A communication dynamic analysis method for virtual network security

Abstract

The present invention discloses a communication dynamic analysis method for virtual network security, which relates to the technical field of network security. The method comprises the following steps: obtaining a communication timing sequence; performing multi-scale decomposition on the communication timing sequence to obtain a reference communication timing sequence; calculating a slope and a propagation rate, and determining abnormal communication data based on the slope and the propagation rate; determining continuous abnormal communication data according to periodic characteristics of the abnormal communication data and its propagation order in network nodes, and using reverse timing recursive analysis to determine the starting node and propagation path of the continuous abnormal communication data; inputting the abnormal data characteristics of the starting node and propagation path of the continuous abnormal communication data into an LSTM neural network model to predict subsequent abnormal nodes. The present invention is conducive to high-precision identification of communication anomalies, and significantly improves the security detection capability and response efficiency in a virtualized network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a communication dynamic analysis method oriented to virtual network security. Background Art

[0002] With the widespread adoption of cloud computing and virtualization technologies, enterprises and organizations are increasingly using virtual machines (VMs) for business deployment to improve resource utilization and management flexibility. However, the frequent and complex network communications between VMs have made network security threats increasingly hidden, complex, and diverse. Traditional network security detection methods typically identify anomalies based on predefined signature rules or static communication patterns, which presents the following significant shortcomings:

[0003] First, most existing technologies use detection methods based on static features or single-dimensional data analysis, which makes it difficult to comprehensively and accurately model complex and dynamically changing virtual network communication data, resulting in insufficient accuracy in identifying abnormal data.

[0004] Secondly, current methods for virtual machine network security detection pay little attention to the multi-scale variation characteristics of communication data, and are unable to capture the changing trends and patterns of abnormal data at different time scales, which easily leads to missing hidden abnormal communications.

[0005] In addition, existing network anomaly detection technologies often ignore the propagation path and periodic characteristics of abnormal communication data, making it difficult to effectively identify persistent abnormal attacks or covert advanced persistent threat (APT) attacks. They also lack predictive analysis of abnormal data propagation trends and paths, resulting in delayed abnormal response and increased risks.

[0006] Therefore, there is an urgent need for a method and system that can comprehensively utilize the multi-dimensional characteristics of communication data, combine multi-scale analysis methods, accurately identify network anomaly data, and effectively analyze anomaly propagation paths and trends, so as to further improve the intelligent level of network security detection. Summary of the Invention

[0007] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes a communication dynamic analysis method for virtual network security.

[0008] To achieve the above object, the present invention provides a communication dynamic analysis method for virtual network security, comprising:

[0009] The server node collects the communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, reconstructs the communication data based on the joint probability distribution of transmission intervals and durations, and obtains the communication time series.

[0010] Perform multi-scale decomposition on the communication timing sequence and fuse the decomposition results of different scales to obtain the benchmark communication timing sequence;

[0011] Calculating a difference sequence between a communication timing sequence and a reference communication timing sequence, calculating a first-order difference sequence of the difference sequence and determining its slope, calculating a propagation rate of the difference sequence between network nodes, and determining abnormal communication data based on the slope and the propagation rate;

[0012] Determine the continuous abnormal communication data according to the periodic characteristics of the abnormal communication data and the propagation order in the network nodes, and use reverse time sequence recursive analysis to determine the starting node and propagation path of the continuous abnormal communication data;

[0013] The abnormal data features of the starting node and propagation path of the continuous abnormal communication data are input into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series.

[0014] Furthermore, reconstructing the communication data based on the joint probability distribution of the transmission interval and the duration includes:

[0015] Count the occurrence frequencies of packet transmission intervals and interaction durations in the original communication data, and calculate the joint probability of transmission intervals and interaction durations based on the occurrence frequencies;

[0016] Based on the joint probability, a two-dimensional probability distribution matrix is ​​constructed with the transmission interval as the vertical axis and the interaction duration as the horizontal axis;

[0017] Determining a valid data region where the probability density is higher than the average probability density based on a probability density variation characteristic of the two-dimensional probability distribution matrix;

[0018] According to the valid data area, original communication data falling within the valid data area is selected, the communication data is reconstructed and a communication timing sequence is formed.

[0019] Furthermore, the method of performing multi-scale decomposition on the communication timing sequence and fusing the decomposition results of different scales includes:

[0020] Perform discrete wavelet transform on the communication timing sequence to obtain multi-scale approximate coefficient sequence and detail coefficient sequence;

[0021] Calculate the variance of each scale detail coefficient sequence respectively, sort them according to the variance and determine the main scale detail coefficient sequence;

[0022] The determined main scale detail coefficient sequence and the corresponding approximate coefficient sequence are used to perform inverse wavelet transform to reconstruct the time domain component sequences of different scales.

[0023] According to the reconstructed time domain component sequences of different scales, they are fused into the reference communication timing sequence through weighted superposition.

[0024] Furthermore, calculating the first-order difference sequence of the difference sequence and determining its slope includes:

[0025] Based on the obtained difference sequence, explicitly calculate its first-order difference sequence :

[0026] , ;

[0027] Where: is the difference between adjacent data points in the difference sequence; and is the difference between two consecutive data points in the difference sequence, and the length of the first-order difference sequence is n-1;

[0028] For the first-order difference series Perform linear regression to calculate its slope. The specific formula for slope calculation is as follows:

[0029] ;

[0030] Where: is the slope of the first-order difference sequence, i is the sequence index, , is the arithmetic mean of the first-order difference sequence.

