Network attack risk studying and judging system and method thereof
Through the network attack risk analysis system, deep learning and One-class SVM model are used to automatically extract network messages and user behavior characteristics, solving the problem of high cost of relying on manual feature engineering and labeling in the existing technology, and achieving fully automated risk assessment and comprehensiveness.
Patent Information
- Application Number
- CN202510744230.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-05
- Publication Date
- 2025-08-12
AI Technical Summary
The existing network security risk analysis methods rely on manual feature engineering and require professional engineers to conduct specific limited analysis. Since the traditional method is based on supervised learning, a large number of samples are required, resulting in incomplete model deviation and risk assessment.
The network attack risk analysis system is adopted, including a data information extraction module, a data feature fusion processing module and a risk analysis analysis module. The network packets and user behavior characteristics are extracted through deep learning, and the One-class SVM model is used to unsupervised learning to calculate the risk score.
It realizes fully automated feature extraction and risk analysis, reduces the cost of manual intervention and labeling, enhances feature extraction capabilities, and ensures the adequacy of data sources and the comprehensiveness of risk evaluation.
Smart Images
Figure CN120474805A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and more specifically, to a network attack risk assessment system and method. Background Art
[0002] With the rapid development of the Internet and the Internet of Things (IoT), cybersecurity threats are becoming increasingly complex and diverse. To enhance cybersecurity management and control capabilities, various security technologies and approaches must complement each other and leverage their respective strengths to improve cybersecurity threat detection and defense capabilities.
[0003] At present, based on the traditional network security risk assessment method, since the traditional method relies more on manual feature engineering, professional engineers are required to perform specific limited analysis. In addition, since the traditional method is based on supervised learning, a large number of labeled samples are required, and the proportion of abnormal samples is extremely small, resulting in model bias. Moreover, only part of the network data is used, making it difficult to comprehensively assess the risk. As a result, the traditional method has certain limitations.
[0004] Therefore, in view of this, the existing structure is studied and improved, and a network attack risk assessment system and method thereof are provided, in order to achieve a more practical purpose. Summary of the Invention
[0005] 1. Technical problems to be solved
[0006] In response to the problems existing in the prior art, the purpose of the present invention is to provide a network attack risk assessment system and method, which can reduce the manual intervention process, avoid excessive reliance on manual feature engineering, reduce annotation costs, reduce model deviation, further enhance feature extraction capabilities, ensure sufficient data sources, and ensure the comprehensiveness of risk assessment.
[0007] 2. Technical solution
[0008] To solve the above problems, the present invention adopts the following technical solutions.
[0009] A network attack risk assessment system, comprising a data information extraction module, a data feature fusion processing module, and a risk assessment and analysis module;
[0010] The data information extraction module extracts features from network messages and user behavior features to obtain message features V d and user behavior characteristics V u ;
[0011] The data feature fusion processing module combines the message feature V d and user behavior characteristics V u Perform the connection and combine it with the deep network fusion to obtain the joint feature vector V;
[0012] The risk assessment and analysis module uses a one-class SVM model to train normal sample features and calculates the distance between the test sample and the center of the hypersphere as the risk score. Access exceeding the threshold γ is considered an abnormal access.
[0013] Furthermore, in the data information extraction module, characteristic information of the network message is extracted, specifically:
[0014] The message data X in the T time window m ∈R T×f It is regarded as sequence data, where f represents the original feature data representing the content of the data packet, such as the original data, communication frequency, and data protocol hot encoding representation;
[0015] Divide into N segments along the time dimension to form a three-dimensional tensor X s =∈R N×t×f
[0016] Use a two-dimensional convolutional neural network to extract high-density feature vector V d .
[0017] Furthermore, in the data information extraction module, feature information of the data feature fusion processing module is extracted, specifically:
[0018] Extract statistical features X from access logs u ∈R k ;
[0019] Use a fully connected neural network to extract the user behavior feature vector V u .
[0020] A network attack risk assessment method, the specific implementation steps of the assessment method are as follows:
[0021] Step 1: Data preprocessing: A deep learning model based on automatic message data automatically obtains the characteristics of the current access, and automatically extracts user behavior feature profiles based on log access. The preprocessing is then completed by normalizing the message feature data, segmenting the data along the time dimension, and performing user behavior feature statistics.
[0022] Step 2: Model training: Based on the preprocessed data features, the message feature extraction network and the user feature extraction network are trained separately. Then, the feature fusion network is trained and the parameters of the one-class SVM hypersphere are optimized to obtain the judgment model.
[0023] Step 3: Apply the model and output risk assessment results: extract message features and user behavior features in real time, calculate the risk score, compare it with the threshold, and output the risk assessment results.
