Network security decision support system construction method based on gray level self-adaption
By building a network security decision support system based on grayscale adaptation, processing network traffic data in real time and updating the decision tree, the problem of traditional methods insufficient identification of unknown threats is solved, and continuous adaptation and efficient protection of new threats are achieved.
Patent Information
- Application Number
- CN202510842176.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-23
- Publication Date
- 2025-08-08
AI Technical Summary
The existing network security threat detection technology has shortcomings in detection coverage and accuracy, especially the ability to identify unknown threats and the high false alarm rate, resulting in insufficiency of network security protection.
Build a network security decision support system based on grayscale adaptation, and convert it into grayscale images by acquiring and preprocessing network traffic data in real time, and identifying fault types using preset models and decision trees, and updating the decision tree when identifying new faults, achieving continuous adaptation to unknown threats.
It improves network security protection efficiency, can quickly identify and respond to new threats, reduce false alarm rates, and improves detection capabilities for unknown attacks and system stability.
Smart Images
Figure CN120455157A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and in particular relates to a method for constructing a network security decision support system based on grayscale self-adaptation. Background Art
[0002] In today's era of explosive digital development, cybersecurity threat detection technology has become a critical core element in safeguarding network security. However, current threat detection technology remains largely focused on expanding scenarios, with detection coverage and accuracy experiencing significant stagnation. This is reflected in high false positive rates, weak detection of unknown threats, and poor data correlation and interpretability. Existing technologies largely rely on fixed rules and blacklisting mechanisms, resulting in low flexibility and difficulty accurately assessing the threat nature of complex, intermediate grayscale behaviors. Improper rule design can also directly lead to false positives. False positives not only increase workload but can also lead to overlooking or missing real threats, significantly compromising network security efficiency.
[0003] With the continuous evolution of network technology, the methods used by attackers are becoming increasingly complex and varied, and new unknown attack methods are emerging in an endless stream. Traditional detection methods are mainly based on feature recognition of known attack patterns. For some unknown attack methods, attack media, and attack ideas that have never appeared before, their detection capabilities are obviously insufficient, resulting in low efficiency of network security protection. Summary of the Invention
[0004] The purpose of the present invention is to solve the problem of low efficiency of network security protection and propose a method for constructing a network security decision support system based on grayscale adaptation.
[0005] The present invention proposes a method for constructing a network security decision support system based on grayscale self-adaptation, the method comprising:
[0006] Acquire original network traffic data in real time, and pre-process the original network traffic data to obtain initial traffic data;
[0007] The target grayscale image is obtained by processing the initial flow data through mapping rules;
[0008] Substituting the target grayscale image into a preset model to obtain target features;
[0009] Substituting the target feature into a preset decision tree to determine the target fault type;
[0010] If the target fault type is a new fault type, the preset decision tree is updated according to the target fault type, and a network security decision support system is obtained according to the updated preset decision tree.
[0011] Optionally, the original network traffic data includes multiple data packets, and preprocessing the original network traffic data to obtain initial traffic data includes:
[0012] Obtaining the IP address and port number corresponding to the target data packet, and searching a preset database according to the IP address and the port number; the target data packet is any data packet in the original network traffic data;
[0013] If the IP address and the port number do not exist in the preset database, the target data packet is recorded as a data packet to be detected;
[0014] Obtain all data packets to be detected to obtain initial traffic data.
[0015] Optionally, processing the initial flow data through a mapping rule to obtain a target grayscale image includes:
[0016] For each data packet in the initial traffic data, determining the traffic size of the data packet;
[0017] If the data packet flow is greater than or equal to the preset data volume, intercepting the data packet flow according to the preset data volume to obtain the target data;
[0018] If the data packet flow is less than the preset data volume, the target remaining data is padded with zeros to obtain the target data; the target remaining data is the flow data difference between the preset data volume and the data packet flow;
[0019] The target data is read into an unsigned integer vector to obtain a target vector, two-dimensional data is constructed according to all the target vectors, and the two-dimensional data is converted into a grayscale image to obtain a target grayscale image.