[0031] Further, determining abnormal communication data based on the slope and propagation rate includes:

[0032] The preset slope threshold is , under normal circumstances, the data transmission rate threshold is ;

[0033] The calculated slope and propagation rate , for comparative judgment:

[0034] When the absolute value of the slope ,and , the corresponding communication data is marked as abnormal communication data;

[0035] Otherwise, the corresponding communication data is not marked as abnormal communication data.

[0036] Furthermore, the method for acquiring the periodic characteristics of the abnormal communication data includes:

[0037] Performing discrete Fourier transform on the data amplitude sequence of the abnormal communication data to obtain the corresponding frequency domain sequence;

[0038] Specifically, the data amplitude sequence of abnormal communication data is: ;in, represents the difference between the ith abnormal data point and the reference communication sequence; n is the length of the abnormal communication data sequence;

[0039] Specifically, the calculation formula for discrete Fourier transform of the data amplitude sequence is as follows:

[0040] ;

[0041] Where: represents the Fourier transform result of the kth frequency component, that is, the amplitude value of the kth frequency component, is an imaginary unit, and , the sequence length n is the number of sampling points of discrete Fourier transform;

[0042] Calculating the power spectral density value of each frequency component in the frequency domain sequence and sorting them from high to low according to the value;

[0043] The power spectrum density value calculation formula is:

[0044] ;

[0045] Where: is the power spectrum density corresponding to the kth frequency component, is the conjugate complex number of the kth frequency component, is the amplitude value of the kth frequency component;

[0046] Determine the frequency component that is at the first position after sorting as the dominant frequency component;

[0047] Calculating a period length according to a frequency value corresponding to the dominant frequency component, and determining the period length as a period feature of the abnormal communication data;

[0048] The cycle length calculation formula is:

[0049] ;

[0050] Where: Expressed as the cycle length of abnormal communication data, is the frequency value corresponding to the dominant frequency component.

[0051] Furthermore, the method for obtaining the propagation order is as follows:

[0052] Record the timestamp when each node in the network detects abnormal communication data;

[0053] According to the timestamp when each node detects abnormal communication data, the nodes are sorted in ascending order of timestamp value;

[0054] According to the sorted node sequence and the network topology connection relationship between the nodes, the propagation order of the abnormal communication data in the network nodes is determined, and the determined propagation order is output.

[0055] Furthermore, determining the starting node and propagation path of the persistent abnormal communication data includes:

[0056] According to the propagation order of the continuous abnormal communication data in the network nodes, determining the last node in the propagation order as the initial backtracking node;

[0057] According to the network topology connection relationship, starting from the initial backtracking node, forwardly determine the previous node that is directly connected to it and is located before the node in the propagation order;

[0058] Using the determined previous-order node as a new backtracking node, repeating the process of determining the previous-order node, and backtracking in reverse step by step until the first node in the propagation sequence is determined, and determining the node as the starting node of the continuous abnormal communication data;

[0059] According to the connection relationship between the nodes determined in the above reverse tracing process, the complete propagation path of the continuous abnormal communication data from the starting node to the initial tracing node is determined, and the starting node and propagation path of the continuous abnormal communication data are output.

[0060] Furthermore, the predicting of subsequent abnormal nodes in the communication timing sequence includes:

[0061] According to the abnormal data features of the starting node and propagation path of the continuous abnormal communication data, an abnormal feature sequence of abnormal propagation of communication nodes is constructed;

[0062] The abnormal feature sequence is input into the LSTM neural network model to predict the probability of occurrence of abnormal communication data of each node at the next moment;

[0063] The nodes whose predicted abnormal occurrence probability exceeds the preset probability threshold are determined as subsequent abnormal nodes, and the determined subsequent abnormal nodes are output.

[0064] A communication dynamic analysis system for virtual network security is implemented based on the above-mentioned communication dynamic analysis method for virtual network security, and is characterized by comprising:

[0065] An acquisition module is used by the server node to collect the communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, reconstruct the communication data based on the joint probability distribution of the transmission intervals and durations, and obtain a communication time sequence;

[0066] The decomposition module is used to perform multi-scale decomposition on the communication timing sequence and fuse the decomposition results of different scales to obtain the benchmark communication timing sequence;

[0067] an anomaly acquisition module, configured to calculate a difference sequence between a communication timing sequence and a reference communication timing sequence, calculate a first-order difference sequence of the difference sequence and determine its slope, calculate a propagation rate of the difference sequence between network nodes, and determine abnormal communication data based on the slope and propagation rate;

[0068] An anomaly analysis module, configured to determine persistent abnormal communication data based on the periodic characteristics of the abnormal communication data and its propagation sequence in network nodes, and determine the starting node and propagation path of the persistent abnormal communication data using reverse time sequence recursive analysis;

[0069] The detection module is used to input the abnormal data features of the starting node and propagation path of the continuous abnormal communication data into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series.

[0070] Compared with the prior art, the present invention has the following beneficial effects:

[0071] The present invention constructs a joint probability distribution model based on data packet transmission intervals and interaction durations, identifies and retains representative valid data areas in virtual machine communications, and reconstructs a true and credible communication timing sequence. This effectively solves the problems in the prior art of severe redundant data interference in virtual communication flows and difficulty in accurately extracting communication behavior features, and significantly improves the quality of pre-processed data and basic analysis accuracy for anomaly detection.