[0024] Furthermore, in step 1, the data volume based on the network access data characteristics includes:
[0025] The number a consisting of every 8 bits of binary in the data segment of a data frame satisfies 0≤a<256;
[0026] For each frame, the first 1500 bytes of the data segment are taken, any bytes less than 1500 are filled with 0, and any bytes exceeding 1500 are truncated. The average of the values is taken as the data feature of the frame.
[0027] Discrete values such as communication mode and communication frequency are represented by discrete values 0, 1, ..., and the transmission amount is represented by a digital representation.
[0028] Furthermore, in step 1, the original characteristic data X of the data packet is d The time axis is evenly divided into N segments, and the features of each segment are recombined into the original data feature tensor data. The formula is:
[0029] X s =concat(X m [0:t],Xd[t+1:2t],…,X m [(N-1)*t,T])∈R N×t×f
[0030] in, Indicates the length of each segmentation, and concat(.) indicates the connection operation along the new dimension;
[0031] For the original data packet X s Tensor based 2D convolution deep network feature extraction, the formula is: v d =f θ (X s )∈R d
[0032] Among them, f θ Represents a deep learning network based on 2D convolution, θ represents its parameters, v d The feature vector representing the data packet data finally obtained by the operation;
[0033] Through the network access log file, the user access profile statistical features are obtained, which mainly include monthly visits, daily visits, average monthly visit duration, average daily visit duration, recent visits and recent visit duration, etc., indicating that X u ∈R k .
[0034] Furthermore, in step 2, the original data features and the user behavior profile features are integrated to express v = g θ (v m ,v u ), where gθ Represents a deep fusion network model.
[0035] Furthermore, in step 3, the fused features are fed into a one-class SVM unsupervised trainable model. This model compresses the data without abnormalities into a hypersphere as small as possible without adding data labels. Its optimization objective function is expressed as:
[0036]
[0037] Assume that the parameters of the generated hypersphere are the center o and the corresponding hypersphere radius r>0. The volume of the hypersphere V(r) is minimized. The center o is a linear combination of the support rows. It is required that the distance from all training data points v to the center is strictly less than r. At the same time, a slack variable ξi with a penalty coefficient C is constructed.
[0038] Then, the data message to be predicted is extracted to obtain the feature vector v, which is then converted into the feature vector v by the formula ||vv o || Calculate its distance from the center o of the hypersphere. If it is greater than the tolerable threshold γ, the message is considered to have an abnormal risk.
[0039] 3. Beneficial effects
[0040] Compared with the prior art, the advantages of the present invention are:
[0041] ① This solution extracts features from network messages and user behaviors, and then completes risk assessment based on feature fusion. The feature extraction, feature fusion, and risk assessment processes are all fully automated, reducing manual intervention and saving significant manual workload. It avoids over-reliance on manual feature engineering and eliminates the need for specialized engineers to perform specific, limited analysis.
[0042] ② This solution extracts the tensor data features of the original data message before data fusion, and then fuses the multi-source data. The entire process is unsupervised learning, which can reduce the labeling cost, ensure that there are sufficient abnormal samples in the labeled samples, and reduce model bias;
[0043] ③ This solution introduces the time dimension during data preprocessing, segments the original features of the data message, and recombines each feature segment into the original data feature tensor data, which can further enhance the feature extraction capability, ensure the adequacy of the data source, and ensure the comprehensiveness of risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] Figure 1 This is a system diagram of the network attack risk assessment system of the present invention;
[0045] Figure 2A flow chart of a network attack risk assessment method and device based on network message analysis and user behavior profiling for implementing training examples in the present invention;
[0046] Figure 3 It is a schematic diagram of extracting features from raw data of network access data packets provided by the implementation example training example of the present invention;
[0047] Figure 4 It is a schematic diagram of the network access feature and user profile feature fusion model provided by the implementation example training example of the present invention;
[0048] Figure 5 This is a schematic diagram of an example of a calculation method for a One-class SVM model provided by a training example in the present invention;
[0049] Figure 6 This is a schematic diagram of an example test of a network security risk model provided by an implementation example test in the present invention. DETAILED DESCRIPTION
[0050] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention; it is obvious that the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0051] Example 1:
[0052] See also Figure 1 ,A network attack risk assessment system ,The network attack risk assessment system includes a data information extraction module, a data feature fusion processing module, and a risk assessment and analysis module;
[0053] The data information extraction module extracts features from network messages and user behavior features to obtain message features V d and user behavior characteristics V u ;
[0054] The data feature fusion processing module combines the message feature V d and user behavior characteristics V u Perform the connection and combine it with the deep network fusion to obtain the joint feature vector V;
[0055] The risk assessment and analysis module uses a one-class SVM model to train normal sample features and calculates the distance between the test sample and the center of the hypersphere as the risk score. Access exceeding the threshold γ is considered an abnormal access.
