Network system intrusion detection method, device, equipment and medium

Abstract

The network system intrusion detection method, device, equipment, and medium provided by the present invention include: preprocessing raw data to obtain preprocessed data; processing the preprocessed data using a cyclic density clustering algorithm with a dynamic ε value to obtain a clustering result consisting of cluster sets of different densities; obtaining character strings of different levels; obtaining masking rules for cluster sets; using a hash tree to store the masking rules of all cluster sets; extracting the masking rules of the same layer of the hash tree to obtain multiple detection groups; segmenting the character strings of the access rules to be detected with / to obtain character strings of different levels as detection strings; matching the detection groups with the detection strings layer by layer according to the hash tree structure, and determining whether the access rules to be detected pass the detection. The present invention can effectively solve the problems of high rule redundancy and uncontrollable matching space in the whitelist mechanism, effectively limiting the probability of undetected illegal access.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network system intrusion detection method, device, equipment and medium. Background Art

[0002] As network attacks become increasingly sophisticated, intrusion detection systems (IDS) have become a crucial tool for ensuring system security. The core goal of intrusion detection is to monitor system behavior in real time, identify potential malicious activity, and implement timely defensive measures. In large-scale network service environments, due to the sheer scale of services and extremely high traffic volumes, traditional signature-based detection or behavioral analysis methods often suffer from high computational resource consumption and high response latency, making them inadequate for practical needs. Therefore, ensuring detection accuracy while reducing system overhead and improving detection efficiency remains a key challenge for intrusion detection technology.

[0003] Whitelisting is a highly effective intrusion detection strategy. Its core concept is to predefine legitimate system behaviors (such as process execution and file access) and block all abnormal operations that do not comply with these rules. Compared to blacklisting, which only blocks known malicious behaviors, whitelisting can effectively defend against unknown attacks and is particularly suitable for scenarios with high security requirements.

[0004] However, the commonly used whitelist matching method in the industry still suffers from drawbacks such as a large matching space and a high risk of missed detections. Therefore, a low-cost solution is urgently needed that can significantly reduce the number of rules and improve matching efficiency while maintaining detection accuracy. Summary of the Invention

[0005] In view of the defects in the prior art, the present invention provides a network system intrusion detection method, device, equipment and medium.

[0006] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0007] In one aspect, the present invention provides a network system intrusion detection method, comprising the following steps:

[0008] S1. Extracting original data, where the original data consists of whitelist access rules, and preprocessing the original data to obtain preprocessed data;

[0009] S2, using a cyclic density clustering algorithm with a dynamic ε value to process the preprocessed data and obtain a clustering result consisting of cluster sets with different densities;

[0010] S3. Split the strings of the whitelist access rules in the cluster set into program path strings and file path strings according to the tab character, and separate the program path strings and the file path strings with / to obtain strings of different levels;

[0011] S4. In the string at each level, identify all sequential common substrings and retain them in order, replace the positions of non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set;

[0012] S5. Use a hash tree to store the masking rules of all cluster sets, where each layer of the hash tree corresponds to a level of the masking rules;

[0013] S6. Extracting mask rules at the same level of the hash tree, splitting the mask rules by wildcards to obtain multiple detection groups, each consisting of a pair of wildcards and non-wildcards; splitting the string of the access rule to be detected by / to obtain strings at different levels as detection strings;

[0014] S7. Match the detection groups and detection strings layer by layer according to the hash tree structure. When all detection groups and detection strings in the same layer are matched, the current layer is considered to be matched successfully. When all layers are matched successfully, the access rule to be tested is considered to have passed the test. Otherwise, the access rule to be tested is considered to be an illegal access rule.

[0015] Furthermore, the original data is preprocessed to obtain preprocessed data, including:

[0016] S11. For whitelist access rules with exactly the same content in the original data, only one copy is retained, thereby deduplicating the original data;

[0017] S12. Unify the path format of the whitelist access rules in the deduplicated data to obtain preprocessed data.