[0072] Furthermore, the communication timing sequence is decomposed through multi-scale wavelet transform, the dominant scale is determined by combining the variance contribution of the detail sequence at each scale, and a benchmark communication timing sequence is constructed for difference analysis. This solves the problem that traditional anomaly detection methods have weak recognition ability for short-term bursts and slow hidden anomalies and high false alarm rate, and significantly enhances the system's adaptability and recognition ability for complex communication abnormal behaviors at different time scales.

[0073] In addition, through the joint discrimination mechanism of the difference sequence slope and the propagation rate between nodes, abnormal communication data with propagation trends can be accurately identified. Further combined with the frequency domain periodicity analysis and the network topology backtracking path algorithm, the starting point and complete path of abnormal propagation are determined, and the LSTM neural network model is introduced to realize the intelligent prediction of subsequent abnormal nodes. This systematically solves the problem of abnormal events being difficult to trace and difficult to warn in advance in existing technologies, and significantly improves the initiative and intelligence level of network security defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0075] Figure 1 Schematic diagram of the process of the present invention;

[0076] Figure 2 Schematic diagram of the structure of the system of the present invention. DETAILED DESCRIPTION

[0077] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0078] See also Figure 1 The first embodiment of the present invention provides a communication dynamic analysis method for virtual network security, including:

[0079] S101: The server node collects communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, reconstructs communication data based on a joint probability distribution of transmission intervals and durations, and obtains a communication time sequence.

[0080] It should be noted that a server node refers to a physical or virtual server used to collect and analyze virtual machine communication data. It obtains communication data through a network monitoring module deployed in the virtualization platform. Communication data includes:

[0081] Inter-VM communication node identifier:

[0082] Specifically, it is the unique network identifier of each virtual machine node in the virtualization platform, which may include an IP address, MAC address, or a unique UUID identifier of the virtual machine, and is collected by monitoring the network traffic records of the virtual switch;

[0083] Data packet transmission interval:

[0084] Specifically, it is the time interval between sending or receiving consecutive communication data packets. The server node accurately records the receiving or sending time of each data packet, and then calculates the transmission interval between each data packet one by one. The specific calculation method is: , The time interval between the transmission of the ith data packet, and are the timestamps of the i-th and i-1-th packets respectively;

[0085] Interaction duration:

[0086] Specifically, it is the total duration of communication activities between two specific virtual machine nodes. Specifically, the server node records the timestamps of the first and last communication data packets between each pair of virtual machine nodes based on the virtual machine communication data traffic, and then calculates the communication duration: , The duration of communication interaction between virtual machine nodes. The communication timestamp of the first data packet between virtual machine nodes, The communication timestamp of the last data packet between virtual machine nodes;

[0087] In implementation, the reconstructing communication data based on the joint probability distribution of the transmission interval and the duration includes:

[0088] S101.1 Count the occurrence frequencies of packet transmission intervals and interaction durations in the original communication data, and calculate the joint probability of the transmission intervals and interaction durations based on the occurrence frequencies;

[0089] The process of counting the frequency of occurrence of the packet transmission interval and the interaction duration in the original communication data and calculating the joint probability is specifically as follows:

[0090] Divide the transmission interval of the original communication data into multiple equal-width intervals, such as 0–10ms, 10–20ms, 20–30ms, etc.

[0091] Divide the interaction duration into multiple equal-width intervals, such as 0–1s, 1–2s, 2–3s, etc.

[0092] Count the number of data packets that fall into each transmission interval and interaction duration interval at the same time;

[0093] Calculate the ratio of the number of data packets in each combination interval to the total number of data packets to form a joint probability :

[0094] ;

[0095] Where: is the number of data packets that fall into both the transmission interval and interaction duration intervals, is the total number of all data packets;

[0096] S101.2 constructing a two-dimensional probability distribution matrix based on the joint probability, with the transmission interval as the vertical axis and the interaction duration as the horizontal axis;

[0097] Among them, all the joint probability values ​​calculated above are arranged according to the corresponding transmission interval interval (vertical axis) and interaction duration interval (horizontal axis) to form a two-dimensional matrix M:

[0098] ;

[0099] Where: Each element in the matrix represents the joint probability of a specific combination interval;

[0100] S101.3 Determine, based on the probability density variation characteristics of the two-dimensional probability distribution matrix, a valid data region having a probability density higher than the average probability density;

[0101] The process of determining the valid data area according to the probability density variation characteristics of the two-dimensional probability distribution matrix is ​​specifically as follows:

[0102] Calculate the average of all joint probability values ​​in the two-dimensional probability distribution matrix M :

[0103] ;

[0104] Where: 、 are the total number of intervals for transmission interval and interaction duration respectively;

[0105] The joint probability value exceeds the mean The interval is determined as the valid data area, forming a two-dimensional valid area mask matrix E, where:

[0106] ;

[0107] S101.4 selecting original communication data falling within the valid data region, reconstructing the communication data, and forming a communication timing sequence;

[0108] The process of selecting the original communication data and reconstructing the communication data according to the valid data area is specifically as follows:

