Network security intrusion detection method and system based on large model

Abstract

The present invention provides a network security intrusion detection method and system based on a large model, which relates to the field of network security technology. The method includes: monitoring and obtaining a number of access behavior data sequences within the current time period, using an access behavior benchmark comparison table to perform node difference comparison, and constructing a deviation node distribution sequence; performing node similarity comparison on a number of access behavior data sequences, and identifying nodes with the same frequency, and constructing a distribution sequence of nodes with the same frequency; combining the large model, predicting the distribution of potential attack nodes and the distribution of potential attack probabilities based on the deviation node distribution sequence and the distribution sequence of nodes with the same frequency, and formulating a node detection strategy for detection. The method aims to address the problems of low detection accuracy, delayed response, and easy missed reports in intrusion detection systems in complex network environments caused by the lack of effective recognition of collaborative behavior patterns between multiple access nodes by traditional detection methods; and can significantly improve the accuracy, real-time nature, and active defense capabilities of intrusion detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security intrusion detection method and system based on a large model. Background Art

[0002] With the development of information technology and the increasing complexity of enterprise network environments, network attack methods are constantly evolving, showing new characteristics such as strong concealment, frequent mutations and coordinated attacks.

[0003] Traditional intrusion detection methods mainly rely on feature matching, rule bases or simple statistical models. Although they are effective in detecting known attacks, they have limited ability to identify unknown attacks, zero-day attacks and variant attacks. In addition, as attack behaviors tend to be distributed and coordinated, multiple access nodes may exhibit highly similar abnormal behaviors in a short period of time, forming coordinated attack modes such as lateral movement and botnets. Existing detection methods often lack modeling and identification mechanisms for such coordinated behaviors, making it difficult to perceive potential threats in a timely manner. Summary of the Invention

[0004] The purpose of the present invention is to provide a network security intrusion detection method and system based on a large model, which is used to solve the problems of traditional intrusion detection methods, such as insufficient recognition ability when dealing with unknown or variant attacks, and lack of effective means to identify the coordinated behavior patterns between multiple access nodes. As a result, the intrusion detection system has low detection accuracy, delayed response, and easy missed reports in complex network environments. The following problems are solved:

[0005] In the first aspect, the present invention provides a network security intrusion detection method based on a large model, comprising: clustering the access behaviors of a number of access nodes according to the network logs of the enterprise intranet in a preset historical time zone, and constructing an access behavior benchmark comparison table; monitoring and obtaining a number of access behavior data sequences of the said number of access nodes in the current time period, using the said access behavior benchmark comparison table, performing node difference comparison on the said number of access behavior data sequences, and constructing a deviated node distribution sequence; performing node similarity comparison on the said number of access behavior data sequences, and identifying the same-frequency nodes, and constructing a same-frequency node distribution sequence; combining with the large model, predicting and obtaining the potential attack node distribution and the potential attack probability distribution according to the said deviated node distribution sequence and the same-frequency node distribution sequence, and formulating a node detection strategy for network security intrusion detection.

[0006] Preferably, the network security intrusion detection method based on a large model also includes: randomly selecting a first access node, screening the network log according to the first access node, and determining a first access behavior data set; determining multiple access time periods based on a preset time interval, dividing the first access behavior data set, and obtaining multiple access behavior data sets; clustering access behaviors according to the multiple access behavior data sets, and determining multiple high-frequency access behavior characteristics, wherein the access behavior characteristics include access frequency, single data traffic, and single duration; establishing a first access behavior benchmark for the first access node based on the multiple access time periods and multiple high-frequency access behavior characteristics, and analyzing and determining several access behavior benchmarks in turn, and constructing an access behavior benchmark comparison table.

[0007] Preferably, the network security intrusion detection method based on a large model also includes: randomly selecting a first access behavior data set, clustering it using the K-means algorithm to obtain multiple first clusters and multiple first central eigenvalues; counting the data volume of the multiple first clusters, and selecting the first cluster with the maximum data volume of a preset proportion as a high-frequency cluster, determining multiple high-frequency clusters, and mapping to obtain multiple high-frequency central eigenvalues; performing mean calculation on the multiple high-frequency central eigenvalues ​​to obtain a first high-frequency access behavior feature, and analyzing in sequence to obtain multiple high-frequency access behavior features.

[0008] Preferably, the network security intrusion detection method based on a large model also includes: using the access behavior benchmark comparison table to match and obtain several adapted access behavior benchmarks of several access nodes in the current time period; based on the several adapted access behavior benchmarks, performing node difference comparison on several access behavior data at the same time point in the several access behavior data sequences in turn, determining multiple deviation node distributions, and constructing a deviation node distribution sequence.

[0009] Preferably, the network security intrusion detection method based on a large model also includes: respectively calculating the deviation amplitude between the adapted access behavior benchmark and the corresponding access behavior data, obtaining the access frequency deviation ratio, the single data flow deviation ratio and the single duration deviation ratio, performing weighted calculation to obtain the node deviation value, and analyzing in turn to obtain several deviation values ​​of several access nodes; obtaining the node position distribution of several access nodes, and using the several deviation values ​​to map and identify the node position distribution to obtain the deviated node distribution.