[0018] Furthermore, the cyclic density clustering algorithm with dynamic ε value is used to process the preprocessed data to obtain clustering results consisting of cluster sets with different densities, including:

[0019] S21. Determine an initial ε value based on the distance between whitelist access rules in the preprocessed data;

[0020] S22. Using the current ε value to perform density clustering on the preprocessed data, and obtaining a cluster set and a discrete outlier set that meet the requirements;

[0021] S23. Increase the ε value by a preset step value, and return to S22 until no discrete outlier set exists, and a clustering result consisting of cluster sets of different densities is obtained.

[0022] Furthermore, a hash tree is used to store the mask rules of all cluster sets, including:

[0023] S51. Each layer of the hash tree corresponds to a level of the mask rule, each node stores the string of that level, and the string of the next level is used as the child node of the current node;

[0024] S52. Use tabs as special level nodes;

[0025] S53. Connect the parent node and the child node through the key-value pair to complete the storage.

[0026] Furthermore, in each level of the string, all sequential common substrings are identified and retained in order, wildcards are used to replace the positions of non-common substrings in the string, and the wildcard replacement results of all levels are merged to obtain the mask rules of the cluster set, which also includes:

[0027] For the non-common substring at the end of the string, retain the last character of the longest substring and replace the rest with wildcard characters;

[0028] For strings that cannot be replaced by wildcards, the original strings are hard-coded to retain them.

[0029] Furthermore, the detection groups and detection strings are matched layer by layer according to the hash tree structure, including:

[0030] The detection group prioritizes matching non-wildcard content in the detection string. If non-wildcard content exists at the corresponding position in the detection string, the current detection group is considered to have matched the detection string, and the next detection group is matched with the detection string until all detection groups are matched with the detection string.

[0031] Furthermore, matching the detection groups and the detection strings layer by layer according to the hash tree structure further includes:

[0032] For the last detection group, if the length of the detection string is less than the wildcard length, it is determined to be a match. If the length of the detection string is greater than the wildcard length, the sliding matching method is used for matching.

[0033] In another aspect, the present invention provides a network system intrusion detection device, comprising:

[0034] The first module is used to extract original data, the original data consisting of whitelist access rules, and preprocess the original data to obtain preprocessed data;

[0035] The second module is used to process the preprocessed data using a cyclic density clustering algorithm with a dynamic ε value to obtain a clustering result consisting of cluster sets with different densities;

[0036] The third module is used to split the string of the whitelist access rule in the cluster set into a program path string and a file path string according to the tab character, and split the program path string and the file path string with / to obtain strings of different levels;

[0037] The fourth module is used to identify all common substrings in each level of the string and retain them in order, replace the non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set;

[0038] The fifth module is used to store the masking rules of all cluster sets using a hash tree, where each layer of the hash tree corresponds to a level of the masking rules;

[0039] The sixth module is used to extract the mask rules of the same layer of the hash tree, split the mask rules by wildcards to obtain multiple detection groups, each of which consists of a pair of wildcards and non-wildcards; split the string of the access rule to be detected by / to obtain strings of different levels as detection strings;

[0040] The seventh module is used to match the detection group and the detection string layer by layer according to the hash tree structure. When all the detection groups and the detection string in the same layer are matched, the current layer is judged to be matched successfully; when all layers are matched successfully, the access rule to be detected is judged to have passed the detection; otherwise, the access rule to be detected is considered to be an illegal access rule.

[0041] On the other hand, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the network system intrusion detection method when executing the computer program.

[0042] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the network system intrusion detection method when the computer program is executed by a processor.

