characteristics and physical characteristics, performing dimensionality reduction processing, and obtaining optimized flow characteristics and physical characteristics.

[0069] In an embodiment of the present invention, by extracting traffic features in network transmission, such as packet size, transmission frequency, IP address, port number, etc., the patterns and regularities of network behavior are characterized, and physical features, such as CPU usage, memory usage, process status, file access records, etc., are extracted from process activities to reflect the running status and potential risks of the process. Dimensionality reduction processing can remove redundant information in the features, reduce the dimension and computational complexity of the data, and the optimized features reflect the essential characteristics of network behavior and process status. Dimensionality reduction processing can retain key information in the features while enhancing the ability to distinguish between features. The feature data after dimensionality reduction is smaller in scale and has a faster processing speed.

[0070] In a specific embodiment of the present invention, the specific steps include:

[0071] Step 121 monitors the CPU usage, memory usage, disk usage, and other system resource usage of each process. It records state changes such as process creation, execution, and termination, as well as inter-process communication. It analyzes file access by each process, including read, write, and delete operations, as well as information such as the path, size, and type of the accessed files. Based on process activity data, it detects abnormal behavior, such as malware execution and unauthorized access, and extracts key features from network transmission and process activity.

[0072] Step 122 removes highly correlated redundant features, selects features that contribute more to threat detection, projects the original features into a low-dimensional space through linear transformation, retains the main information while reducing the feature dimension, and standardizes or normalizes the reduced-dimensional features so that different features have the same scale, thereby enhancing the feature distinguishing ability.

[0073] In a preferred embodiment of the present invention, the above step 13 may include:

[0074] Step 131, performing feature selection based on the extracted flow characteristics and physical characteristics to obtain selected feature data;

[0075] In step 132, weighted fusion is performed on the selected feature data, and the flow features and physical features are directly concatenated into a long vector to generate fused feature data.

[0076] In the embodiments of the present invention, feature selection improves the overall quality of the data by removing redundant, irrelevant, or noisy features, reduces data dimensionality, reduces storage and computing requirements, and improves data processing efficiency, with significant effects when processing large-scale data sets or real-time data. The selected key features reflect the essential characteristics and patterns of the data, and the streamlined feature set is easier to understand and interpret, lowering the threshold for data analysis. Traffic features and physical features are fused into a long vector, and weighted fusion allows for flexible adjustment based on the importance of different features, so that the fused feature data meets actual analysis needs and improves information utilization.

[0077] In a specific embodiment of the present invention, the specific steps include:

[0078] Step 131 : Based on the extracted traffic features and physical features, and according to the results of feature evaluation and redundancy check, features that contribute more to the target variable and have lower redundancy are selected, and the selected features are combined into a new feature set.

[0079] Step 132, the selected feature data is obtained by , and obtain the result of the standardized processing, where is the normalized value, is the original data point, is the mean of the data set, It is the standard deviation of the dataset, which makes different features have the same scale. Based on the feature importance evaluation results, a weight is assigned to each feature. The weight can be determined based on the feature importance score, correlation coefficient, or other business logic. The weighted traffic features and physical features are directly concatenated into a long vector, which is used as the fused feature data.

[0080] In a preferred embodiment of the present invention, the above step 14 may include:

[0081] Step 141 , generating an initial population using a genetic algorithm based on historical network traffic and process activity data, where each individual represents a potential threat rule;

[0082] Step 142: Perform crossover and mutation operations on the selected individuals to generate new individuals. The crossover operation generates a new individual by exchanging some genes of two individuals, and the mutation operation introduces diversity by randomly changing some genes of the individuals. Repeat the evaluation and optimization process until the maximum number of iterations is reached.

[0083] Step 143, organizing the optimized individuals into a threat rule library;

[0084] Step 144: According to the normal behavior pattern and the known threat pattern in the threat rule library, the feature mean vector of the normal behavior pattern is set as the first reference point. , the feature mean vector of the known threat pattern is set as the second reference point ;

[0085] Step 145, according to the normal behavior mode, by , get the characteristic mean vector of the normal behavior mode ,in, Indicates the i The first sample j eigenvalues, is the number of samples of normal behavior pattern, M is the number of features per sample, i is the index of the sample, j Is the index of the feature, according to the threat pattern, through , get the feature mean vector of the threat pattern ,in, Indicates the i The first sample j eigenvalues, is the number of samples of known threat patterns, M is the number of features per sample, i is the index of the sample, j is the index of the feature.

