Network security secrecy automatic intelligent processing method, device, equipment and medium

Abstract

The invention relates to the technical field of network security, and provides an automatic intelligent processing method, device, equipment and medium for network security secrecy, and the method achieves the automatic classification of traffic, the automatic execution of anomaly detection and defense, and the automatic generation of IPSec security policy table entries through the construction of a traffic classification model based on deep learning. The IPSec encryption and decryption tunnel of each type of traffic is automatically established according to the traffic classification result and each reachable opposite terminal detected automatically, the security policy manually configured by an administrator is not depended on any more, and automatic execution of'detection-defense-encryption 'is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, equipment and medium for automated intelligent processing of network security and confidentiality. Background Art

[0002] Network security devices protect network data transmission from eavesdropping and tampering, and prevent unauthorized access and malicious attacks. Common firewalls defend against network attacks and intrusions based on predefined rules (such as IP addresses, ports, and protocols). IPSec security gateways query predefined security policies to generate IPSec entries, establish encryption and decryption tunnels, and perform high-strength encryption and verification of IP packets.

[0003] Traditional network security devices rely on manually configured security policies, which categorize network packet handling methods into three categories: open, secret, and discard. Upon receiving a data packet, the device matches the security policy. Packets matching the discard policy are discarded (e.g., for abnormal traffic); packets matching the open policy are passed (e.g., for routing protocols); and packets matching the secret policy are encrypted. Security policies rely primarily on network administrators to manually add and maintain them based on current network conditions and business needs. This results in inefficient and time-sensitive configuration, and pre-configured security defense rules are unable to adapt to the ever-changing network. Summary of the Invention

[0004] In view of the fact that traditional network security equipment relies on administrators to manually configure security policies, which has problems such as low configuration efficiency, poor timeliness, and lack of automation, the present invention provides a network security confidentiality automated intelligent processing method, device, equipment and medium.

[0005] In a first aspect, the present invention provides a method for automated intelligent processing of network security and confidentiality, comprising:

[0006] The peer device joins the network and periodically broadcasts the network joining notification message;

[0007] Update the peer device information database according to the received peer device network access notification message;

[0008] Automatically execute the key exchange protocol for each type of traffic on the detected peer device and add the generated IPSec table entries to the IPSec table entry database;

[0009] Pre-process the received intranet messages and extranet explicit messages;

[0010] The pre-processed packets are sent to the traffic classification model to identify normal packets and abnormal packets;

[0011] Execute abnormal message processing and discard abnormal messages;

[0012] Send normal packets to the traffic N classification model to detect the traffic type to which the normal packets belong;

[0013] If the detected traffic type is clear message, the clear message transparent transmission process is performed;

[0014] If the detected traffic type is non-clear message, the peer device information database is queried, and based on the query result, the security policy encryption table entry is retrieved from the IPSec table database. The message is then encrypted using IPSec according to the retrieved table entry content.

[0015] If an external network encrypted message is received, the security policy decryption table entry is retrieved in the IPSec table database, and IPSec decryption processing is performed on the external network encrypted message according to the retrieved table entry content.

[0016] In some embodiments, the network access notification message includes the peer device ID, IP, and protection subnet.

[0017] In some embodiments, the abnormal message processing includes:

[0018] After identifying abnormal messages, abnormal alarms are issued, such as interface prompts and / or message notifications;

[0019] And / or, perform corresponding abnormal message analysis and classification according to user needs, including identifying the attack source based on the source IP of the abnormal message, identifying the attack target based on the destination IP, classifying the attack based on the message type, and recording the attack-related security situation.

[0020] In some embodiments, the message data preprocessing includes:

[0021] Extract traffic features from all protocol layer data of received messages;

[0022] The extracted traffic features are cleaned by randomization and the cleaned traffic features are converted into a two-dimensional feature matrix;

[0023] Each element in the two-dimensional feature matrix is regarded as a pixel point, and the value of the element is used as the grayscale value of this pixel point, so as to convert the two-dimensional feature matrix into a two-dimensional flow image pixel matrix.

[0024] In some embodiments, the traffic 2 classification model and the traffic N classification model adopt a convolutional neural network (CNN) model.

[0025] In some embodiments, the convolutional neural network (CNN) model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer, wherein multiple convolutional layers and pooling layers are alternated.