[0020] Optionally, substituting the target grayscale image into a preset model to obtain target features includes:
[0021] Substituting the target grayscale image into a preset convolution model to obtain a first feature;
[0022] Performing one-dimensional flattening on the first feature to obtain a second feature, and substituting the second feature into a long short-term memory layer to obtain a second feature;
[0023] Substituting the second feature into the fully connected layer, the target feature is obtained.
[0024] Optionally, substituting the target grayscale image into a preset convolution model to obtain the first feature includes:
[0025] Performing a 3×3 convolution operation on the target grayscale image to obtain a first convolution feature, and substituting the first convolution feature into a pooling module to obtain a first pooling feature;
[0026] Performing a 3×3 convolution operation on the first pooled feature to obtain a second convolution feature, and substituting the second convolution feature into the pooling module to obtain a second pooled feature;
[0027] Performing a 3×3 convolution operation on the second pooled feature to obtain a third convolution feature, and substituting the third convolution feature into the pooling module to obtain a third pooled feature;
[0028] The first pooling feature, the second pooling feature, and the third pooling feature are fused to obtain a first feature.
[0029] Optionally, the working principle of the pooling module includes:
[0030] Perform average pooling and maximum pooling on the input features to obtain average features and pooling features;
[0031] Substituting the average feature and the pooled feature into a multilayer perceptron to obtain an average weight and a pooled weight;
[0032] The average feature and the pooling feature are weightedly fused according to the average weight and the pooling weight to obtain an output feature.
[0033] Optionally, a preset decision tree is built including:
[0034] Step 1: Obtain the target features corresponding to the abnormal traffic data in the historical data to obtain the abnormal traffic feature set;
[0035] Step 2: By formula Calculating the total information entropy corresponding to the abnormal traffic feature set;
[0036] in, is the total information entropy, is the probability that the feature belongs to category i, and D is the abnormal traffic feature set;
[0037] Step 3: For each abnormal traffic feature A in the abnormal traffic feature set, divide the abnormal traffic feature set into v subsets {D1, D2, ..., Dv} according to preset values;
[0038] Step 4: By formula The information gain rate is obtained, where is the information gain rate of abnormal traffic feature A, is the total information entropy, is the information entropy corresponding to the subset where the abnormal traffic feature A is located, is the jth subset;
[0039] Step 5: For all the information gain rates corresponding to the abnormal traffic features, obtain the abnormal traffic feature with the largest information gain rate as the splitting attribute of the current node;
[0040] Step 6: Based on the information entropy value of each subset, a query tree is established for all subsets by pre-order sorting;
[0041] Step 7: For each leaf node in the query tree, sort the abnormal traffic features in the subset corresponding to the child node by pre-order sorting according to the information gain rate; sort all abnormal traffic features to obtain a preset decision tree; each node of the preset decision tree and the corresponding abnormal traffic feature in each node correspond to the processing plan.
[0042] Optionally, if the target fault type is a new fault type, updating the preset decision tree according to the target fault type includes:
[0043] Searching for an optimal node in the decision tree according to the target feature, and obtaining a subset of the optimal node as an optimal subset;
[0044] Adding the target feature to the optimal subset, and calculating the updated information entropy of the optimal subset after the addition;
[0045] If the difference between the updated information entropy and the original information entropy of the optimal subset exceeds a preset value, the target feature is added as a leaf node to the decision tree to update the decision tree.
[0046] Beneficial effects of the present invention:
[0047] The present invention proposes a method for constructing a network security decision support system based on grayscale adaptation. The method obtains raw network traffic data in real time, pre-processes the raw network traffic data to obtain initial traffic data, processes the initial traffic data through mapping rules to obtain a target grayscale image, substitutes the target grayscale image into a preset model to obtain target features, substitutes the target features into a preset decision tree to determine the target fault type, and if the target fault type is a new fault type, updates the preset decision tree according to the target fault type, and obtains a network security decision support system based on the updated preset decision tree. The network traffic is converted into a two-dimensional image, retaining the temporal and spatial features of the traffic. The target features are then determined in combination with the preset model, thereby finding the fault type and determining the decision plan. This avoids the defect of traditional methods that cannot identify unknown attacks, achieves continuous adaptation to new threats, and improves the efficiency of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS
[0048] The present invention will be further described below with reference to the accompanying drawings.