[0109] Traverse all original communication data and determine whether its transmission interval and interaction duration both fall into the position marked as 1 in the valid data area mask matrix E. If so, select the communication data and keep the timestamp and sequence information of the original data packet unchanged;

[0110] After the selection is completed, the original data packet timestamps are strictly sorted in ascending order to ensure that the reconstructed communication data sequence is accurate and continuous, and is completely consistent with the original communication data in time sequence to ensure data authenticity and time sequence continuity, thereby obtaining the reconstructed communication time sequence sequence, which is specifically expressed as:

[0111] ;

[0112] Where: is the transmission interval of the i-th data packet after reconstruction, and n is the total number of communication data after reconstruction;

[0113] Assuming that in the original communication data packet sequence, the 3rd, 4th, 7th, and 8th data packets fall into the valid data area, the explicitly selected data packets still retain the timestamp information of the original data packets, such as the following Table 1:

[0114] Table 1: Timestamp information table

[0115]

[0116] The reconstructed communication timing sequence is clearly: ;

[0117] S102: performing multi-scale decomposition on the communication timing sequence, and fusing the decomposition results of different scales to obtain a reference communication timing sequence;

[0118] In implementation, the method of performing multi-scale decomposition on a communication timing sequence and fusing decomposition results at different scales includes:

[0119] S102.1: Perform discrete wavelet transform on the communication timing sequence to obtain a multi-scale approximate coefficient sequence and a detail coefficient sequence;

[0120] It should be noted that the discrete wavelet transform is a standard multi-scale analysis method, using db4 or sym4, specifically: the communication time series The input wavelet filter bank is first low-pass filtered and down-sampled to obtain an approximate coefficient sequence that reflects the long-term trend of the original sequence. , and after high-pass filtering and downsampling, the detail coefficient sequence reflecting the short-term fluctuation of the sequence is clearly obtained , with an approximate coefficient sequence As input, continue to perform low-pass and high-pass filtering of the next scale, and downsample to clearly obtain the approximate coefficient sequence of the next scale With detail coefficient sequence ; Similarly, complete the multi-scale (such as three-level) discrete wavelet transform, and finally obtain the approximate coefficient sequence set of each scale and detail coefficient sequence set ;

[0121] S102.2: Calculate the variance of each scale detail coefficient sequence, sort them by variance, and determine the main scale detail coefficient sequence;

[0122] It should be noted that the method for calculating the variance of each scale detail coefficient sequence and determining the main scale is specifically as follows: taking the k-th scale detail coefficient sequence For example, the formula for calculating variance is:

[0123] ;

[0124] Where: is the variance of the k-th scale detail coefficient sequence; is the i-th element in the k-th scale detail coefficient sequence; is the arithmetic mean of the k-th scale detail coefficient sequence; is the total number of elements in the k-th scale detail coefficient sequence;

[0125] After calculating the variance of all scale detail coefficient series, sort them from large to small according to the size of the variance, and select the scale with the highest ranking r (such as r = 2) as the main scale to clearly indicate that these scales contribute most significantly to the short-term fluctuations of the original series;

[0126] S102.3: Perform inverse wavelet transform using the determined main-scale detail coefficient sequence and the corresponding approximate coefficient sequence to reconstruct time-domain component sequences of different scales;

[0127] It should be noted that the method of performing inverse wavelet transform using the determined main-scale detail coefficient sequence and the corresponding approximate coefficient sequence to reconstruct time domain component sequences of different scales is specifically as follows:

[0128] For a selected sequence of principal scale detail coefficients (e.g. and the corresponding approximate coefficient sequence (e.g. ), respectively, perform inverse wavelet transform; taking the kth scale as an example, the inverse wavelet transform specifically includes:

[0129] The k-th scale detail coefficient sequence and the approximate coefficient sequence Do not upsample, insert zero values ​​for sequence expansion;

[0130] The upsampled sequences are processed by corresponding wavelet reconstruction filters (i.e., low-pass and high-pass filters);

[0131] The two sequences processed by the filter are summed point by point to obtain the time domain component sequence corresponding to the kth scale ;

[0132] S102.4: Based on the reconstructed time domain component sequences of different scales, the reference communication timing sequence is fused by weighted superposition.

[0133] It should be noted that the method of fusing time domain component sequences of different scales into a reference communication timing sequence by weighted superposition is specifically as follows:

[0134] The time domain component sequences of each scale obtained by the above reconstruction Perform weighted superposition, and the specific weight coefficient is determined by the correlation coefficient between each scale sequence and the original communication timing sequence; the specific correlation coefficient The calculation formula is:

[0135] ;

[0136] Where: is the i-th element in the original communication timing sequence, is the i-th element in the k-th scale time domain component sequence, 、 are the arithmetic means of the two sequences, and n is the length of the sequence;

[0137] After obtaining the correlation coefficient, calculate the weight of the time domain component sequence of each scale :

[0138] ;

[0139] Finally, the benchmark communication timing sequence It is clearly obtained by the following formula:

[0140] ;

[0141] Where: is the i-th element in the benchmark communication timing sequence; is the weight of the k-th scale time domain component sequence; is the i-th element in the k-th scale time domain component sequence;

[0142] S103: Calculating a difference sequence between a communication timing sequence and a reference communication timing sequence, calculating a first-order difference sequence of the difference sequence and determining its slope, calculating a propagation rate of the difference sequence between network nodes, and determining abnormal communication data based on the slope and the propagation rate;