[0010] Preferably, the network security intrusion detection method based on a large model also includes: performing similarity clustering on several access behavior data at the same time point in the several access behavior data sequences according to a predetermined similarity threshold, and performing same-frequency node identification on the access nodes corresponding to the access behavior data that meet the predetermined similarity threshold to determine the same-frequency node set sequence; according to the same-frequency node set sequence, identifying the node position distribution of several access nodes respectively to obtain the same-frequency node distribution sequence.

[0011] Preferably, the network security intrusion detection method based on a large model also includes: screening sample data according to the network logs of similar enterprises, obtaining sample deviation node distribution sequence sets and sample same-frequency node distribution sequence sets, and analyzing to obtain high-frequency attack node distributions and high-frequency attack probability distributions under different sample deviation node distribution sequences and sample same-frequency node distribution sequences, obtaining sample attack node distribution sets and sample attack probability distribution sets; using the sample deviation node distribution sequence sets and sample same-frequency node distribution sequence sets as input, using the sample attack node distribution sets and sample attack probability distribution sets as supervision, training a large model, and constructing a network attack identification plug-in; using the network attack identification plug-in to predict and obtain potential attack node distributions and potential attack probability distributions based on the deviation node distribution sequence and the same-frequency node distribution sequence.

[0012] Preferably, the network security intrusion detection method based on a large model also includes: risk identification of potential attack nodes that meet a preset probability threshold and determining the distribution of potential risk nodes; performing position distribution concentration analysis on the distribution of potential risk nodes and determining the concentration of risk node distribution; if the concentration of risk node distribution is less than or equal to a preset concentration index, formulating a node detection strategy as local detection, wherein local detection is to perform network security intrusion detection on risk nodes according to the potential attack probability from large to small.

[0013] Preferably, the network security intrusion detection method based on a large model also includes: if the risk node distribution concentration is greater than a preset concentration index, formulating a node detection strategy as a global detection, wherein the global detection is to perform network security intrusion detection on all nodes according to the potential attack probability from large to small.

[0014] In the second aspect, the present invention also provides a network security intrusion detection system based on a large model, which is used to execute a network security intrusion detection method based on a large model as described in the first aspect, including: an access behavior clustering module, which is used to cluster the access behaviors of several access nodes according to the network logs of the enterprise intranet in a preset historical time zone, and construct an access behavior benchmark comparison table; a deviation node distribution sequence construction module, which is used to monitor and obtain several access behavior data sequences of the several access nodes in the current time period, and use the access behavior benchmark comparison table to perform node difference comparison on the several access behavior data sequences to construct a deviation node distribution sequence; a same-frequency node distribution sequence construction module, which is used to perform node similarity comparison on the several access behavior data sequences, and perform same-frequency node identification to construct a same-frequency node distribution sequence; a node detection strategy formulation module, which is used to combine the large model to predict and obtain potential attack node distribution and potential attack probability distribution according to the deviation node distribution sequence and the same-frequency node distribution sequence, and formulate a node detection strategy for network security intrusion detection.

[0015] The embodiments of the present invention include the following advantages:

[0016] By clustering the access behaviors of several access nodes based on the network logs of the enterprise intranet in a preset historical time zone, an access behavior benchmark comparison table is constructed; then, several access behavior data sequences of the several access nodes in the current period are monitored and obtained, and the access behavior benchmark comparison table is used to perform node difference comparison on the several access behavior data sequences to construct a deviation node distribution sequence; on the other hand, node similarity comparison is performed on the several access behavior data sequences, and same-frequency nodes are identified to construct a same-frequency node distribution sequence; then, combined with a large model, the potential attack node distribution and the potential attack probability distribution are predicted based on the deviation node distribution sequence and the same-frequency node distribution sequence; finally, a node detection strategy is formulated based on the potential attack node distribution and the potential attack probability distribution to perform network security intrusion detection. That is, by constructing an access behavior benchmark comparison table, access deviation nodes and same-frequency collaborative behavior nodes are identified, and combined with the large model, potential attack nodes and their attack probabilities are predicted, which effectively improves the detection capability of unknown attacks and collaborative attacks, realizes intelligent identification and accurate early warning of network intrusion behaviors, and significantly improves the accuracy, real-time nature and active defense capability of intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flowchart of the steps of a network security intrusion detection method based on a large model of the present invention;

[0018] Figure 2 The diagram is a structural diagram of a network security intrusion detection system based on a large model according to the present invention.

[0019] Description of reference numerals:

[0020] Access behavior clustering module 11, deviation node distribution sequence construction module 12, same-frequency node distribution sequence construction module 13, node detection strategy formulation module 14. DETAILED DESCRIPTION

[0021] The present invention provides a large-scale model-based network security intrusion detection method and system, addressing the shortcomings of traditional intrusion detection methods in identifying unknown or variant attacks, as well as the lack of effective means for identifying collaborative behavior patterns between multiple access nodes. This leads to problems such as low detection accuracy, delayed response, and easy omissions in intrusion detection systems in complex network environments. By constructing an access behavior benchmark comparison table, identifying access deviation nodes and nodes with same-frequency collaborative behavior, and combining the large-scale model to predict potential attack nodes and their attack probabilities, the system effectively enhances the detection capability for unknown and coordinated attacks, realizes intelligent identification and accurate early warning of network intrusion behavior, and significantly improves the accuracy, real-time nature, and active defense capabilities of intrusion detection.