[0049] Figure 1 The present invention provides a flowchart of a method for constructing a network security decision support system based on grayscale adaptation.
[0050] Figure 2A flowchart of another method for constructing a network security decision support system based on grayscale adaptation provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0051] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.
[0052] Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative work shall fall within the scope of protection of the present invention.
[0053] The embodiment of the present invention provides a method for constructing a network security decision support system based on grayscale adaptation. Figure 1 , Figure 1 A flowchart of a method for constructing a network security decision support system based on grayscale adaptation is provided in an embodiment of the present invention. The method includes the following steps:
[0054] S101, obtaining original network traffic data in real time, and preprocessing the original network traffic data to obtain initial traffic data;
[0055] S102, processing the initial flow data using a mapping rule to obtain a target grayscale image;
[0056] S103, substituting the target grayscale image into a preset model to obtain target features;
[0057] S104, substituting the target feature into a preset decision tree to determine the target fault type;
[0058] S105: If the target fault type is a new fault type, the preset decision tree is updated according to the target fault type, and a network security decision support system is obtained according to the updated preset decision tree.
[0059] A grayscale adaptive network security decision support system construction method provided in an embodiment of the present invention converts network traffic into a two-dimensional image, retaining the temporal and spatial characteristics of the traffic. The target characteristics are then determined in combination with a preset model, thereby finding the fault type and determining a decision plan. This avoids the defect of traditional methods that cannot identify unknown attacks, achieves continuous adaptation to new threats, and improves the efficiency of network security protection.
[0060] In one implementation, preprocessing of raw network traffic data can filter out redundant information and interfering data, avoid the impact of outliers on subsequent analysis, ensure the integrity and reliability of initial traffic data, and lay a high-quality data foundation for subsequent analysis.
[0061] In one implementation, traffic data is converted into grayscale images through mapping rules. Abstract network traffic features (such as packet size, frequency, protocol type, etc.) can be converted into visual image features (such as pixel grayscale value, texture, shape, etc.), thereby mining hidden patterns and associations in traffic data, improving the expressiveness of features, and facilitating the model to capture complex network behavior characteristics.
[0062] In one implementation, a grayscale image is substituted into a preset model to automatically extract multi-level, abstract network traffic features from the image. Compared with traditional manual feature extraction methods, this method can more comprehensively and deeply capture subtle differences in traffic data, improve the efficiency and accuracy of feature extraction, and is particularly suitable for processing large-scale, high-dimensional network traffic data.
[0063] In one implementation, the target fault type is divided into a new fault type, an old fault type, and a non-fault type; after obtaining the target feature, the similarity between the feature corresponding to each fault and the target feature in the preset decision tree is traversed; if the similarity between all features and the target feature is less than the preset first similarity, then the target fault type is a non-fault type; if there is a feature whose similarity with the target feature is greater than the second similarity, then the target fault type is regarded as the old fault type, and the processing solution of the feature corresponding to the old fault type is used as the decision solution; the specific values of the preset first similarity and the second similarity are determined by technical personnel.
[0064] In one implementation, a preset decision tree is used to classify target features, which can quickly and accurately determine the type of network fault. The hierarchical structure of the decision tree is clear and easy to understand, making it easy to explain the basis for fault classification. If a new fault type is identified, the system can automatically update the decision tree based on the type, and continuously expand the fault knowledge base through incremental learning, so that the model's ability to identify new network security threats continues to improve, avoiding the omission of new faults due to model solidification.
[0065] In one embodiment, see Figure 2 , Figure 2 A flowchart of another grayscale adaptive network security decision support system construction method is provided, including:
[0066] S1011, obtaining the IP address and port number corresponding to the target data packet, and searching a preset database according to the IP address and port number;
[0067] S1012, if the IP address and port number record corresponding data does not exist in the preset database, the target data packet is recorded as a data packet to be detected;
[0068] S1013: Acquire all data packets to be detected to obtain initial traffic data.