[0143] It should be noted that the calculation method of the difference sequence is: let the original communication timing sequence be recorded as, , the benchmark communication timing sequence is recorded as, , where the sequence length is n and each data point and The timestamps of the two sequences are strictly consistent; then the difference sequence is clearly expressed as:

[0144] , , ;

[0145] Where: is the difference between the original communication timing sequence and the reference sequence at the i-th time point, and are the corresponding i-th data points in the communication timing sequence and the benchmark communication timing sequence, respectively. The sequence length n is clearly the total number of data points in the data analysis interval;

[0146] Calculating the first-order difference sequence of the difference sequence and determining its slope includes:

[0147] Based on the obtained difference sequence D, explicitly calculate its first-order difference sequence :

[0148] , ;

[0149] Where: is the difference between adjacent data points in the difference sequence; and is the difference between two consecutive data points in the difference sequence, and the length of the first-order difference sequence is n-1;

[0150] For the first-order difference series Perform linear regression to calculate its slope. The specific formula for slope calculation is as follows:

[0151] ;

[0152] Where: is the slope of the first-order difference sequence, i is the sequence index, , is the arithmetic mean of the first-order difference sequence;

[0153] It can be understood that the slope objectively reflects the rate of change of the difference sequence, which can be specifically expressed as:

[0154] If the slope , then the difference sequence gradually increases over time;

[0155] If the slope , then the difference sequence decreases gradually over time;

[0156] Absolute value of slope The larger it is, the more drastic the change trend is;

[0157] It should be noted that the specific method for calculating the propagation rate is: if the data point with abnormal changes in the difference sequence is first observed at the network node m and exceeds the preset abnormal amplitude threshold, then the first timestamp of the abnormal data observed by the node is recorded as ; Subsequently, when the same abnormal characteristic data point is observed for the first time at the next network node n and exceeds the preset abnormal amplitude threshold, the timestamp of the first abnormal data observed by the node is recorded as ; Then the propagation time interval of the difference sequence between network node m and node n is clearly: ; The network topology connection distance (such as the number of hops) between network node m and node n is clearly defined as , then the propagation rate can be calculated as: ;

[0158] It should be noted that: the network topology connection distance (i.e., the number of hops) between network node m and node n is ), is determined by pre-acquired and stored network topology mapping table, specifically as follows:

[0159] Establish a topological connection matrix (adjacency matrix) between network nodes in advance to record the direct connection relationship between all nodes; use the breadth-first search (BFS) algorithm, starting from node m, to search the shortest path length to node n in the network topology graph as the hop count ;

[0160] For example, if node m is connected to node n through two intermediate nodes, node x and node y, the number of hops is ;

[0161] Wherein, determining abnormal communication data based on the slope and the propagation rate includes:

[0162] The preset slope threshold is , under normal circumstances, the data transmission rate threshold is ;

[0163] The calculated slope and propagation rate , for comparative judgment:

[0164] When the absolute value of the slope ,and , the corresponding communication data is marked as abnormal communication data;

[0165] Otherwise, the corresponding communication data is not marked as abnormal communication data;

[0166] For example: Assume that the slope threshold is set to , the propagation rate threshold is (jumps / second); if calculated, the slope of the actual data , while the propagation rate , then the condition is met, and the corresponding communication data is clearly determined to be abnormal communication data.

[0167] S104: Determine persistent abnormal communication data based on the periodic characteristics of the abnormal communication data and its propagation sequence in the network nodes, and use reverse time sequence recursive analysis to determine the starting node and propagation path of the persistent abnormal communication data;

[0168] Specifically, the method for obtaining the periodic characteristics of the abnormal communication data includes:

[0169] S104.1: Perform a discrete Fourier transform on the amplitude sequence of the abnormal communication data to obtain a corresponding frequency domain sequence;

[0170] Specifically, the data amplitude sequence of abnormal communication data is: ;in, represents the difference between the ith abnormal data point and the reference communication sequence; n is the length of the abnormal communication data sequence;

[0171] Specifically, the calculation formula for discrete Fourier transform of the data amplitude sequence is as follows:

[0172] ;

[0173] Where: represents the Fourier transform result of the kth frequency component, that is, the amplitude value of the kth frequency component, is an imaginary unit, and , the sequence length n is the number of sampling points of discrete Fourier transform;

[0174] S104.2: Calculate the power spectral density value of each frequency component in the frequency domain sequence and sort them from high to low according to the value;

[0175] The power spectrum density value calculation formula is:

[0176] ;

[0177] Where: is the power spectrum density corresponding to the kth frequency component, is the conjugate complex number of the kth frequency component, is the amplitude value of the kth frequency component;

[0178] S104.3: Determine the frequency component that is at the first position after sorting as the dominant frequency component;

[0179] S104.4: Calculate a period length based on the frequency value corresponding to the dominant frequency component, and determine the period length as a period characteristic of the abnormal communication data;

[0180] The cycle length calculation formula is:

[0181] ;

[0182] Where: Expressed as the cycle length of abnormal communication data, is the frequency value corresponding to the dominant frequency component;

[0183] Specifically, the method for obtaining the propagation order is as follows:

[0184] S104.5: Record the timestamp when each node in the network detects abnormal communication data;