[0086] In an embodiment of the present invention, the crossover operation generates a new individual by exchanging some genes of two individuals, exploring new areas in the solution space. The mutation operation introduces diversity by randomly changing certain genes of the individual to prevent the population from falling into a local optimal solution. The optimized individuals are organized into a threat rule library, making the rules more structured and easier to manage and use. The feature mean vectors of normal behavior patterns and known threat patterns are set as benchmarks, providing a reference standard for subsequent anomaly detection. By comparing the difference between the feature vectors of new data and the benchmarks, data points that deviate from normal behavior patterns or are close to threat patterns can be discovered in a timely manner, thereby triggering the anomaly detection mechanism and improving the efficiency of anomaly detection.

[0087] In a specific embodiment of the present invention, the specific steps include:

[0088] In step 141, by collecting historical network traffic data and process activity data, the structure of the threat rule is defined, and a certain number of individuals are randomly generated to form an initial population. The genes of each individual (i.e., the specific parameters of the threat rule) can be set randomly or based on statistical information in historical data.

[0089] In step 142, based on individual fitness (e.g., number of detected threats, false alarm rate, etc.), select the best performing individuals. Two individuals are selected and some of their genes (i.e., some parameters of the threat rule) are exchanged to generate new individuals. These new individuals inherit some of the characteristics of their parents. Some genes of the individuals are randomly selected and mutated, i.e., their values ​​are changed. Mutation helps introduce diversity and prevents the population from falling into a local optimum. The newly generated individuals are evaluated, and the selection, crossover, mutation, and evaluation process is repeated until the maximum number of iterations is reached or other stopping conditions are met.

[0090] In step 143, the individuals with the highest fitness are selected from the optimized population. The threat rules represented by these individuals have high accuracy and effectiveness. The selected individuals are decoded into threat rules, and these rules are organized into a threat rule library.

[0091] Step 144: extract normal behavior patterns and known threat patterns from the threat rule library. The normal behavior pattern represents the characteristics of normal activities in the network, and the known threat pattern represents the characteristics of known malicious activities. Calculate the feature mean vector of the normal behavior pattern as the first reference point, and calculate the feature mean vector of the known threat pattern as the second reference point.

[0092] Step 145: For each sample in the normal behavior pattern, extract its eigenvalue. According to the normal behavior pattern, calculate the characteristic mean vector of the normal behavior pattern by the above formula. For the threat pattern, calculate the characteristic mean vector of the threat pattern by the above formula.

[0093] In a preferred embodiment of the present invention, the above step 15 may include:

[0094] Step 151, according to each fusion feature data, , calculate the Euclidean distance of the first reference point, where is the fused feature data vector x No. j eigenvalues, Is the first reference point No. j eigenvalues, j is the index of the feature, through , calculate the Euclidean distance of the second reference point, where Is the first reference point No. j eigenvalues, j is the index of the feature, through , get the distance difference between the two reference points;

[0095] Step 152: construct a nonlinear transformation function of the distance difference based on the distance difference between the two reference points. ,in, is the parameter to be optimized;

[0096] Step 153, through the objective function , and obtain the optimized nonlinear transformation function, where is the sample size, is the sample number, It is The distance difference of samples, It is Classification labels of samples 1 means threat, 0 means normal;

[0097] Step 154, through the optimized nonlinear transformation function For each distance difference Perform the transformation to obtain the new eigenvalues.

[0098] In the embodiment of the present invention, the difference between the fused feature data and the first reference point and the second reference point can be quantified by calculating the Euclidean distance. It reflects the relative position of the data point relative to the two reference points, which helps in subsequent classification and recognition. The nonlinear transformation function can capture the complex relationship between the distance difference and the classification label, thus improving the accuracy of classification. , which can make the transformation function better adapt to the data distribution. By optimizing the objective function, the nonlinear transformation function can better fit the data and improve the accuracy of classification. The optimization algorithm can automatically adjust the parameters. The new eigenvalues ​​after transformation can better represent the relative relationship between the data point and the two reference points, thereby enhancing the feature representation ability of the data.

[0099] In a specific embodiment of the present invention, the specific steps include:

[0100] Step 151: Based on each fusion feature data The Euclidean distance of the first reference point is calculated by the above formula, and the Euclidean distance of the second reference point is calculated by the above formula. , get the distance difference between the two reference points, where is the Euclidean distance to the first reference point, is the Euclidean distance to the second reference point.