[0026] In some embodiments, the specific structure of the convolutional neural network (CNN) model is:

[0027] The input layer inputs a 16*16 two-dimensional flow image pixel matrix, and performs a 0-1 normalization conversion on the input two-dimensional flow image pixel matrix;

[0028] The convolution kernel of the first convolution layer C1 is 8*(5*5), generating eight 16*16 feature matrices, which are then combined with the first pooling layer S2 for a 2*2 maximum pooling operation to generate eight 8*8 feature matrices.

[0029] The convolution kernel of the second convolution layer C3 is 16*(5*5), generating 16 8*8 feature matrices. The 2*2 maximum pooling operation is performed in the second pooling layer S4 to generate 16 4*4 feature matrices.

[0030] The convolution kernel of the fully connected layer F5 is 128*(4*4), which maps 16 4*4 feature matrices into a 128*1 vector;

[0031] The output layer uses a soft-max classifier to output the number of categories.

[0032] In a second aspect, the present invention provides a network security and confidentiality automated intelligent processing device for implementing the aforementioned network security and confidentiality automated intelligent processing method;

[0033] The device comprises:

[0034] The message data preprocessing module is used to preprocess the received intranet messages and extranet explicit messages;

[0035] Traffic 2 classification module, used to send pre-processed packets to the traffic 2 classification model to identify normal packets and abnormal packets;

[0036] Intrusion prevention module, used to perform abnormal message processing and discard abnormal messages;

[0037] Traffic N classification module, used to send normal packets to the traffic N classification model to detect the traffic type to which the normal packets belong;

[0038] An IPSec security policy table entry automatic generation module is used to automatically execute the key exchange protocol for each type of traffic on the detected peer device and add the generated IPSec table entry to the IPSec table entry database;

[0039] The IPSec encryption module is used to query the peer device information database when the detected traffic type is non-clear message, and search the security policy encryption table entry in the IPSec table entry database based on the query result, and perform IPSec encryption processing on the message according to the retrieved table entry content;

[0040] The IPSec decryption module is used to retrieve the security policy decryption table entry in the IPSec table entry database when receiving the external network encrypted message, and perform IPSec decryption processing on the external network encrypted message according to the retrieved table entry content.

[0041] In a third aspect, the present invention provides an electronic device, comprising:

[0042] at least one processor; and a memory communicatively coupled to the at least one processor;

[0043] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the above method by executing the instructions stored in the memory.

[0044] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store instructions, and when the instructions are executed, the above method is implemented.

[0045] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0046] The present invention realizes automatic traffic classification, automatic anomaly detection and defense, and automatic generation of IPSec security policy entries by constructing a traffic classification model based on deep learning. It automatically establishes IPSec encryption and decryption tunnels for each type of traffic based on the traffic classification results and each automatically detected reachable peer. It no longer relies on security policies manually configured by the administrator, and realizes the automatic execution of "detection-defense-encryption". BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flowchart of an automated intelligent processing method for network security and confidentiality provided in an embodiment of the present invention.

[0048] Figure 2 Schematic diagram of the traffic classification model architecture in an embodiment of the present invention.

[0049] Figure 3 This is a schematic diagram of the convolutional neural network (CNN) model structure in an embodiment of the present invention.

[0050] Figure 4 This is a structural diagram of a network security and confidentiality automated intelligent processing device provided in an embodiment of the present invention.

[0051] Figure 5 The figure is a schematic structural diagram of an electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0053] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0054] In recent years, research on neural network-based traffic classification and anomaly detection methods has made significant progress and has been proven to be practical. Deep learning models (such as convolutional neural network (CNN) models and long short-term memory (LSTM) models) can automatically learn the nonlinear relationship between raw traffic and corresponding categories, extracting spatial or temporal features to achieve traffic classification and anomaly detection without human intervention. Based on this, the present invention proposes an automated intelligent processing method for network security and confidentiality, achieving automated execution of the "detection-defense-encryption" process.

[0055] like Figure 1 As shown, an embodiment of the present invention proposes an automated intelligent processing method for network security and confidentiality, including:

[0056] S1: The peer device joins the network and periodically broadcasts a network access notification message;

[0057] S2, updating the peer device information database according to the received peer device network access notification message; the keywords in the peer device information database include the peer device ID, IP, and protection subnet;

[0058] S3 automatically executes the Internet Key Exchange (IKE) protocol for each type of traffic on the detected peer device and adds the generated IPSec entry to the IPSec entry database (keywords include traffic type, peer device ID, SAD, and SPI) for subsequent encryption and decryption processing;

[0059] S4, pre-processing the received intranet message and extranet explicit message;

[0060] S5: Send the pre-processed packets to the traffic classification model 2 to identify normal packets and abnormal packets;

[0061] S6, execute abnormal message processing and discard abnormal messages;

[0062] S7: Send the normal message to the traffic classification model N to detect the traffic type to which the normal message belongs;

[0063] S8, if the detected traffic type is a clear message, perform clear message transparent transmission processing;

[0064] S9, if the detected traffic type is a non-explicit message (such as a business message), extract the destination IP of the message and query the peer device information database to obtain the peer device ID associated with the message, then use the peer device ID and traffic type to retrieve the security policy encryption table entry in the IPSec table database, and perform IPSec encryption processing on the message based on the retrieved table entry content.