[0043] Compared with the prior art, the beneficial technical effects of the present invention are:

[0044] The network system intrusion detection method, device, equipment and medium provided by the present invention process the pre-processed data with a cyclic density clustering algorithm of dynamic ε value to obtain a clustering result composed of cluster sets of different densities, which overcomes the defects of the fixed ε value density clustering algorithm, while ensuring the high similarity within the clustering result, eliminating the abnormal values that cannot be clustered, and can better adapt to the actual distribution characteristics of the whitelist rule data; by splitting the character string of the whitelist access rule in the cluster set, obtaining the path character string and then splitting it to achieve hierarchical division, thereby realizing hierarchical processing of a class of whitelist access rules represented by the cluster set, so that only characters within the same level are processed. The comparison and analysis of strings avoids the complexity and errors caused by cross-level comparison; on the basis of hierarchical division, wildcards are replaced for non-public substrings in the string to obtain the mask rules of the cluster set, thereby further compressing the representation space of the same type of whitelist access rules while ensuring the accuracy of the rules, and improving the simplicity and generalization ability of the whitelist rules; hash tree storage is then used to realize efficient and structured storage of the mask rules of all cluster sets; the mask rules and the access rules to be detected are then processed to obtain the detection group and detection string; finally, the detection group and the detection string are matched layer by layer according to the hash tree structure to complete the judgment of the string to be detected and determine whether the network system has been invaded.

[0045] The present invention can effectively solve the problems of high rule redundancy and uncontrollable matching space in the whitelist mechanism, effectively limiting the probability of missed detection of illegal access; it can be widely used in scenarios such as enterprise security protection, cloud computing platforms, and Internet of Things devices, providing efficient and accurate intrusion detection for system security. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0047] Figure 1 A schematic diagram of a flow chart of a network system intrusion detection method provided by an embodiment;

[0048] Figure 2 A schematic diagram of a flow chart of a cyclic density clustering algorithm for dynamic ε values provided in one embodiment;

[0049] Figure 3 A diagram of a character string acquisition process at different levels provided by an embodiment, wherein: Figure 3 (a) is a diagram showing the process of splitting the string of whitelist access rules according to tab characters. Figure 3(b) is a diagram showing the process of splitting the path string with / ;

[0050] Figure 4 A schematic diagram of a wildcard replacement process provided by an embodiment;

[0051] Figure 5 A schematic diagram of a sequential common substring provided by an embodiment;

[0052] Figure 6 A schematic diagram of a process for merging wildcard replacement results at all levels provided by an embodiment;

[0053] Figure 7 A schematic diagram of a hash tree storing mask rules of a cluster set provided by an embodiment;

[0054] Figure 8 A diagram of detection group and detection string generation provided in one embodiment;

[0055] Figure 9 A schematic diagram of a detection group and detection string matching process provided in one embodiment;

[0056] Figure 10 A schematic diagram of a sliding alignment process provided by one embodiment. DETAILED DESCRIPTION

[0057] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0058] Reference Figure 1 , an embodiment provides a network system intrusion detection method, comprising the following steps:

[0059] S1. Extracting original data, where the original data consists of whitelist access rules, and preprocessing the original data to obtain preprocessed data;

[0060] S2, using a cyclic density clustering algorithm with a dynamic ε value to process the preprocessed data and obtain a clustering result consisting of cluster sets with different densities;

[0061] S3. Split the strings of the whitelist access rules in the cluster set into program path strings and file path strings according to the tab character, and separate the program path strings and the file path strings with / to obtain strings of different levels;

[0062] S4. In the string at each level, identify all sequential common substrings and retain them in order, replace the positions of non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set;

[0063] S5. Use a hash tree to store the masking rules of all cluster sets, where each layer of the hash tree corresponds to a level of the masking rules;

[0064] S6. Extracting mask rules at the same level of the hash tree, splitting the mask rules by wildcards to obtain multiple detection groups, each consisting of a pair of wildcards and non-wildcards; splitting the string of the access rule to be detected by / to obtain strings at different levels as detection strings;

[0065] S7. Match the detection groups and detection strings layer by layer according to the hash tree structure. When all detection groups and detection strings in the same layer are matched, the current layer is considered to be matched successfully. When all layers are matched successfully, the access rule to be tested is considered to have passed the test. Otherwise, the access rule to be tested is considered to be an illegal access rule.