[0022] Below, the technical solutions of the present invention will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments described herein. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. It should also be noted that, for the convenience of description, only the parts related to the present invention, rather than all, are shown in the accompanying drawings.

[0023] For example 1, please refer to the attached Figure 1 The present invention provides a network security intrusion detection method based on a large model, which is applied to a network security intrusion detection system based on a large model, and specifically includes the following steps:

[0024] S10: Clustering access behaviors of several access nodes based on the network logs of the enterprise intranet in a preset historical time zone, and constructing an access behavior benchmark comparison table.

[0025] Furthermore, step S10 of the present invention further includes:

[0026] S11: randomly select a first access node, filter the network log according to the first access node, and determine a first access behavior data set; S12: determine multiple access time periods based on a preset time interval, divide the first access behavior data set, and obtain multiple access behavior data sets.

[0027] Specifically, first, network log data from the enterprise intranet is collected within a preset historical time interval (e.g., the last 30 days). The preset historical time zone refers to a system-set historical time range used to capture network log data within a certain period of time. This time zone can be configured according to actual needs, for example, to the last 7 days, 30 days, or 90 days. In this embodiment, the "last 30 days" is used as an example. The purpose is to collect complete access behavior patterns within a sufficiently long time window for subsequent modeling and analysis. Network logs refer to various types of access records, connection requests, data transmission, and other behavioral information recorded by enterprise internal network devices (such as switches and servers). Log content typically includes fields such as timestamps, source IP addresses, destination IP addresses, ports, protocol types, data flow, and session duration. The enterprise intranet includes multiple access nodes, which are terminal devices or servers with independent network identifiers, such as employee computers, printers, and business system hosts. Each node leaves an access behavior record in the network, which serves as the basic unit for behavioral modeling. Then, any access node among multiple access nodes is randomly selected as the first access node, and the first access node is used as the screening condition. The obtained network log is filtered using the unique identifier of the first access node (such as the IP address), and only all access records generated by the node in the preset historical time zone are retained to form the first access behavior data set for subsequent behavior modeling and analysis.

[0028] Next, each day is divided based on preset time intervals. Specifically, to enable a more detailed analysis of the temporal distribution of access behavior, the entire historical time zone is further divided into multiple, continuous, equal-length time periods. These time intervals can be customized based on actual business characteristics, such as 30 minutes, 1 hour, 2 hours, or 4 hours. This allows for a more accurate depiction of differences in node access behavior within different time periods. For example, a 24-hour day can be divided into 24 access time periods based on hourly intervals. Based on these division results, the access behavior data of the first access node throughout the entire historical time zone is assigned to the corresponding access time period according to its timestamp attribute. After this time division operation, the original first access behavior dataset is split into several subsets, each corresponding to access behavior within a time period, resulting in multiple access behavior datasets.

[0029] S13: performing access behavior clustering according to the plurality of access behavior data sets to determine a plurality of high-frequency access behavior features, wherein the access behavior features include access frequency, single data flow, and single duration.

[0030] Furthermore, step S13 of the present invention further includes:

[0031] S131: Randomly select a first access behavior data set, cluster it using the K-means algorithm, and obtain multiple first clusters and multiple first center eigenvalues; S132: Count the data volume of the multiple first clusters, and select the first cluster with the maximum data volume of a preset proportion as the high-frequency cluster, determine multiple high-frequency clusters, and map to obtain multiple high-frequency center eigenvalues; S133: Calculate the mean of the multiple high-frequency center eigenvalues ​​to obtain the first high-frequency access behavior feature, and analyze in sequence to obtain multiple high-frequency access behavior features.

[0032] Specifically, first, any one data set is randomly selected from multiple access behavior data sets as the first access behavior data set; then, the K-means algorithm is used to cluster the first access behavior data set, first randomly initialize several cluster center points, and then each data sample is assigned to the cluster cluster to which the center point closest to it belongs; then, the mean of all samples in each cluster cluster is recalculated as the new center point, and the above steps are repeated until the clustering result converges or reaches the set number of iterations, thereby obtaining multiple access behavior clusters and their corresponding central feature values; wherein each behavior sample is represented by a set of access behavior feature vectors (such as access frequency, single data traffic, single duration), and the goal of clustering is to minimize the distance between samples and center points in the same cluster, and obtain several clusters with similar behavior characteristics.

[0033] Next, the data volume of the multiple first clusters is counted, and clusters with larger data volumes are selected based on a preset ratio (for example, selecting the top 20% or 30% of the clusters with the largest data volumes) and labeled as high-frequency clusters. The corresponding center point feature values ​​of these high-frequency clusters are obtained, referred to as high-frequency center feature values, representing the most common access patterns in the node's historical behavior. The multiple high-frequency center feature values ​​are then averaged according to their dimensions to calculate a first high-frequency access behavior feature, which reflects the typical access behavior profile of the first access node during that time period. This analysis process is repeated to extract multiple high-frequency access behavior features in multiple time periods. Access behavior features include access frequency, single data flow, and single duration. Access frequency refers to the number of connections or access requests initiated within a certain time period; single data flow refers to the amount of data transmitted during each access; and single duration refers to the duration of each connection. Using K-means clustering to perform pattern recognition on access behavior can effectively remove noise data, highlight high-frequency, stable behavior features, and thus establish an accurate access behavior profile for each node.