[0065] S10: If an external network encrypted message is received, the SPI in the external network encrypted message is extracted and a security policy decryption entry is retrieved from the IPSec entry database, and IPSec decryption processing is performed on the external network encrypted message according to the retrieved entry content.

[0066] The primary purpose of automatically enabling peer device network access in step S1 is to enable communication entities to automatically detect reachable peer device information, automatically establish a peer device information database, and provide services for automatic generation of IPSec security policy entries. To implement this functionality, a network access notification message is designed. This message includes the peer device ID, IP address, and protected subnet. Each communication entity periodically broadcasts this message after network access.

[0067] In the above step S6, the abnormal message processing does not require pre-set security rules and includes two optional aspects:

[0068] (1) After identifying abnormal messages, abnormal alarms are issued, such as interface prompts and / or message notifications;

[0069] (2) Perform corresponding abnormal message analysis and classification according to user needs, such as identifying the attack source based on the source IP of the abnormal message, identifying the attack target based on the destination IP, and classifying the attack based on the message type, and record the attack-related security situation.

[0070] In step S4 above, the message data preprocessing is performed in accordance with the input requirements of the traffic classification model to provide valid input data. Specifically, traffic features are extracted from all protocol layer data of the received message, certain unique information in the extracted traffic features (such as IP address, MAC address, etc.) is randomized to perform traffic cleaning, and the cleaned traffic features are converted into a two-dimensional feature matrix (e.g., a matrix with m rows and n columns can represent m*n features); each element in the two-dimensional feature matrix is regarded as a pixel point, and the value of the element is used as the grayscale value of this pixel point, thereby converting the two-dimensional feature matrix into a two-dimensional traffic image pixel matrix.

[0071] After the packet data preprocessing, the traffic classification problem is converted into an image classification problem. Therefore, in the above steps S5 and S7, the traffic 2 classification model and the traffic N classification model use the convolutional neural network (CNN) model widely used in the field of image classification to implement traffic classification.

[0072] According to the application scenario, the traffic classification model in the embodiment of the present invention will adopt binary classification and multi-classification collaboration. First, the abnormal traffic is identified by binary classification, and then the normal traffic is multi-classified according to the application type. The model architecture is as follows: Figure 2 As shown. The convolutional neural network CNN model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. Multiple convolutional layers and pooling layers can be designed to alternate. The convolutional neural network CNN model used in the embodiment of the present invention is as follows Figure 3 As shown. The input layer inputs a 16*16 two-dimensional flow image pixel matrix, which is normalized from 0 to 1. The convolution kernel of the first convolution layer C1 is 8*(5*5), generating eight 16*16 feature matrices, which are then subjected to a 2*2 maximum pooling operation with the first pooling layer S2 to generate eight 8*8 feature matrices. The convolution kernel of the second convolution layer C3 is 16*(5*5), generating 16 8*8 feature matrices, which are then subjected to a 2*2 maximum pooling operation in the second pooling layer S4 to generate 16 4*4 feature matrices. The convolution kernel of the fully connected layer F5 is 128*(4*4), mapping the 16 4*4 feature matrices into a 128*1 vector. The output layer uses a soft-max classifier to output the number of required classifications (2 or N, corresponding to a 2-class flow model or a N-class flow model). The training data set of the traffic classification model may adopt a public abnormal traffic data set (such as the KDD99 data set, etc.) and / or real traffic collected from the deployment environment.

[0073] From the above, it can be seen that the present invention realizes automatic traffic classification, automatic anomaly detection and defense, and automatic generation of IPSec security policy entries by constructing a traffic classification model based on deep learning. It automatically establishes IPSec encryption and decryption tunnels for each type of traffic with each reachable peer that is automatically detected, and no longer relies on security policies manually configured by the administrator, thus realizing the automatic execution of "detection-defense-encryption".