[0066] The pre-processed data is processed with a cyclic density clustering algorithm with a dynamic ε value to obtain a clustering result consisting of cluster sets with different densities, which overcomes the defects of the fixed ε value density clustering algorithm. While ensuring high similarity within the clustering results, it eliminates abnormal values that cannot be clustered, and can better adapt to the actual distribution characteristics of whitelist rule data; by splitting the strings of whitelist access rules in the cluster set, obtaining the path strings and then splitting them to achieve hierarchical division, thereby achieving hierarchical processing of a class of whitelist access rules represented by the cluster set, so that the comparison and analysis of strings are only performed within the same layer, avoiding cross-layer The complexity and error caused by hierarchical comparison; on the basis of hierarchical division, wildcard replacement is performed on non-public substrings in the string to obtain the mask rules of the cluster set, so as to further compress the representation space of the same type of whitelist access rules on the basis of ensuring the accuracy of the rules, and improve the simplicity and generalization ability of the whitelist rules; then the hash tree storage is used to realize the efficient and structured storage of the mask rules of all cluster sets; then the mask rules and the access rules to be detected are processed to obtain the detection group and the detection string; finally, the detection group and the detection string are matched layer by layer according to the hash tree structure to complete the judgment of the string to be detected and determine whether the network system has been invaded.

[0067] In a preferred embodiment, preprocessing the original data to obtain preprocessed data includes:

[0068] S11. For whitelist access rules with exactly the same content in the original data, only one copy is retained, thereby deduplicating the original data;

[0069] S12. Unify the path format of the whitelist access rules in the deduplicated data to obtain preprocessed data.

[0070] By deduplicating the original data, the storage space occupied by duplicate data is significantly reduced, saving storage resources. Furthermore, deduplication can simplify the computational complexity and runtime of subsequent clustering algorithms, making detection more efficient. The path format of whitelist access rules in the data is unified, ensuring consistency across the paths, ensuring the correctness and effectiveness of subsequent calculations.

[0071] In one embodiment, the deduplicated data contains access rules for absolute path and relative path records. The access rules for relative path records in the deduplicated data are converted into access rules for absolute path records by supplementing the access rules for relative path records in the deduplicated data with " / " or other prefixes.

[0072] Reference Figure 2 In a preferred embodiment, a cyclic density clustering algorithm with a dynamic ε value is used to process the preprocessed data to obtain a clustering result consisting of cluster sets of different densities, including:

[0073] S21. Determine an initial ε value based on the distance between whitelist access rules in the preprocessed data;

[0074] S22. Using the current ε value to perform density clustering on the preprocessed data, and obtaining a cluster set and a discrete outlier set that meet the requirements;

[0075] S23. Increase the ε value by a preset step value, and return to S22 until no discrete outlier set exists, and a clustering result consisting of cluster sets of different densities is obtained.

[0076] The initial ε value is determined by the distance between the whitelist access rules in the preprocessed data, so as to obtain a more appropriate ε value for density clustering of the preprocessed data, which can effectively balance the similarity of the clusters and the number of discrete outliers; and then the preset step value is used to Increase the ε value and continue density clustering. Through multiple cycles of clustering, until there is no discrete outlier set, all data are divided into one cluster set, which can better adapt to the actual distribution characteristics of the whitelist rule data and ensure the accuracy of subsequent mask rule generation.

[0077] Reference Figure 3 In one embodiment, a diagram of a character string acquisition process at different levels is provided, wherein: Figure 3 (a) is a diagram of the process of splitting the string of whitelist access rules according to the tab character, as shown in Figure 3As shown in (a), / usr / bin / id is the program path string, and / lib64 / libselinux.so.1 and others are file path strings; Figure 3 (b) is a diagram of the process of splitting the path string with / , as shown in Figure 3 As shown in (b), / lib64 / libselinux.so.1 is split into two levels: "lib64" and "libselinux.so.1." Limiting the scope of string comparison and analysis not only effectively improves computational efficiency but also ensures that the generated mask rules are more accurate and reasonable in structure.