[0101] Step 152: construct a nonlinear transformation function of the distance difference according to the distance difference between the two reference points.

[0102] Step 153: Calculate using the above formula to obtain an optimized nonlinear transformation function.

[0103] Step 154: for each sample, the distance difference , using the optimized nonlinear transformation function Perform the transformation to obtain the new eigenvalues.

[0104] In a preferred embodiment of the present invention, the above step 16 may include:

[0105] Step 161 , using the threat rule base and the new feature data, calculate the distance between the new feature and each feature vector in the threat rule base using the Euclidean distance;

[0106] Step 162: Based on the distance of each eigenvector, statistical results of the threat type are obtained using the distance matrix and the K value, where the K value represents the number of nearest neighbors to be considered in the KNN algorithm.

[0107] Step 163: Checking whether the threat type statistics result contains the number of threat types, based on the threat type statistics result, to obtain a matching result;

[0108] Step 164: Implement threat detection for network transmission and process activities based on the matching results.

[0109] In the embodiment of the present invention, the similarity between the new feature and each feature vector in the threat rule base can be quantified by calculating the Euclidean distance. The distance information is used in the subsequent KNN classification algorithm to generate the threat type of the new feature. The KNN algorithm is based on the principle of locality, that is, similar samples are likely to belong to the same category. By selecting the nearest K neighbors, which can be classified more efficiently. K The value can be adjusted to suit different datasets and classification requirements. Through statistical and threshold judgment, a clear classification result can be obtained, namely whether the new feature belongs to a certain threat type. By considering the voting results of multiple nearest neighbors, the impact of individual outliers on the classification result can be reduced. Through threat detection, potential security threats can be discovered and addressed in a timely manner, enhancing the security of the network system.

[0110] In a specific embodiment of the present invention, the specific steps include:

[0111] In step 161 , the distance between the new feature and each feature vector in the threat rule base is obtained through the threat rule base and the new feature data according to step 151 .

[0112] Step 162, sort the distances in the distance matrix or list to get the smallest distance K The feature vectors and their corresponding threat types are used to initialize a counter to count the number of occurrences of each threat type. The counter stores the statistical results of each threat type.

[0113] Step 163: Set a threshold, for example, K / 2, indicating that more than half of the nearest neighbors belong to a certain threat type. Traverse the statistical results to check whether the number of a certain threat type exceeds the set threshold. If the number of a certain threat type exceeds the threshold, the new feature matches the threat type. If the number of any threat type does not exceed the threshold, the new feature does not match any threat type or belongs to a normal type.

[0114] Step 164 , by collecting and integrating multi-source data, define threat detection indicators and rules; perform multi-source data correlation analysis based on the threat detection indicators and rules; and formulate and implement response strategies based on the analysis results to achieve threat detection of network transmission and process activities.

[0115] like Figure 2 As shown, an embodiment of the present invention further provides a network transmission and process activity threat detection system 20, comprising:

[0116] The acquisition module 21 is used to collect data on network transmission and process activities, pre-process the data, and obtain the data on network transmission and process activities;

[0117] The extraction module 22 is used to extract traffic features and physical features based on the data of network transmission and process activities; and fuse the extracted traffic features and physical features to obtain fused feature data;

[0118] Processing module 23 is used to construct a threat rule library based on historical data using a genetic algorithm, obtain normal behavior and known threat patterns, set the first reference point as the feature mean vector of the normal behavior pattern, and set the second reference point as the feature mean vector of the known threat pattern; for each fused feature data, calculate the distance difference from the two reference points, and optimize the nonlinear transformation of the distance difference using the L-BFGS algorithm to generate a new feature; according to the threat rule library, the new feature is matched and analyzed using KNN, and the matching result is obtained by identifying the threat data.