[0185] S104.6: Sort the nodes in ascending order of timestamp values ​​based on the timestamps when each node detects abnormal communication data;

[0186] Specifically, obtain the set of nodes in the network where abnormal communication data has been clearly observed, which is recorded as: ,in is a node identifier in the network, which can be the node's IP address, MAC address, or unique identifier of a virtual machine, and m is the total number of nodes in the network where abnormal communication data has been clearly observed;

[0187] Record the exact timestamp of the first occurrence of abnormal communication data for each node in the above network node set to form a corresponding set of nodes and timestamps, specifically recorded as: ,in, Represents a network node The timestamp of the first occurrence of abnormal communication data, with millisecond accuracy to ensure that the order of occurrence of abnormal data from different nodes can be objectively distinguished;

[0188] S104.7: Determine the propagation order of the abnormal communication data in the network nodes based on the sorted node order and the network topology connection relationship between the nodes, and output the determined propagation order;

[0189] For example, assume that the network nodes that have clearly detected abnormal communication data include node A, node B, node C, and node D; the timestamps when each node detected the abnormal communication data are: node A: 2024-05-30 10:00:05.200; node B: 2024-05-30 10:00:06.500; node C: 2024-05-30 10:00:08.300; node D: 2024-05-30 10:00:10.600;

[0190] According to the above timestamps, after sorting the nodes in the order of the time when the abnormal data was detected from the earliest to the latest, the clear node order is: node A → node B → node C → node D;

[0191] Furthermore, given the network topology connection relationship: there is a direct connection between node A and node B; there is a direct connection between node B and node C; there is a direct connection between node C and node D; there is no direct connection between node A and node C, node A and node D; there is no direct connection between node B and node D; based on the sorted node order and the above clear network topology connection relationship, it can be determined that the propagation order of abnormal communication data is: node A → node B → node C → node D;

[0192] The above node order conforms to the logic of abnormal data gradually propagating between nodes: Node A has abnormal data first, followed by Node B, and there is a direct connection between the two. Then, Node C has abnormal data, which has a direct connection with Node B. Node D has abnormal data last, and there is a direct connection with Node C. Finally, the propagation order is clearly output in table form (see Table 2 below):

[0193] Table 2: Propagation order data table

[0194]

[0195] Specifically, the persistent abnormal communication data refers to abnormal communication data that propagates sequentially between network nodes in the same node order over multiple consecutive cycles, and the propagation process exhibits stable periodic repetition characteristics; the persistent abnormal communication data is manifested as a clear dominant periodic component in the frequency domain, and in the time domain, the abnormal data propagation path recurs without difference over consecutive cycles;

[0196] In implementation, the method of determining the starting node and propagation path of the persistent abnormal communication data by using reverse time sequence recursive analysis includes:

[0197] S104.1: Determine, based on the propagation order of the persistent abnormal communication data in the network nodes, the last node in the propagation order as the initial backtracking node;

[0198] For example, assume that the node propagation order sequence is: → → → , then the node at the end of the propagation sequence will be clearly As the initial backtracking node;

[0199] S104.2: Starting from the initial backtracking node, determine the previous node that is directly connected to the initial backtracking node and is located before the node in the propagation order according to the network topology connection relationship;

[0200] S104.3: Using the determined previous-order node as a new backtracking node, repeat the previous-order node determination process, backtracking in reverse level by level until the first node in the propagation sequence is determined, and determining this node as the starting node of the persistent abnormal communication data;

[0201] S104.4: Determine the complete propagation path of the persistent abnormal communication data from the starting node to the initial traceback node based on the connection relationship between the nodes determined in the reverse traceback process, and output the starting node and propagation path of the persistent abnormal communication data;

[0202] For example, if the network topology is as follows: 、 、 , indicating that there is a clear direct network connection relationship between nodes A and B, B and C, and C and D. Based on the network topology connection relationship, it is clearly judged that The node that has a direct connection and precedes the node in the propagation order is the node , then determine the node For nodes Then, the previous node that has just been determined is used as the new backtracking node, and the above process is repeated to continue forward to determine the node that is directly connected and located in the front of the propagation order;

[0203] Continuing the example, the current node To trace back the node, clearly judge the node according to the network topology relationship Directly connected and located at the node The previous node is the node , then determine the node For nodes Repeat the above recursive analysis until the first node in the propagation order is clearly determined (such as node ), at this time node The node that first detects the continuous abnormal communication data in the network, and there is no earlier node in the propagation path, so the node The starting node of the persistent abnormal communication data is determined. Finally, based on the above backtracking analysis process, the complete propagation path is determined as: → → → .