[0078] Reference Figure 4 、 Figure 5 、 Figure 6 , an embodiment provides a specific process of masking rules of cluster sets, such as Figure 4 As shown, use As a wildcard, and specify each Match at most one character; in each level of the string, identify all common substrings in sequence and retain them in order, and use wildcards to replace the positions of non-common substrings in the string, so as to achieve the maximum compression of the string at that level. Figure 6 As shown, the wildcard replacement results of all levels are merged to obtain a unified mask representation of this type of whitelist access rules, that is, the mask rules of the cluster set are obtained.

[0079] The order of common substrings is as follows Figure 5 As shown, in order to ensure the accuracy of the masking rule, only the longest common substrings that appear in sequence are retained, such as Figure 5 As shown in the figure, for libselinux.so.1 and .so.clib6, the sequential common substring is .so., not lib and .so.; for non-sequential common substrings, longer substrings are limitedly retained while ensuring the order.

[0080] In a preferred embodiment, in each level of the string, all sequential common substrings are identified and retained in order, wildcards are used to replace the positions of non-common substrings in the string, and the wildcard replacement results of all levels are merged to obtain the masking rules of the cluster set, which also includes:

[0081] For the non-common substring at the end of a string, the tail characters of the longest substring are retained, and the rest are replaced with wildcards; thus, more original information is retained as much as possible and character space is reduced.

[0082] For strings that cannot be replaced with wildcards, hard-coding is used to retain the original strings, thereby improving the accuracy and simplicity of the rules.

[0083] Reference Figure 7 In a preferred embodiment, a hash tree is used to store mask rules for all cluster sets, including:

[0084] S51. Each layer of the hash tree corresponds to a level of the mask rule, each node stores the string of that level, and the string of the next level is used as the child node of the current node;

[0085] S52. Use tabs as special level nodes;

[0086] S53. Connect the parent node and the child node through the key-value pair to complete the storage.

[0087] A hash tree is used to store the mask rules of all cluster sets. Since the hash tree supports hierarchical access at the 0 (1) level, it can quickly locate the target rule and significantly shorten the matching time. Furthermore, hierarchical storage makes the rule organization more orderly, which is convenient for maintenance and expansion. On the other hand, rules with the same prefix can share nodes, thereby reducing redundant storage. At the same time, the hash tree supports dynamic insertion, deletion and modification of rules, which can adapt to the real-time update requirements of whitelist rules.

[0088] Reference Figure 8 In one embodiment, the mask rules of the same layer of the hash tree are extracted, and the mask rules are split according to wildcards to obtain multiple detection groups, each of which consists of a pair of wildcards and non-wildcards, and the length of the wildcards and non-wildcards can be 0; the character string of the access rule to be detected is split with / to obtain character strings of different levels as detection strings.

[0089] The mask rules are split into multiple detection groups to achieve efficient and segmented matching of the access rules to be detected, improving the flexibility and accuracy of detection.

[0090] In a preferred embodiment, the detection groups and detection strings are matched layer by layer according to the hash tree structure, including:

[0091] A detection group prioritizes matching non-wildcard characters in the detection string. If a non-wildcard character exists at the corresponding position in the detection string, the current detection group is considered to have successfully matched the detection string, and the next detection group is matched against the detection string, until all detection groups have been matched against the detection string. If the length of the subsequent string is 0, there is no content to match, and the match is considered successful.

[0092] Reference Figure 9 , the mask rule is , the string to be detected is libexif.so.1. In the first set of matches, the detection group is [, lib], that is, the first three characters of the string to be detected (i.e., the detection string) libexif.so.1 are searched for lib, and the result is found, so the match is passed. In the second set of matches, the detection group is , that is, search within the first 11 characters of the string to be detected exif.so.1 , the result exists, and the match is passed. In the third group of matches, the detection group is , that is, search for any character within the first character of the string to be detected 1. If the result exists, the match is passed. Through the above matching, the string to be detected successfully matches the given mask rule.