[0119] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for detecting threats to network transmission and process activities, characterized in that: The method comprises: Collect network transmission and process activity data, pre-process the data, and obtain network transmission and process activity data; Extract traffic characteristics and physical characteristics based on network transmission and process activity data; The extracted traffic features and physical features are fused to obtain fused feature data; Based on historical data, a threat rule library is constructed using a genetic algorithm to obtain normal behavior patterns and known threat patterns. The first reference point is set as the feature mean vector of the normal behavior pattern, and the second reference point is set as the feature mean vector of the known threat pattern. For each fused feature data, the distance difference between the two reference points is calculated, and the nonlinear transformation of the distance difference is optimized by the L-BFGS algorithm to generate new features, including: According to each fusion feature data, the Euclidean distance of the first reference point is calculated, and the Euclidean distance of the second reference point is calculated. , get the distance difference between the two reference points, where is the Euclidean distance to the first reference point, is the Euclidean distance to the second reference point; According to the distance difference between two reference points, a nonlinear transformation function of the distance difference is constructed; By optimizing the objective function, an optimized nonlinear transformation function is obtained; Each distance difference is converted into Perform the transformation to obtain the new eigenvalue; Based on the threat rule base, new features are matched and analyzed using KNN. By identifying threat data, matching results are obtained to achieve threat detection for network transmission and process activities, including: Through the threat rule base and the new feature data, the Euclidean distance is used to calculate the distance between the new feature and each feature vector in the threat rule base; Based on the distance of each eigenvector, the statistical results of the threat type are obtained through the distance matrix and the K value. The K value represents the number of nearest neighbors that need to be considered in the KNN algorithm. According to the statistical results of the threat type, check whether the number of threat types is included in the statistical results of the threat type to obtain a matching result; Based on the matching results, threat detection of network transmission and process activities can be achieved.

2. The method for detecting threats to network transmission and process activities according to claim 1, characterized in that: Collect network transmission and process activity data, pre-process the data, and obtain network transmission and process activity data, including: Collect raw data on network transmission and process activities; By cleaning the collected raw data, removing noise, outliers and erroneous data, we obtain the preprocessed network transmission and process activity data.

3. The method for detecting threats to network transmission and process activities according to claim 2, wherein: Extract traffic and physical characteristics based on network transmission and process activity data, including: Based on the pre-processed data, traffic features are extracted from network transmission and physical features are extracted from process activities; By extracting flow characteristics and physical characteristics and performing dimensionality reduction processing, optimized flow characteristics and physical characteristics are obtained.

4. The method for detecting threats to network transmission and process activities according to claim 3, wherein: The extracted traffic features and physical features are fused to obtain fused feature data, including: Perform feature selection based on the extracted flow characteristics and physical characteristics to obtain selected feature data; The selected feature data is weightedly fused, and the traffic features and physical features are directly concatenated into a long vector to generate fused feature data.

5. The method for detecting threats to network transmission and process activities according to claim 4, characterized in that: Based on historical data, a threat rule library is constructed using a genetic algorithm to obtain normal behavior patterns and known threat patterns. The first reference point is set as the feature mean vector of the normal behavior pattern, and the second reference point is set as the feature mean vector of the known threat pattern, including: Based on historical network traffic and process activity data, an initial population is generated through a genetic algorithm, where each individual represents a potential threat rule; Perform crossover and mutation operations on the selected individuals to generate new individuals. The crossover operation generates new individuals by exchanging some genes of two individuals, while the mutation operation introduces diversity by randomly changing some genes of the individuals. Repeat the evaluation and optimization process to reach the maximum number of iterations. Organize the optimized individuals into a threat rule library; According to the normal behavior pattern and known threat pattern in the threat rule library, the feature mean vector of the normal behavior pattern is set as the first reference point , the feature mean vector of the known threat pattern is set as the second reference point ; According to each feature in the normal behavior pattern, the average value of all samples on this feature is calculated to obtain the feature mean vector of the normal behavior pattern. , according to each feature in the known threat pattern, calculate the average value of all samples on this feature, and obtain the feature mean vector of the known threat pattern .

6. A threat detection system for network transmission and process activities, the system implementing the method according to any one of claims 1 to 5, characterized in that: include: The acquisition module is used to collect data on network transmission and process activities, pre-process the data, and obtain the data on network transmission and process activities; The extraction module is used to extract traffic characteristics and physical characteristics based on the data of network transmission and process activities; The extracted traffic features and physical features are fused to obtain fused feature data; The processing module is used to build a threat rule base based on historical data through a genetic algorithm, obtain normal behavior patterns and known threat patterns, set the first reference point as the feature mean vector of the normal behavior pattern, and set the second reference point as the feature mean vector of the known threat pattern; for each fused feature data, calculate the distance difference with the two reference points, and optimize the nonlinear transformation of the distance difference through the L-BFGS algorithm to generate new features; according to the threat rule base, the new features are matched and analyzed through KNN, and the matching results are obtained by identifying the threat data.

Images