[0074] Based on the same technical concept, the embodiment of the present invention also provides a network security and confidentiality automatic intelligent processing device for implementing the above network security and confidentiality automatic intelligent processing method, such as Figure 4 As shown, the device includes:

[0075] The message data preprocessing module is used to preprocess the received intranet messages and extranet explicit messages;

[0076] Traffic 2 classification module, used to send pre-processed packets to the traffic 2 classification model to identify normal packets and abnormal packets;

[0077] Intrusion prevention module, used to perform abnormal message processing and discard abnormal messages;

[0078] Traffic N classification module, used to send normal packets to the traffic N classification model to detect the traffic type to which the normal packets belong;

[0079] An IPSec security policy table entry automatic generation module is used to automatically execute the key exchange protocol for each type of traffic on the detected peer device and add the generated IPSec table entry to the IPSec table entry database;

[0080] The IPSec encryption module is used to query the peer device information database when the detected traffic type is non-clear message, and search the security policy encryption table entry in the IPSec table entry database based on the query result, and perform IPSec encryption processing on the message according to the retrieved table entry content;

[0081] The IPSec decryption module is used to retrieve the security policy decryption table entry in the IPSec table entry database when receiving the external network encrypted message, and perform IPSec decryption processing on the external network encrypted message according to the retrieved table entry content.

[0082] The specific working principles of each module in the above device can be referred to the description in the above embodiment method, which will not be repeated here.

[0083] Based on the same technical concept, an embodiment of the present invention also provides an electronic device that can implement the network security and confidentiality automated intelligent processing method provided by the above embodiment of the present invention. In one embodiment, the electronic device can be a server, or a terminal device or other electronic device. Figure 5 As shown, the electronic device may include:

[0084] At least one processor, and a memory connected to the at least one processor. The embodiment of the present invention does not limit the specific connection medium between the processor and the memory. Figure 5 The example in this article is that the processor and memory are connected via a bus. Figure 5 The connections between the other components are shown in bold lines, which are only for illustration and not intended to be limiting. The bus can be divided into address bus, data bus, control bus, etc. Figure 5 The processor is represented by a single thick line, but this does not mean that there is only one bus or only one type of bus. Alternatively, the processor can also be called a controller, without any limitation on the name.

[0085] In an embodiment of the present invention, the memory stores instructions that can be executed by at least one processor. The at least one processor can execute the aforementioned network security and confidentiality automated intelligent processing method by executing the instructions stored in the memory. The processor can implement Figure 5 The functions of each module in the device shown.

[0086] Among them, the processor is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory and calling data stored in the memory, the various functions of the device and processing data.

[0087] In an optional design, the processor may include one or more processing units, and the processor may integrate an application processor and a modem processor, wherein the application processor primarily processes the operating system, user interface, and application programs, and the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip, or in some embodiments, they may be implemented on separate chips.

[0088] The processor can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the automated intelligent processing method for network security and confidentiality disclosed in the embodiments of the present invention can be directly implemented and executed by a hardware processor, or by a combination of hardware and software modules in the processor.

[0089] As a non-volatile computer-readable storage medium, memory can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory can include at least one type of storage medium, for example, can include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), programmable read-only memory (Programmable Read Only Memory, PROM), read-only memory (Read Only Memory, ROM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), magnetic memory, disk, optical disk, etc. Memory is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory in the embodiment of the present invention can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0090] By designing and programming a processor, the code corresponding to the automated intelligent processing method for network security and confidentiality described in the aforementioned embodiment can be embedded in the chip, enabling the chip to execute the steps of the method described in the aforementioned embodiment during operation. Designing and programming a processor is well known to those skilled in the art and will not be further described here.

[0091] Based on the same inventive concept, an embodiment of the present invention further provides a storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer executes an automated intelligent processing method for network security and confidentiality discussed above.

[0092] In some optional embodiments, the present invention also provides various aspects of a method for automated intelligent processing of network security and confidentiality, which can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a method for automated intelligent processing of network security and confidentiality according to various exemplary embodiments of the present invention described above in this specification.