[0034] S14: establishing a first access behavior benchmark of the first access node according to the multiple access time periods and the multiple high-frequency access behavior features, and sequentially analyzing and determining a plurality of access behavior benchmarks to construct an access behavior benchmark comparison table.

[0035] Specifically, a first access behavior benchmark is first established for the first access node based on the multiple access time periods and multiple high-frequency access behavior characteristics. The access behavior benchmark is a normal behavior pattern for a node formed by modeling its historical access behavior characteristics over different time periods. This is used to subsequently determine whether the current access behavior deviates from the normal pattern and serves as an important basis for determining anomalies in intrusion detection. Using the same method used to obtain the first access behavior benchmark, multiple access behavior benchmarks for multiple access nodes are sequentially analyzed and obtained. Based on these multiple access behavior benchmarks, an access behavior benchmark comparison table is constructed.

[0036] S20: monitoring and obtaining a plurality of access behavior data sequences of the plurality of access nodes in the current time period, performing node difference comparison on the plurality of access behavior data sequences using the access behavior benchmark comparison table, and constructing a deviation node distribution sequence.

[0037] Furthermore, step S20 of the present invention further includes:

[0038] S21: using the access behavior benchmark comparison table, matching and obtaining a plurality of adapted access behavior benchmarks of a plurality of access nodes in the current time period.

[0039] Specifically, the monitoring obtains several access behavior data sequences of the several access nodes in the current time period. The current time period refers to the real-time time window in which the intrusion detection task is being carried out, which is usually consistent with the time interval used by the historical behavior benchmark (for example: the current 1 hour, the current half hour, etc.), which ensures the comparability between the current access behavior and the historical benchmark; in the current time period, network behavior monitoring is performed on all or part of the key monitored access nodes in the enterprise intranet, and the access request logs issued by each node are collected to generate structured behavior data records to obtain several access behavior data sequences.

[0040] Then, the access behavior benchmark comparison table is used to match and obtain several adapted access behavior benchmarks of several access nodes in the current time period, that is, a set of historical behavior features that best match the current time period and current node behavior are selected from the access behavior benchmark comparison table and used as a comparison template for the current behavior.

[0041] S22: Based on the plurality of adapted access behavior benchmarks, node difference comparison is performed on a plurality of access behavior data at the same time point in the plurality of access behavior data sequences, a plurality of deviation node distributions are determined, and a deviation node distribution sequence is constructed.

[0042] Furthermore, step S22 of the present invention further includes:

[0043] S221: Calculate the deviation amplitude between the adapted access behavior benchmark and the corresponding access behavior data respectively, obtain the access frequency deviation ratio, the single data flow deviation ratio and the single duration deviation ratio, perform weighted calculation to obtain the node deviation value, and analyze and obtain several deviation values ​​of several access nodes in turn; S222: Obtain the node position distribution of several access nodes, use the several deviation values ​​to map and identify the node position distribution, and obtain the deviated node distribution.

[0044] Specifically, for each access node within the current time period, a deviation analysis is performed based on its current access behavior data and its corresponding adapted access behavior benchmark. The deviation magnitude between the adapted access behavior benchmark and the corresponding access behavior data is calculated. The deviation magnitude is the ratio of the difference between the two to the benchmark value. This is used to obtain the access frequency deviation ratio, the single data flow deviation ratio, and the single duration deviation ratio. For example, assuming the current access frequency is 5 times per minute and the benchmark frequency is 4 times per minute, the frequency deviation magnitude is (5-4) / 4, which equals 25%. The weighted ratios of access frequency, single data flow, and single duration are further configured. These can be set empirically or obtained through training optimization. A weighted calculation is performed on the access frequency deviation ratio, single data flow deviation ratio, and single duration deviation ratio to obtain the node deviation value. This is then analyzed sequentially to obtain multiple deviation values ​​for several access nodes.

[0045] Then, the node location distribution of several access nodes is obtained, and the topological position or logical coordinates of each access node in the enterprise intranet can be determined based on the IP address segment, subnet location, device number, physical location or logical business grouping. Then, the node location distribution is mapped and identified using the several deviation values ​​to obtain the deviation node distribution, and multiple deviation node distributions are analyzed in turn to construct a deviation node distribution sequence.

[0046] S30: Perform node similarity comparison on the plurality of access behavior data sequences, identify nodes with the same frequency, and construct a distribution sequence of nodes with the same frequency.

[0047] Furthermore, step S30 of the present invention further includes:

[0048] S31: According to a predetermined similarity threshold, similarity clustering is performed on several access behavior data at the same time point in the several access behavior data sequences, and the access nodes corresponding to the access behavior data that meet the predetermined similarity threshold are identified as same-frequency nodes to determine the same-frequency node set sequence; S32: According to the same-frequency node set sequence, the node position distribution of several access nodes is identified respectively to obtain the same-frequency node distribution sequence.