[0069] The target data packet is any data packet in the original network traffic data;
[0070] In one implementation, a preset database stores abnormal traffic data that has occurred and corresponding processing solutions, and marks the data corresponding to the IP address and port number; for abnormal traffic data that has occurred, a processing decision solution corresponding to the abnormal traffic data is determined.
[0071] In one implementation, the records in the preset database are usually based on historical data or known security policies, so it is possible to avoid misjudging normal but unrecorded traffic as abnormal, improving the accuracy of detection. By pre-filtering known normal traffic, subsequent analysis only needs to be performed on the data packets to be detected, thereby significantly reducing the amount of data that needs to be processed and improving detection efficiency.
[0072] In one embodiment, processing the initial flow data using a mapping rule to obtain a target grayscale image includes:
[0073] For each data packet in the initial traffic data, determine the traffic size of the data packet;
[0074] If the data packet flow is greater than or equal to the preset data volume, the data packet flow is intercepted according to the preset data volume to obtain the target data;
[0075] If the data packet flow is less than the preset data volume, the target remaining data is padded with zeros to obtain the target data; the target remaining data is the flow data difference between the preset data volume and the data packet flow;
[0076] The target data is read into an unsigned integer vector to obtain a target vector, two-dimensional data is constructed according to all the target vectors, and the two-dimensional data is converted into a grayscale image to obtain a target grayscale image.
[0077] In one implementation, the preset data size is determined by a technician; by truncating or zero-padding the packet traffic based on the preset data size, each packet is ensured to be processed as target data of the same length. This helps ensure consistency in subsequent processing and analysis, avoiding complications and errors caused by inconsistent data lengths. By truncating or zero-padding the packet traffic based on the preset data size, each packet is ensured to be processed as target data of the same length. This helps ensure consistency in subsequent processing and analysis, avoiding complications and errors caused by inconsistent data lengths.
[0078] In one implementation, the processed target data is converted into grayscale images, making the previously abstract network traffic data intuitive and visual. This helps security analysts quickly identify traffic patterns, abnormal behavior, or potential threats. Grayscale images provide richer information, helping analysts make more accurate decisions.
[0079] In one implementation, the pixel values in a grayscale image can be viewed as a characteristic representation of packet traffic. Image processing techniques can be used to extract more meaningful features for subsequent classification or anomaly detection. Grayscale images are an ideal input format for deep learning models (such as convolutional neural networks (CNNs)). By converting network traffic data into grayscale images, the powerful learning capabilities of deep learning models can be fully utilized, improving detection accuracy and efficiency.
[0080] In one embodiment, substituting the target grayscale image into a preset model to obtain target features includes:
[0081] Substitute the target grayscale image into the preset convolution model to obtain the first feature;
[0082] Flatten the first feature in one dimension to obtain the second feature, and substitute the second feature into the long short-term memory layer to obtain the second feature;
[0083] Substitute the second feature into the fully connected layer to obtain the target feature.
[0084] In one implementation, the long short-term memory network is a special recurrent neural network that excels at processing sequential data. In network traffic analysis, data packets often have time series characteristics. LSTM can capture this temporal dependency, perform sequence modeling on the first feature, and generate a second feature that is more time-relevant. LSTM can process input sequences of different lengths, which is particularly important for network traffic data because the traffic size and content of different data packets may vary.
[0085] In one implementation, the fully connected layer integrates and classifies the second features output by the LSTM layer. Through the weight matrix and bias term of the fully connected layer, the second features can be linearly transformed and nonlinearly activated to generate the final target features.