[0093] In a preferred embodiment, matching detection groups and detection strings layer by layer according to a hash tree structure further includes:

[0094] For the last test group, if the test string length is less than the wildcard length, the match is considered successful. If the test string length is greater than the wildcard length, a sliding match method is used. This sliding match method ensures that the match can still be completed accurately even if the end of the string changes.

[0095] Reference Figure 10 , the last detection group is , and the string to be detected is 012. At this time, 123 cannot be found in the first 6 characters of 012, and the length of 012 also exceeds the length represented by the wildcard. In this case, the algorithm allows the use of Replace the first few characters in the detection string to achieve alignment. Slide the detection string (012) from left to right. When the end of the detection string can be aligned with the front of the non-wildcard string (123) in the detection group, it is considered to meet the matching rules and the match is passed.

[0096] One embodiment provides a network system intrusion detection device, including:

[0097] The first module is used to extract original data, the original data consisting of whitelist access rules, and preprocess the original data to obtain preprocessed data;

[0098] The second module is used to process the preprocessed data using a cyclic density clustering algorithm with a dynamic ε value to obtain a clustering result consisting of cluster sets with different densities;

[0099] The third module is used to split the string of the whitelist access rule in the cluster set into a program path string and a file path string according to the tab character, and split the program path string and the file path string with / to obtain strings of different levels;

[0100] The fourth module is used to identify all common substrings in each level of the string and retain them in order, replace the non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set;

[0101] The fifth module is used to store the masking rules of all cluster sets using a hash tree, where each layer of the hash tree corresponds to a level of the masking rules;

[0102] The sixth module is used to extract the mask rules of the same layer of the hash tree, split the mask rules by wildcards to obtain multiple detection groups, each of which consists of a pair of wildcards and non-wildcards; split the string of the access rule to be detected by / to obtain strings of different levels as detection strings;

[0103] The seventh module is used to match the detection group and the detection string layer by layer according to the hash tree structure. When all the detection groups and the detection string in the same layer are matched, the current layer is judged to be matched successfully; when all layers are matched successfully, the access rule to be detected is judged to have passed the detection; otherwise, the access rule to be detected is considered to be an illegal access rule.

[0104] On the other hand, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the network system intrusion detection method provided in any of the above embodiments are implemented. The computer device may be a server. The computer device comprises a processor, a memory, a network interface, and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device comprises a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store sample data. The network interface of the computer device is used to communicate with an external terminal via a network connection.

[0105] On the other hand, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the network system intrusion detection method provided in any of the above embodiments are implemented.

[0106] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0107] Matters not covered by the present invention are known technologies.

[0108] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and such modifications and improvements are intended to fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

[0110] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that the present invention is susceptible to various modifications and variations. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A network system intrusion detection method, characterized in that: The following steps are involved: S1. Extracting original data, where the original data consists of whitelist access rules, and preprocessing the original data to obtain preprocessed data; S2, using a cyclic density clustering algorithm with a dynamic ε value to process the preprocessed data and obtain a clustering result consisting of cluster sets with different densities; S3. Split the strings of the whitelist access rules in the cluster set into program path strings and file path strings according to the tab character, and separate the program path strings and the file path strings with / to obtain strings of different levels; S4. In the string at each level, identify all sequential common substrings and retain them in order, replace the positions of non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set; S5. Use a hash tree to store the masking rules of all cluster sets, where each layer of the hash tree corresponds to a level of the masking rules; S6. Extracting mask rules at the same level of the hash tree, splitting the mask rules by wildcards to obtain multiple detection groups, each consisting of a pair of wildcards and non-wildcards; splitting the string of the access rule to be detected by / to obtain strings at different levels as detection strings; S7. Match the detection groups and detection strings layer by layer according to the hash tree structure. When all detection groups and detection strings in the same layer are matched, the current layer is considered to be matched successfully. When all layers are matched successfully, the access rule to be tested is considered to have passed the test. Otherwise, the access rule to be tested is considered to be an illegal access rule.