[0049] Specifically, at the same point in time, the behavioral data of all access nodes is treated as a feature vector. Similarity metrics (such as cosine similarity and Euclidean distance) are used to compare all nodes pairwise. Nodes that meet a predetermined similarity threshold (which can be set based on the actual scenario, such as 70%) are grouped together into the same co-frequency node set, indicating that they exhibit consistent or coordinated access behavior characteristics at that point in time. These co-frequency nodes are then identified. This process is repeated for each time point, resulting in a sequence of co-frequency node sets that evolves over time. Based on this co-frequency node set sequence, the node location distributions of several access nodes are then identified. Each time point corresponds to a co-frequency node distribution structure diagram, resulting in a co-frequency node distribution sequence. This co-frequency node distribution sequence reflects the evolution of potential attack behavior in cyberspace or logic. By constructing a co-frequency node distribution sequence, it is possible to effectively identify abnormal coordinated behavior characteristics among multiple access nodes (such as group attacks and botnet synchronization), providing structured input data for subsequent large-scale model prediction of coordinated attack paths and identification of potential attack nodes.

[0050] S40: Combined with the large model, the potential attack node distribution and the potential attack probability distribution are predicted based on the deviation node distribution sequence and the same-frequency node distribution sequence, and a node detection strategy is formulated to perform network security intrusion detection.

[0051] Furthermore, step S40 of the present invention further includes:

[0052] S41: Based on the network logs of similar enterprises, sample data is screened to obtain the sample deviation node distribution sequence set and the sample same-frequency node distribution sequence set, and the high-frequency attack node distribution and high-frequency attack probability distribution under different sample deviation node distribution sequences and sample same-frequency node distribution sequences are analyzed to obtain the sample attack node distribution set and the sample attack probability distribution set; S42: Using the sample deviation node distribution sequence set and the sample same-frequency node distribution sequence set as input, and using the sample attack node distribution set and the sample attack probability distribution set as supervision, a large model is trained to construct a network attack identification plug-in; S43: Using the network attack identification plug-in, the potential attack node distribution and the potential attack probability distribution are predicted based on the deviation node distribution sequence and the same-frequency node distribution sequence.

[0053] Specifically, we first collect historical network log data from enterprises with similar business scenarios, network structures, or asset sizes. Each log sample contains access behavior data, node access time series, and annotated attack events or alarm records, serving as network logs for similar enterprises. We then filter sample data based on the network logs of similar enterprises to obtain a set of sample deviation node distribution sequences and a set of sample homogeneous node distribution sequences. We further analyze the distribution of high-frequency attack nodes and the distribution of high-frequency attack probabilities under different sample deviation node distribution sequences and homogeneous node distribution sequences, obtaining a set of sample attack node distributions and a set of sample attack probability distributions. The sample attack node distribution refers to the actual distribution of attack nodes in each sample, and the sample attack probability refers to the recorded or estimated probability of a node being attacked in different time periods.

[0054] Then, the sample deviation node distribution sequence set and the sample same-frequency node distribution sequence set are used as input, and the sample attack node distribution set and the sample attack probability distribution set are used as supervision to train the large model. First, the sample deviation node distribution sequence and the same-frequency node distribution sequence are used as model input, and the model performs forward propagation to output predictions of attack node distribution and attack probability; then, the error between the prediction result and the true label is calculated through the loss function (such as cross entropy, mean square error, etc.); then the backpropagation algorithm and optimizer (such as Adam) are used to adjust the model parameters to reduce the prediction error; finally, the model performance is periodically evaluated on the validation set, and the training strategy (such as learning rate, regularization) is adjusted to prevent overfitting. After the training is completed, the model parameters with the best performance are saved and encapsulated as a network attack identification plug-in module, and the trained identification plug-in is integrated into the network security monitoring platform to realize real-time prediction of potential attack nodes and their attack probabilities.

[0055] Finally, the trained network attack identification plug-in is used to input the deviated node distribution sequence and the same-frequency node distribution sequence monitored in the current network environment. Based on the attack pattern learning ability built into the large model, the plug-in predicts the spatial distribution of potential attack nodes and the corresponding attack probability distribution, thereby realizing real-time identification and early warning of network intrusion behavior.

[0056] Furthermore, step S40 of the present invention further includes:

[0057] S44: Risk identification of potential attack nodes that meet the preset probability threshold, and determination of potential risk node distribution; S45: Position distribution concentration analysis of the potential risk node distribution, and determination of risk node distribution concentration; S46: If the risk node distribution concentration is less than or equal to the preset concentration index, a node detection strategy is formulated as local detection, wherein local detection is to perform network security intrusion detection on risk nodes according to the potential attack probability from large to small.