[0086] In one embodiment, substituting the target grayscale image into a preset convolution model to obtain the first feature includes:
[0087] Perform a 3×3 convolution operation on the target grayscale image to obtain the first convolution feature, and substitute the first convolution feature into the pooling module to obtain the first pooling feature;
[0088] Perform a 3×3 convolution operation on the first pooled feature to obtain a second convolution feature, and substitute the second convolution feature into the pooling module to obtain a second pooled feature;
[0089] Perform a 3×3 convolution operation on the second pooled feature to obtain a third convolution feature, and substitute the third convolution feature into the pooling module to obtain the third pooled feature;
[0090] The first pooling feature, the second pooling feature and the third pooling feature are fused to obtain the first feature.
[0091] In one implementation, three 3×3 convolution operations are performed to generate the first, second, and third convolution features, respectively. Each convolution operation extracts feature information at a different scale, with shallow convolutions capturing local details and deep convolutions capturing more abstract global features.
[0092] In one implementation, a pooling module is connected after each convolution operation to reduce the dimension and compress the feature map. The pooling operation reduces the size and computational complexity of the feature map while retaining the most important feature information.
[0093] In one implementation, the first, second, and third pooled features are fused to obtain the first feature. This fusion approach combines feature information from different levels, making the final feature representation more comprehensive. By normalizing the first, second, and third pooled features to the same scale as the target grayscale image before performing feature fusion, the fused features have stronger expressive power and can better reflect the complex patterns and relationships in the original image.
[0094] In one embodiment, the pooling module works as follows:
[0095] Perform average pooling and maximum pooling on the input features to obtain average features and pooling features;
[0096] Substitute the average features and pooled features into the multilayer perceptron to obtain the average weight and pooled weight;
[0097] The average feature and the pooling feature are weightedly fused according to the average weight and the pooling weight to obtain the output feature.
[0098] In one implementation, by calculating the average value of each area on the feature map, the information of the entire area is retained, and the background information is better captured, which is suitable for extracting global features; by selecting the maximum value of each area on the feature map, the significant features in the area are retained, and it is more sensitive to detailed information such as texture and edges, which is suitable for extracting local features. By using average pooling and maximum pooling at the same time, features can be extracted from different perspectives, making the feature representation more comprehensive and diverse.
[0099] In one implementation, MLP, as a neural network, automatically learns the complex relationship between input features and output. Through training, MLP can assign adaptive weights to average and pooled features. Average pooling has a certain smoothing effect on noise, while maximum pooling can highlight significant features and reduce noise interference. Weighted fusion can further reduce the impact of noise on model performance. The fused output features contain rich global and local information, as well as adaptive weighting, which can better support subsequent classification.
[0100] In one embodiment, the preset decision tree construction includes:
[0101] Step 1: Obtain the target features corresponding to the abnormal traffic data in the historical data to obtain the abnormal traffic feature set;
[0102] Step 2: By formula Calculate the total information entropy corresponding to the abnormal traffic feature set;
[0103] in, is the total information entropy, is the probability that the feature belongs to category i, and D is the abnormal traffic feature set;
[0104] Step 3: For each abnormal traffic feature A in the abnormal traffic feature set, divide the abnormal traffic feature set into v subsets {D1, D2, ..., Dv} according to the preset value;
[0105] Step 4: By formula The information gain rate is obtained, where is the information gain rate of abnormal traffic feature A, is the total information entropy, is the information entropy corresponding to the subset where the abnormal traffic feature A is located, is the jth subset;
[0106] Step 5: For all the information gain rates corresponding to the abnormal traffic features, obtain the abnormal traffic feature with the largest information gain rate as the splitting attribute of the current node;
[0107] Step 6: Based on the information entropy value of each subset, a query tree is established for all subsets by pre-order sorting;
[0108] Step 7: For each leaf node in the query tree, sort the abnormal traffic features in the subset corresponding to the child node by pre-order sorting according to the information gain rate; sort all abnormal traffic features to obtain a preset decision tree; preset a processing plan for each node of the decision tree and the corresponding abnormal traffic features in each node.
[0109] In one implementation, preset values are determined by technical personnel. By obtaining the target features corresponding to abnormal traffic data in historical data, an abnormal traffic feature set is constructed, providing rich abnormal traffic information for subsequent analysis. Information entropy and information gain rate are used to evaluate the contribution of features to classification, which can accurately identify the most critical features for abnormal traffic classification and improve classification accuracy.