[0204] S105: Inputting the abnormal data features of the starting node and propagation path of the continuous abnormal communication data into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series;

[0205] Specifically, the abnormal data characteristics include the frequency of occurrence of historical abnormal communication data of the node, specifically the number of times the node detects abnormal communication data within a unit time (such as per hour or per day); the amplitude change characteristics of the historical abnormal communication data of the node, specifically the average value, variance, maximum value or median of the difference sequence of historical abnormal communication data relative to the baseline communication data; the historical delay characteristics of the propagation of abnormal communication data between network nodes, specifically the historical average value or historical median of the time difference between two adjacent nodes successively detecting abnormal communication data; the historical probability of the propagation of abnormal data of a node to subsequent nodes after abnormal communication data has occurred in the past, specifically the historical statistical probability of abnormal communication data occurring in the subsequent nodes directly adjacent to the node at the next moment after the node detects the abnormal data;

[0206] In implementation, predicting subsequent abnormal nodes in the communication timing sequence includes:

[0207] S105.1: Construct an abnormal feature sequence of abnormal communication node propagation based on the abnormal data features of the starting node and propagation path of the persistent abnormal communication data;

[0208] S105.2: Input the abnormal feature sequence into the LSTM neural network model to predict the probability of abnormal communication data of each node at the next moment;

[0209] It should be noted that the training process of the LSTM neural network model is to obtain historical abnormal feature recognition data, divide the historical abnormal feature recognition data into a training set and a test set, wherein the historical abnormal feature recognition data includes abnormal data features and their corresponding abnormal occurrence probabilities; construct an LSTM neural network, use the abnormal data features in the training set as input, and the abnormal occurrence probabilities as output, and feed them into the LSTM neural network for training to obtain an initial LSTM neural network; use the test set to verify the initial LSTM neural network model, and input the initial LSTM neural network with a test error threshold as the LSTM neural network model; the abnormal data features and abnormal occurrence probabilities in the historical abnormal feature recognition data are actually collected by technicians or obtained based on historical data records.

[0210] S105.3: Determine the node whose predicted abnormality occurrence probability exceeds a preset probability threshold as a subsequent abnormal node, and output the determined subsequent abnormal node.

[0211] See also Figure 2 Based on the same inventive concept, the second aspect of the present invention provides a communication dynamic analysis system for virtual network security. For details not provided in this embodiment, please refer to the description of the relevant parts in Example 1. The system includes:

[0212] Acquisition module 201, configured for a server node to collect communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, and reconstruct communication data based on a joint probability distribution of transmission intervals and durations to obtain a communication time sequence;

[0213] Decomposition module 202, configured to perform multi-scale decomposition on the communication timing sequence and fuse the decomposition results of different scales to obtain a reference communication timing sequence;

[0214] Anomaly acquisition module 203, configured to calculate a difference sequence between a communication timing sequence and a reference communication timing sequence, calculate a first-order difference sequence of the difference sequence and determine its slope, calculate a propagation rate of the difference sequence between network nodes, and determine abnormal communication data based on the slope and propagation rate;

[0215] Anomaly analysis module 204, configured to determine persistent abnormal communication data based on the periodic characteristics of the abnormal communication data and its propagation sequence in network nodes, and to determine the starting node and propagation path of the persistent abnormal communication data using reverse time sequence recursive analysis;

[0216] The detection module 205 is configured to input the abnormal data features of the starting node and propagation path of the continuous abnormal communication data into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series.

[0217] The above embodiments can be implemented in whole or in part via software, hardware, firmware, or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via a wired or wireless network. The computer-readable storage medium can be any available medium accessible by a computer, or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, or magnetic tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0218] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only one type. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0219] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0220] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0221] Some of the data in the above formula are calculated by removing the dimensions and taking their numerical values. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0222] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A communication dynamic analysis method for virtual network security, characterized in that: include: The server node collects the communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, reconstructs the communication data based on the joint probability distribution of transmission intervals and durations, and obtains the communication time series. Perform multi-scale decomposition on the communication timing sequence and fuse the decomposition results of different scales to obtain the benchmark communication timing sequence; Calculating a difference sequence between a communication timing sequence and a reference communication timing sequence, calculating a first-order difference sequence of the difference sequence and determining its slope, calculating a propagation rate of the difference sequence between network nodes, and determining abnormal communication data based on the slope and the propagation rate; Determine the continuous abnormal communication data according to the periodic characteristics of the abnormal communication data and the propagation order in the network nodes, and use reverse time sequence recursive analysis to determine the starting node and propagation path of the continuous abnormal communication data; The method for obtaining the propagation order is as follows: Record the timestamp when each node in the network detects abnormal communication data; According to the timestamp when each node detects abnormal communication data, the nodes are sorted in ascending order of timestamp value; Determine the propagation order of the abnormal communication data in the network nodes according to the sorted node order and the network topology connection relationship between the nodes, and output the determined propagation order; The step of determining the starting node and propagation path of the persistent abnormal communication data includes: According to the propagation order of the continuous abnormal communication data in the network nodes, determining the last node in the propagation order as the initial backtracking node; According to the network topology connection relationship, starting from the initial backtracking node, forwardly determine the previous node that is directly connected to it and is located before the node in the propagation order; Using the determined previous-order node as a new backtracking node, repeating the process of determining the previous-order node, and backtracking in reverse step by step until the first node in the propagation sequence is determined, and determining the node as the starting node of the continuous abnormal communication data; Determine the complete propagation path of the persistent abnormal communication data from the starting node to the initial backtracking node based on the connection relationship between the nodes determined in the above reverse backtracking process, and output the starting node and propagation path of the persistent abnormal communication data; The abnormal data features of the starting node and propagation path of the continuous abnormal communication data are input into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series.