[0058] Specifically, first, the attack probability of each node predicted by the network attack identification plug-in is compared with a pre-set probability threshold (which can be set according to the actual scenario, such as 50%). For nodes with an attack probability higher than the threshold, the system marks them as "potential risk nodes." These marked potential risk nodes form a potential risk node distribution in the network topology or physical location, reflecting the set of nodes that may currently be attacked and their distribution status. Next, a concentration analysis is performed on the spatial distribution of the above potential risk nodes, that is, to assess whether these risk nodes are clustered or relatively dispersed in certain areas of the network. The analysis indicators may include the physical distance between nodes, the network topology distance, or a statistically based distribution concentration indicator (such as the clustering coefficient, density, etc.). A risk node distribution concentration value is calculated, which quantifies the "aggregation degree" of the risk nodes. The concentration of risky nodes is then compared to a preset concentration threshold. If the concentration is less than or equal to the threshold, it indicates that the risky nodes are relatively dispersed and not highly concentrated. Based on this, a localized detection strategy is developed, focusing on high-risk nodes for targeted detection. Specifically, the potential risk nodes are ranked from highest to lowest by potential attack probability, prioritizing the nodes with the highest attack probability, and gradually conducting in-depth network security intrusion detection. This strategy can concentrate limited security resources, improve detection efficiency and response speed, avoid indiscriminate detection across the entire network, and save computational and labor costs.

[0059] Furthermore, step S40 of the present invention further includes:

[0060] S47: If the risk node distribution concentration is greater than a preset concentration index, a node detection strategy is formulated as global detection, wherein the global detection is to perform network security intrusion detection on all nodes according to the potential attack probability from large to small.

[0061] Specifically, when the concentration of risk nodes exceeds the preset concentration index threshold, it indicates that potential risk nodes in the network are showing a relatively obvious clustering or concentration trend. Due to the high concentration of risk nodes, the risk of attack may spread across nodes or be a coordinated attack. Simple local detection may not fully cover potential threats. Therefore, a global detection strategy is adopted to comprehensively scan and detect all access nodes in the network. Global detection sorts the potential attack probability from high to low, and performs network security intrusion detection on all nodes one by one to ensure that potential attack behaviors are not missed. Through the global detection strategy, the one-by-one inspection of all nodes can effectively prevent cluster attacks and rapidly spreading security threats, and enhance the comprehensiveness and depth of network security defense.

[0062] In summary, the network security intrusion detection method based on a large model provided by the present invention has the following technical effects:

[0063] By clustering the access behaviors of several access nodes based on the network logs of the enterprise intranet in a preset historical time zone, an access behavior benchmark comparison table is constructed; then, several access behavior data sequences of the several access nodes in the current period are monitored and obtained, and the access behavior benchmark comparison table is used to perform node difference comparison on the several access behavior data sequences to construct a deviation node distribution sequence; on the other hand, node similarity comparison is performed on the several access behavior data sequences, and same-frequency nodes are identified to construct a same-frequency node distribution sequence; then, combined with a large model, the potential attack node distribution and the potential attack probability distribution are predicted based on the deviation node distribution sequence and the same-frequency node distribution sequence; finally, a node detection strategy is formulated based on the potential attack node distribution and the potential attack probability distribution to perform network security intrusion detection. That is, by constructing an access behavior benchmark comparison table, access deviation nodes and same-frequency collaborative behavior nodes are identified, and combined with the large model, potential attack nodes and their attack probabilities are predicted, which effectively improves the detection capability of unknown attacks and collaborative attacks, realizes intelligent identification and accurate early warning of network intrusion behaviors, and significantly improves the accuracy, real-time nature and active defense capability of intrusion detection.

[0064] In the second embodiment, based on the same inventive concept as the network security intrusion detection method based on a large model in the above embodiment, the present invention also provides a network security intrusion detection system based on a large model, please refer to the attached Figure 2 , including: an access behavior clustering module 11, which is used to cluster the access behaviors of several access nodes according to the network logs of the enterprise intranet in a preset historical time zone, and construct an access behavior benchmark comparison table; a deviation node distribution sequence construction module 12, which is used to monitor and obtain several access behavior data sequences of the several access nodes in the current time period, and use the access behavior benchmark comparison table to perform node difference comparison on the several access behavior data sequences to construct a deviation node distribution sequence; a same-frequency node distribution sequence construction module 13, which is used to perform node similarity comparison on the several access behavior data sequences, and perform same-frequency node identification to construct a same-frequency node distribution sequence; a node detection strategy formulation module 14, which is used to combine the large model, predict and obtain the potential attack node distribution and potential attack probability distribution according to the deviation node distribution sequence and the same-frequency node distribution sequence, and formulate a node detection strategy for network security intrusion detection.

[0065] Furthermore, the large model-based network security intrusion detection system is also used to: randomly select a first access node, filter the network log according to the first access node, and determine a first access behavior data set; determine multiple access time periods based on a preset time interval, divide the first access behavior data set, and obtain multiple access behavior data sets; cluster access behaviors according to the multiple access behavior data sets to determine multiple high-frequency access behavior characteristics, wherein the access behavior characteristics include access frequency, single data traffic, and single duration; establish a first access behavior benchmark for the first access node based on the multiple access time periods and multiple high-frequency access behavior characteristics, and analyze and determine several access behavior benchmarks in turn to construct an access behavior benchmark comparison table.

[0066] Furthermore, the large model-based network security intrusion detection system is also used to: randomly select a first access behavior data set, cluster it using the K-means algorithm to obtain multiple first clusters and multiple first center eigenvalues; count the data volume of the multiple first clusters, and select the first cluster with the maximum data volume of a preset proportion as a high-frequency cluster, determine multiple high-frequency clusters, and map to obtain multiple high-frequency center eigenvalues; calculate the mean of the multiple high-frequency center eigenvalues ​​to obtain a first high-frequency access behavior feature, and analyze in sequence to obtain multiple high-frequency access behavior features.