[0110] In one implementation, the information gain ratio of each abnormal traffic feature is calculated and the feature with the highest information gain ratio is selected as the splitting attribute for the current node, ensuring efficient construction of the decision tree. This method can quickly find the optimal split point, reduce the depth and complexity of the decision tree, partition the abnormal traffic feature set, and build a query tree based on the information entropy values of the subsets, further optimizing the decision tree structure and improving query efficiency.
[0111] In one implementation, for each leaf node in the query tree, the abnormal traffic characteristics are sorted according to the information gain rate, and corresponding processing plans are formulated for each node and the abnormal traffic characteristics within the node, so that the decision tree can flexibly respond to different types of abnormal traffic and provide targeted processing measures.
[0112] In one implementation, a preset decision tree can quickly identify and classify abnormal traffic, allowing the system to respond quickly and take appropriate measures, such as blocking connections and issuing alarms, thereby improving system security. Through accurate feature recognition and classification, the decision tree can reduce the false alarm rate, avoid misjudging normal traffic as abnormal traffic, and improve system stability and reliability.
[0113] In one embodiment, if the target fault type is a new fault type, updating the preset decision tree according to the target fault type includes:
[0114] Find the optimal node in the decision tree according to the target feature, and obtain the subset of the optimal node as the optimal subset;
[0115] Add the target feature to the optimal subset and calculate the updated information entropy of the optimal subset after adding;
[0116] If the difference between the updated information entropy and the original information entropy of the optimal subset exceeds the preset value, the target feature is added as a leaf node to the decision tree to update the decision tree.
[0117] In one implementation, this method dynamically adapts to emerging traffic characteristics by finding the optimal node in the decision tree based on the target feature and adding the target feature to the corresponding optimal subset. This allows the decision tree to be continuously updated as data changes, maintaining its timeliness and accuracy. In a network environment, new abnormal traffic patterns may emerge at any time. By dynamically updating the decision tree, the system can promptly detect and respond to these unknown threats, thereby improving system security.
[0118] In one implementation, the method evaluates the impact of the target feature on the decision tree's performance by calculating the updated information entropy of the optimal subset after adding the target feature and comparing it with the original information entropy. If the difference between the updated and original information entropies exceeds a preset value, it indicates that the target feature significantly improves the classification performance of the decision tree. Therefore, the target feature is added as a leaf node to the decision tree. By comparing information entropies, this method avoids adding redundant or irrelevant features to the decision tree, thereby maintaining the simplicity and efficiency of the decision tree.
[0119] The above is a detailed description of an embodiment of the present invention. However, the content is only a preferred embodiment of the present invention and should not be considered to limit the scope of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.
Claims
1. A method for constructing a network security decision support system based on grayscale adaptation, characterized in that: The method comprises: Acquire original network traffic data in real time, and pre-process the original network traffic data to obtain initial traffic data; The target grayscale image is obtained by processing the initial flow data through mapping rules; Substituting the target grayscale image into a preset model to obtain target features; Substituting the target feature into a preset decision tree to determine the target fault type; If the target fault type is a new fault type, the preset decision tree is updated according to the target fault type, and a network security decision support system is obtained according to the updated preset decision tree.
2. The method for constructing a network security decision support system based on grayscale adaptation according to claim 1, characterized in that: The original network traffic data includes multiple data packets, and the initial traffic data obtained by preprocessing the original network traffic data includes: Obtaining the IP address and port number corresponding to the target data packet, and searching a preset database according to the IP address and the port number; the target data packet is any data packet in the original network traffic data; If the IP address and the port number do not exist in the preset database, the target data packet is recorded as a data packet to be detected; Obtain all data packets to be detected to obtain initial traffic data.