[0093] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to an embodiment of the present invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of a unit described above can be further divided into multiple units to be embodied. In addition, although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, certain steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0094] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0095] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a server, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] Program code for performing the operations of the present invention may be written using any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's device, as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0097] Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0098] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0099] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0100] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A network security and confidentiality automated intelligent processing method, characterized in that: include: The peer device joins the network and periodically broadcasts the network joining notification message; Update the peer device information database according to the received peer device network access notification message; Automatically execute the key exchange protocol for each type of traffic on the detected peer device and add the generated IPSec table entries to the IPSec table entry database; Pre-process the received intranet messages and extranet explicit messages; The pre-processed packets are sent to the traffic classification model to identify normal packets and abnormal packets; Execute abnormal message processing and discard abnormal messages; Send normal packets to the traffic N classification model to detect the traffic type to which the normal packets belong; If the detected traffic type is clear message, the clear message transparent transmission process is performed; If the detected traffic type is non-clear message, the peer device information database is queried, and based on the query result, the security policy encryption table entry is retrieved from the IPSec table database. The message is then encrypted using IPSec according to the retrieved table entry content. If an external network encrypted message is received, the security policy decryption table entry is retrieved in the IPSec table database, and IPSec decryption processing is performed on the external network encrypted message according to the retrieved table entry content.

2. The method for automated intelligent processing of network security and confidentiality according to claim 1, characterized in that: The network access notification message includes the peer device ID, IP, and protection subnet.

3. The method for automated intelligent processing of network security and confidentiality according to claim 1, characterized in that: The abnormal message processing includes: After identifying abnormal messages, abnormal alarms are issued, such as interface prompts and / or message notifications; And / or, perform corresponding abnormal message analysis and classification according to user needs, including identifying the attack source based on the source IP of the abnormal message, identifying the attack target based on the destination IP, classifying the attack based on the message type, and recording the attack-related security situation.

4. The method for automated intelligent processing of network security and confidentiality according to claim 1, characterized in that: The message data preprocessing includes: Extract traffic features from all protocol layer data of received messages; The extracted traffic features are cleaned by randomization and the cleaned traffic features are converted into a two-dimensional feature matrix; Each element in the two-dimensional feature matrix is regarded as a pixel point, and the value of the element is used as the grayscale value of this pixel point, so as to convert the two-dimensional feature matrix into a two-dimensional flow image pixel matrix.

5. The network security and confidentiality automated intelligent processing method according to claim 1 is characterized in that: The traffic 2 classification model and the traffic N classification model adopt a convolutional neural network (CNN) model.

6. The network security and confidentiality automated intelligent processing method according to claim 5, characterized in that: The convolutional neural network (CNN) model consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer, wherein multiple convolutional layers and pooling layers are alternated.

7. The network security and confidentiality automated intelligent processing method according to claim 6, characterized in that: The specific structure of the convolutional neural network CNN model is: The input layer inputs a 16*16 two-dimensional flow image pixel matrix, and performs a 0-1 normalization conversion on the input two-dimensional flow image pixel matrix; The convolution kernel of the first convolution layer C1 is 8*(5*5), generating eight 16*16 feature matrices, which are then combined with the first pooling layer S2 for a 2*2 maximum pooling operation to generate eight 8*8 feature matrices. The convolution kernel of the second convolution layer C3 is 16*(5*5), generating 16 8*8 feature matrices. The 2*2 maximum pooling operation is performed in the second pooling layer S4 to generate 16 4*4 feature matrices. The convolution kernel of the fully connected layer F5 is 128*(4*4), which maps 16 4*4 feature matrices into a 128*1 vector; The output layer uses a soft-max classifier to output the number of categories.

8. A network security and confidentiality automated intelligent processing device, characterized in that: Used to implement the above-mentioned automated intelligent processing method for network security and confidentiality; The device comprises: The message data preprocessing module is used to preprocess the received intranet messages and extranet explicit messages; Traffic 2 classification module, used to send pre-processed packets to the traffic 2 classification model to identify normal packets and abnormal packets; Intrusion prevention module, used to perform abnormal message processing and discard abnormal messages; Traffic N classification module, used to send normal packets to the traffic N classification model to detect the traffic type to which the normal packets belong; An IPSec security policy table entry automatic generation module is used to automatically execute the key exchange protocol for each type of traffic on the detected peer device and add the generated IPSec table entry to the IPSec table entry database; The IPSec encryption module is used to query the peer device information database when the detected traffic type is non-clear message, and search the security policy encryption table entry in the IPSec table entry database based on the query result, and perform IPSec encryption processing on the message according to the retrieved table entry content; The IPSec decryption module is used to retrieve the security policy decryption table entry in the IPSec table entry database when receiving the external network encrypted message, and perform IPSec decryption processing on the external network encrypted message according to the retrieved table entry content.

9. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method according to any one of claims 1 to 7 by executing the instructions stored in the memory.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 7 is implemented.

Images