[0067] Furthermore, the large model-based network security intrusion detection system is also used to: use the access behavior benchmark comparison table to match and obtain several adapted access behavior benchmarks of several access nodes in the current time period; based on the several adapted access behavior benchmarks, perform node difference comparison on several access behavior data at the same time point in the several access behavior data sequences in turn, determine multiple deviation node distributions, and construct a deviation node distribution sequence.

[0068] Furthermore, the network security intrusion detection system based on the large model is also used to: calculate the deviation amplitude between the adapted access behavior benchmark and the corresponding access behavior data, obtain the access frequency deviation ratio, the single data flow deviation ratio and the single duration deviation ratio, perform weighted calculation to obtain the node deviation value, and analyze and obtain several deviation values ​​of several access nodes in turn; obtain the node position distribution of several access nodes, use the several deviation values ​​to map and identify the node position distribution, and obtain the deviated node distribution.

[0069] Furthermore, the large model-based network security intrusion detection system is also used to: perform similarity clustering on several access behavior data at the same time point in the several access behavior data sequences according to a predetermined similarity threshold, and perform same-frequency node identification on the access nodes corresponding to the access behavior data that meet the predetermined similarity threshold to determine the same-frequency node set sequence; and identify the node position distribution of several access nodes respectively according to the same-frequency node set sequence to obtain the same-frequency node distribution sequence.

[0070] Furthermore, the network security intrusion detection system based on the large model is also used to: screen sample data according to the network logs of similar enterprises, obtain sample deviation node distribution sequence sets and sample same-frequency node distribution sequence sets, and analyze to obtain high-frequency attack node distribution and high-frequency attack probability distribution under different sample deviation node distribution sequences and sample same-frequency node distribution sequences, and obtain sample attack node distribution sets and sample attack probability distribution sets; use the sample deviation node distribution sequence sets and sample same-frequency node distribution sequence sets as input, use the sample attack node distribution sets and sample attack probability distribution sets as supervision, train the large model, and construct a network attack identification plug-in; use the network attack identification plug-in to predict and obtain potential attack node distribution and potential attack probability distribution based on the deviation node distribution sequence and the same-frequency node distribution sequence.

[0071] Furthermore, the network security intrusion detection system based on the large model is also used to: identify the risks of potential attack nodes that meet the preset probability threshold and determine the distribution of potential risk nodes; perform position distribution concentration analysis on the distribution of potential risk nodes and determine the concentration of risk node distribution; if the concentration of risk node distribution is less than or equal to the preset concentration index, formulate a node detection strategy as local detection, wherein local detection is to perform network security intrusion detection on risk nodes according to the potential attack probability from large to small.

[0072] Furthermore, the network security intrusion detection system based on the large model is also used to: if the risk node distribution concentration is greater than the preset concentration index, formulate a node detection strategy as global detection, wherein the global detection is to perform network security intrusion detection on all nodes according to the potential attack probability from large to small.

[0073] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The network security intrusion detection method based on a large model and the specific examples in the aforementioned embodiment 1 are also applicable to the network security intrusion detection system based on a large model in this embodiment. Through the aforementioned detailed description of the network security intrusion detection method based on a large model, those skilled in the art can clearly understand the network security intrusion detection system based on a large model in this embodiment, so for the sake of brevity of the specification, it will not be described in detail here. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0074] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

[0075] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the present invention and its equivalents, the present invention is intended to include these modifications and variations.

Claims

1. A network security intrusion detection method based on a large model, characterized in that: Methods include: Based on the network logs of the enterprise intranet in a preset historical time zone, the access behavior of several access nodes is clustered to build an access behavior benchmark comparison table; Monitor and obtain a plurality of access behavior data sequences of the plurality of access nodes in a current period, perform node difference comparison on the plurality of access behavior data sequences using the access behavior benchmark comparison table, and construct a deviation node distribution sequence; Performing node similarity comparison on the plurality of access behavior data sequences, identifying nodes with the same frequency, and constructing a distribution sequence of nodes with the same frequency; Combined with the large model, the potential attack node distribution and potential attack probability distribution are predicted based on the deviation node distribution sequence and the same-frequency node distribution sequence, and a node detection strategy is formulated to perform network security intrusion detection; Among them, based on the network logs of the enterprise intranet in the preset historical time zone, the access behavior of several access nodes is clustered to build an access behavior benchmark comparison table, including: Randomly selecting a first access node, screening the network log according to the first access node, and determining a first access behavior data set; Determining a plurality of access time periods based on a preset time interval, dividing the first access behavior data set to obtain a plurality of access behavior data sets; Performing access behavior clustering based on the multiple access behavior data sets to determine multiple high-frequency access behavior features, wherein the access behavior features include access frequency, single data flow, and single duration; Establishing a first access behavior benchmark for the first access node according to the multiple access time periods and the multiple high-frequency access behavior characteristics, and sequentially analyzing and determining a plurality of access behavior benchmarks to construct an access behavior benchmark comparison table; The method of predicting and obtaining the potential attack node distribution and the potential attack probability distribution according to the deviation node distribution sequence and the same-frequency node distribution sequence includes: Based on the network logs of similar enterprises, sample data is screened to obtain the sample deviation node distribution sequence set and the sample same-frequency node distribution sequence set. The high-frequency attack node distribution and high-frequency attack probability distribution under different sample deviation node distribution sequences and sample same-frequency node distribution sequences are analyzed to obtain the sample attack node distribution set and sample attack probability distribution set. Using the sample deviation node distribution sequence set and the sample same-frequency node distribution sequence set as input, using the sample attack node distribution set and the sample attack probability distribution set as supervision, training a large model, and building a network attack identification plug-in; The network attack identification plug-in is used to predict and obtain the potential attack node distribution and the potential attack probability distribution according to the deviation node distribution sequence and the same-frequency node distribution sequence.