2. A communication dynamic analysis method for virtual network security according to claim 1, characterized in that: The reconstructing communication data based on the joint probability distribution of the transmission interval and the duration includes: Count the occurrence frequencies of packet transmission intervals and interaction durations in the original communication data, and calculate the joint probability of transmission intervals and interaction durations based on the occurrence frequencies; Based on the joint probability, a two-dimensional probability distribution matrix is ​​constructed with the transmission interval as the vertical axis and the interaction duration as the horizontal axis; Determining a valid data region where the probability density is higher than the average probability density based on a probability density variation characteristic of the two-dimensional probability distribution matrix; According to the valid data area, original communication data falling within the valid data area is selected, the communication data is reconstructed and a communication timing sequence is formed.

3. A communication dynamic analysis method for virtual network security according to claim 2, characterized in that: The method of performing multi-scale decomposition on a communication time series and fusing decomposition results of different scales includes: Perform discrete wavelet transform on the communication timing sequence to obtain multi-scale approximate coefficient sequence and detail coefficient sequence; Calculate the variance of each scale detail coefficient sequence respectively, sort them according to the variance and determine the main scale detail coefficient sequence; The determined main scale detail coefficient sequence and the corresponding approximate coefficient sequence are used to perform inverse wavelet transform to reconstruct the time domain component sequences of different scales. According to the reconstructed time domain component sequences of different scales, they are fused into the reference communication timing sequence through weighted superposition.

4. A communication dynamic analysis method for virtual network security according to claim 3, characterized in that: Calculating a first-order difference sequence of the difference sequence and determining its slope includes: Based on the obtained difference sequence, explicitly calculate its first-order difference sequence : ， ； Where: is the difference between adjacent data points in the difference sequence; and is the difference between two consecutive data points in the difference sequence, and the length of the first-order difference sequence is n-1; For the first-order difference series Perform linear regression to calculate its slope. The specific formula for slope calculation is as follows: ； Where: is the slope of the first-order difference sequence, i is the sequence index, , is the arithmetic mean of the first-order difference sequence.

5. A communication dynamic analysis method for virtual network security according to claim 4, characterized in that: The determining of abnormal communication data based on the slope and the propagation rate includes: The preset slope threshold is , under normal circumstances, the data transmission rate threshold is ; The calculated slope and propagation rate , for comparative judgment: When the absolute value of the slope ,and , the corresponding communication data is marked as abnormal communication data; Otherwise, the corresponding communication data is not marked as abnormal communication data.

6. A communication dynamic analysis method for virtual network security according to claim 5, characterized in that: The method for acquiring the periodic characteristics of the abnormal communication data includes: Performing discrete Fourier transform on the data amplitude sequence of the abnormal communication data to obtain the corresponding frequency domain sequence; Specifically, the data amplitude sequence of abnormal communication data is: ;in, represents the difference between the ith abnormal data point and the reference communication sequence; n is the length of the abnormal communication data sequence; Specifically, the calculation formula for discrete Fourier transform of the data amplitude sequence is as follows: ； Where: represents the Fourier transform result of the kth frequency component, that is, the amplitude value of the kth frequency component, is an imaginary unit, and , the sequence length n is the number of sampling points of discrete Fourier transform; Calculating the power spectral density value of each frequency component in the frequency domain sequence and sorting them from high to low according to the value; The power spectrum density value calculation formula is: ； Where: is the power spectrum density corresponding to the kth frequency component, is the conjugate complex number of the kth frequency component, is the amplitude value of the kth frequency component; Determine the frequency component that is at the first position after sorting as the dominant frequency component; Calculating a period length according to a frequency value corresponding to the dominant frequency component, and determining the period length as a period feature of the abnormal communication data; The cycle length calculation formula is: ； Where: Expressed as the cycle length of abnormal communication data, is the frequency value corresponding to the dominant frequency component.

7. A communication dynamic analysis method for virtual network security according to claim 6, characterized in that: The predicted subsequent abnormal nodes in the communication timing sequence include: According to the abnormal data features of the starting node and propagation path of the continuous abnormal communication data, an abnormal feature sequence of abnormal propagation of communication nodes is constructed; The abnormal feature sequence is input into the LSTM neural network model to predict the probability of occurrence of abnormal communication data of each node at the next moment; The nodes whose predicted abnormal occurrence probability exceeds the preset probability threshold are determined as subsequent abnormal nodes, and the determined subsequent abnormal nodes are output.

8. A communication dynamic analysis system for virtual network security, implemented based on the communication dynamic analysis method for virtual network security according to any one of claims 1 to 7, characterized in that: include: An acquisition module is used by the server node to collect the communication node identifiers, data packet transmission intervals, and interaction durations between virtual machines, reconstruct the communication data based on the joint probability distribution of the transmission intervals and durations, and obtain a communication time sequence; The decomposition module is used to perform multi-scale decomposition on the communication timing sequence and fuse the decomposition results of different scales to obtain the benchmark communication timing sequence; an anomaly acquisition module, configured to calculate a difference sequence between a communication timing sequence and a reference communication timing sequence, calculate a first-order difference sequence of the difference sequence and determine its slope, calculate a propagation rate of the difference sequence between network nodes, and determine abnormal communication data based on the slope and propagation rate; An anomaly analysis module, configured to determine persistent abnormal communication data based on the periodic characteristics of the abnormal communication data and its propagation sequence in network nodes, and determine the starting node and propagation path of the persistent abnormal communication data using reverse time sequence recursive analysis; The detection module is used to input the abnormal data features of the starting node and propagation path of the continuous abnormal communication data into the LSTM neural network model to predict subsequent abnormal nodes in the communication time series.

Images