2. The network system intrusion detection method according to claim 1, wherein: Preprocess the original data to obtain preprocessed data, including: S11. For whitelist access rules with exactly the same content in the original data, only one copy is retained, thereby deduplicating the original data; S12. Unify the path format of the whitelist access rules in the deduplicated data to obtain preprocessed data.

3. The network system intrusion detection method according to claim 1, wherein: The preprocessed data is processed using a cyclic density clustering algorithm with a dynamic ε value, and clustering results consisting of cluster sets of different densities are obtained, including: S21. Determine an initial ε value based on the distance between whitelist access rules in the preprocessed data; S22. Using the current ε value to perform density clustering on the preprocessed data, and obtaining a cluster set and a discrete outlier set that meet the requirements; S23. Increase the ε value by a preset step value, and return to S22 until no discrete outlier set exists, and a clustering result consisting of cluster sets of different densities is obtained.

4. The network system intrusion detection method according to claim 1, wherein: A hash tree is used to store the mask rules of all cluster sets, including: S51. Each layer of the hash tree corresponds to a level of the mask rule, each node stores the string of that level, and the string of the next level is used as the child node of the current node; S52. Use tabs as special level nodes; S53. Connect the parent node and the child node through the key-value pair to complete the storage.

5. The network system intrusion detection method according to claim 1, wherein: In the strings at each level, all sequential common substrings are identified and retained in order. Wildcards are used to replace the positions of non-common substrings in the string. The wildcard replacement results of all levels are merged to obtain the mask rules of the cluster set, which also includes: For the non-common substring at the end of the string, retain the last character of the longest substring and replace the rest with wildcard characters; For strings that cannot be replaced by wildcards, the original strings are hard-coded to retain them.

6. The network system intrusion detection method according to claim 1, wherein: Match detection groups and detection strings layer by layer according to the hash tree structure, including: The detection group prioritizes matching non-wildcard content in the detection string. If non-wildcard content exists at the corresponding position in the detection string, the current detection group is considered to have matched the detection string, and the next detection group is matched with the detection string until all detection groups are matched with the detection string.

7. The network system intrusion detection method according to claim 6, wherein: Matching detection groups and detection strings layer by layer according to the hash tree structure also includes: For the last detection group, if the length of the detection string is less than the wildcard length, it is determined to be a match. If the length of the detection string is greater than the wildcard length, the sliding matching method is used for matching.

8. A network system intrusion detection device, characterized in that: include: The first module is used to extract original data, the original data consisting of whitelist access rules, and preprocess the original data to obtain preprocessed data; The second module is used to process the preprocessed data using a cyclic density clustering algorithm with a dynamic ε value to obtain a clustering result consisting of cluster sets with different densities; The third module is used to split the string of the whitelist access rule in the cluster set into a program path string and a file path string according to the tab character, and split the program path string and the file path string with / to obtain strings of different levels; The fourth module is used to identify all common substrings in each level of the string and retain them in order, replace the non-common substrings in the string with wildcards, and merge the wildcard replacement results of all levels to obtain the mask rules of the cluster set; The fifth module is used to store the masking rules of all cluster sets using a hash tree, where each layer of the hash tree corresponds to a level of the masking rules; The sixth module is used to extract the mask rules of the same layer of the hash tree, split the mask rules by wildcards to obtain multiple detection groups, each of which consists of a pair of wildcards and non-wildcards; split the string of the access rule to be detected by / to obtain strings of different levels as detection strings; The seventh module is used to match the detection group and the detection string layer by layer according to the hash tree structure. When all the detection groups and the detection string in the same layer are matched, the current layer is judged to be matched successfully; when all layers are matched successfully, the access rule to be detected is judged to have passed the detection; otherwise, the access rule to be detected is considered to be an illegal access rule.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network system intrusion detection method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the steps of the network system intrusion detection method according to any one of claims 1 to 7 are implemented.

Images