2. The network security intrusion detection method based on a large model according to claim 1 is characterized in that: Performing access behavior clustering based on the multiple access behavior data sets to determine multiple high-frequency access behavior features, including: Randomly select the first access behavior data set, perform clustering using the K-means algorithm, and obtain multiple first clusters and multiple first central eigenvalues; Counting the data volumes of the plurality of first clusters, selecting a first cluster with a maximum data volume of a preset proportion as a high-frequency cluster, determining a plurality of high-frequency clusters, and mapping to obtain a plurality of high-frequency central eigenvalues; The mean of the multiple high-frequency central feature values ​​is calculated to obtain a first high-frequency access behavior feature, and multiple high-frequency access behavior features are analyzed in sequence to obtain.

3. The network security intrusion detection method based on a large model according to claim 1 is characterized in that: Using the access behavior benchmark comparison table, performing node difference comparison on the plurality of access behavior data sequences to construct a deviation node distribution sequence, including: Using the access behavior benchmark comparison table, matching and obtaining a plurality of adapted access behavior benchmarks of a plurality of access nodes in the current time period; Based on the plurality of adapted access behavior benchmarks, node difference comparison is performed on a plurality of access behavior data at the same time point in the plurality of access behavior data sequences in turn, a plurality of deviation node distributions are determined, and a deviation node distribution sequence is constructed.

4. The network security intrusion detection method based on a large model according to claim 3 is characterized in that: Calculate the deviation between the adapted access behavior benchmark and the corresponding access behavior data, obtain the access frequency deviation ratio, single data flow deviation ratio, and single duration deviation ratio, perform weighted calculations, and obtain the node deviation value. Analyze and obtain several deviation values ​​of several access nodes in turn. The node position distribution of a plurality of access nodes is obtained, and the node position distribution is mapped and identified using the plurality of deviation values ​​to obtain a deviation node distribution.

5. The network security intrusion detection method based on a large model according to claim 1 is characterized in that: Performing node similarity comparison on the plurality of access behavior data sequences, identifying nodes with the same frequency, and constructing a distribution sequence of nodes with the same frequency, including: According to a predetermined similarity threshold, similarity clustering is performed on a plurality of access behavior data at the same time point in the plurality of access behavior data sequences, and access nodes corresponding to the access behavior data that meet the predetermined similarity threshold are identified as same-frequency nodes to determine a same-frequency node set sequence; According to the same-frequency node set sequence, the node position distributions of several access nodes are respectively identified to obtain the same-frequency node distribution sequence.

6. The network security intrusion detection method based on a large model according to claim 1 is characterized in that: The node detection strategy is formulated, including: Identify the potential attack nodes that meet the preset probability threshold and determine the distribution of potential risk nodes; Performing a location distribution concentration analysis on the potential risk node distribution to determine the risk node distribution concentration; If the risk node distribution concentration is less than or equal to a preset concentration index, a node detection strategy is formulated as local detection, wherein the local detection is to perform network security intrusion detection on the risk nodes according to the potential attack probability from large to small.

7. The network security intrusion detection method based on a large model according to claim 6 is characterized in that: If the risk node distribution concentration is greater than a preset concentration index, a node detection strategy is formulated as global detection, wherein the global detection is to perform network security intrusion detection on all nodes according to the potential attack probability from large to small.

8. A network security intrusion detection system based on a large model, characterized in that: The steps for implementing the large model-based network security intrusion detection method according to any one of claims 1 to 7 include: The access behavior clustering module is used to cluster the access behaviors of several access nodes based on the network logs of the enterprise intranet in a preset historical time zone and build an access behavior benchmark comparison table; a deviation node distribution sequence construction module, configured to monitor and obtain a plurality of access behavior data sequences of the plurality of access nodes in a current period, compare the plurality of access behavior data sequences with each other using the access behavior benchmark comparison table, and construct a deviation node distribution sequence; A same-frequency node distribution sequence construction module is used to perform node similarity comparison on the plurality of access behavior data sequences, identify same-frequency nodes, and construct a same-frequency node distribution sequence; The node detection strategy formulation module is used to combine the large model, predict the potential attack node distribution and potential attack probability distribution based on the deviation node distribution sequence and the same-frequency node distribution sequence, and formulate a node detection strategy for network security intrusion detection.

Images