3. The method for constructing a network security decision support system based on grayscale adaptation according to claim 2 is characterized in that: The target grayscale image is obtained by processing the initial traffic data through mapping rules, including: For each data packet in the initial traffic data, determining the traffic size of the data packet; If the data packet flow is greater than or equal to the preset data volume, intercepting the data packet flow according to the preset data volume to obtain the target data; If the data packet flow is less than the preset data volume, the target remaining data is padded with zeros to obtain the target data; the target remaining data is the flow data difference between the preset data volume and the data packet flow; The target data is read into an unsigned integer vector to obtain a target vector, two-dimensional data is constructed according to all the target vectors, and the two-dimensional data is converted into a grayscale image to obtain a target grayscale image.
4. The method for constructing a network security decision support system based on grayscale adaptation according to claim 1, characterized in that: Substituting the target grayscale image into the preset model to obtain target features includes: Substituting the target grayscale image into a preset convolution model to obtain a first feature; Performing one-dimensional flattening on the first feature to obtain a second feature, and substituting the second feature into a long short-term memory layer to obtain a second feature; Substituting the second feature into the fully connected layer, the target feature is obtained.
5. The method for constructing a network security decision support system based on grayscale adaptation according to claim 4 is characterized in that: Substituting the target grayscale image into a preset convolution model to obtain the first feature includes: Performing a 3×3 convolution operation on the target grayscale image to obtain a first convolution feature, and substituting the first convolution feature into a pooling module to obtain a first pooling feature; Performing a 3×3 convolution operation on the first pooled feature to obtain a second convolution feature, and substituting the second convolution feature into the pooling module to obtain a second pooled feature; Performing a 3×3 convolution operation on the second pooled feature to obtain a third convolution feature, and substituting the third convolution feature into the pooling module to obtain a third pooled feature; The first pooling feature, the second pooling feature, and the third pooling feature are fused to obtain a first feature.
6. The method for constructing a network security decision support system based on grayscale adaptation according to claim 5, characterized in that: The working principle of the pooling module includes: Perform average pooling and maximum pooling on the input features to obtain average features and pooling features; Substituting the average feature and the pooled feature into a multilayer perceptron to obtain an average weight and a pooled weight; The average feature and the pooling feature are weightedly fused according to the average weight and the pooling weight to obtain an output feature.
7. The method for constructing a network security decision support system based on grayscale adaptation according to claim 1 is characterized in that: The preset decision tree construction includes: Step 1: Obtain the target features corresponding to the abnormal traffic data in the historical data to obtain the abnormal traffic feature set; Step 2: By formula Calculating the total information entropy corresponding to the abnormal traffic feature set; in, is the total information entropy, is the probability that the feature belongs to category i, and D is the abnormal traffic feature set; Step 3: For each abnormal traffic feature A in the abnormal traffic feature set, divide the abnormal traffic feature set into v subsets {D1, D2, ..., Dv} according to preset values; Step 4: By formula The information gain rate is obtained, where is the information gain rate of abnormal traffic feature A, is the total information entropy, is the information entropy corresponding to the subset where the abnormal traffic feature A is located, is the jth subset; Step 5: For all the information gain rates corresponding to the abnormal traffic features, obtain the abnormal traffic feature with the largest information gain rate as the splitting attribute of the current node; Step 6: Based on the information entropy value of each subset, a query tree is established for all subsets by pre-order sorting; Step 7: For each leaf node in the query tree, sort the abnormal traffic features in the subset corresponding to the child node by pre-order sorting according to the information gain rate; sort all abnormal traffic features to obtain a preset decision tree; each node of the preset decision tree and the corresponding abnormal traffic feature in each node correspond to the processing plan.
8. The method for constructing a network security decision support system based on grayscale adaptation according to claim 1, characterized in that: If the target fault type is a new fault type, updating the preset decision tree according to the target fault type includes: Searching for an optimal node in the decision tree according to the target feature, and obtaining a subset of the optimal node as an optimal subset; Adding the target feature to the optimal subset, and calculating the updated information entropy of the optimal subset after the addition; If the difference between the updated information entropy and the original information entropy of the optimal subset exceeds a preset value, the target feature is added as a leaf node to the decision tree to update the decision tree.