[0056] The data feature information is processed in sequence using the data information extraction module, data feature fusion processing module, and risk assessment and analysis module to complete the network attack risk assessment work and ensure the accuracy of the assessment work.
[0057] Specifically, in the data information extraction module, characteristic information of network messages is extracted, specifically:
[0058] The message data X in the T time window m ∈R T×f It is regarded as sequence data, where f represents the original feature data representing the content of the data packet, such as the original data, communication frequency, and data protocol hot encoding representation;
[0059] Divide into N segments along the time dimension to form a three-dimensional tensor X s =∈R N×t×f
[0060] Use a two-dimensional convolutional neural network to extract high-density feature vector V d .
[0061] Specifically, in the data information extraction module, feature information of the data feature fusion processing module is extracted, specifically:
[0062] Extract statistical features X from access logs u ∈R k ;
[0063] Use a fully connected neural network to extract the user behavior feature vector V u .
[0064] Example 2:
[0065] Based on the above embodiment 1, further description is given.
[0066] See also Figure 2 、 Figure 3 、 Figure 4 、 Figure 5 、 Figure 6 A network attack risk assessment method, the specific implementation steps of the assessment method are as follows:
[0067] Step 1: Data preprocessing: A deep learning model based on automatic message data automatically obtains the characteristics of the current access, and automatically extracts user behavior feature profiles based on log access. The preprocessing is then completed by normalizing the message feature data, segmenting the data along the time dimension, and performing user behavior feature statistics.
[0068] Specifically, the data volume based on network access data characteristics includes:
[0069] The number a consisting of every 8 bits of binary in the data segment of a data frame satisfies 0≤a<256;
[0070] For each frame, the first 1500 bytes of the data segment are taken, any bytes less than 1500 are filled with 0, and any bytes exceeding 1500 are truncated. The average of the values is taken as the data feature of the frame.
[0071] Discrete values such as communication mode and communication frequency are represented by discrete values 0, 1, ..., and the transmission amount is represented by a digital representation.
[0072] The message tensor is split into a 3D tensor along the time dimension.
[0073] Specifically, the original feature data X of the data packet d The time axis is evenly divided into N segments, and the features of each segment are recombined into the original data feature tensor data. The formula is:
[0074] X s =concat(X m [0:t],X d [t+1:2t],…,X m [(N-1)*t,T])∈R N×t×f
[0075] in, Indicates the length of each segmentation, and concat(.) indicates the connection operation along the new dimension;
[0076] For the original data packet X s Tensor based 2D convolution deep network feature extraction, the formula is: v d =f θ (X s )∈R d
[0077] Among them, f θ Represents a deep learning network based on 2D convolution, θ represents its parameters, v d The feature vector representing the data packet data finally obtained by the operation;
[0078] Through the network access log file, the user access profile statistical features are obtained, which mainly include monthly visits, daily visits, average monthly visit duration, average daily visit duration, recent visits and recent visit duration, etc., indicating that X u ∈R k .
[0079] Step 2: Model training: Based on the preprocessed data features, the message feature extraction network and the user feature extraction network are trained separately. Then, the feature fusion network is trained and the parameters of the one-class SVM hypersphere are optimized to obtain the judgment model.
[0080] Specifically, the original data features and user behavior profile features are integrated to express v = g θ (v m ,v u ), where g θ Represents a deep fusion network model.
[0081] Step 3: Apply the model and output risk assessment results: extract message features and user behavior features in real time, calculate the risk score, compare it with the threshold, and output the risk assessment results.
[0082] Specifically, the fused features are fed into a one-class SVM unsupervised trainable model, which compresses the data without abnormalities into a small hypersphere without adding data labels. The optimization objective function is expressed as:
[0083]
[0084] Assume that the parameters of the generated hypersphere are the center o and the corresponding hypersphere radius r>0, the hypersphere volume V(r) is minimized, the center o is a linear combination of the support rows, and the distance from all training data points v to the center is strictly less than r. At the same time, a slack variable ξ with a penalty coefficient C is constructed. i ;
[0085] Then, the data message to be predicted is extracted to obtain the feature vector v, which is then converted into the feature vector v by the formula ||vv o || Calculate its distance from the center o of the hypersphere. If it is greater than the tolerable threshold γ, the message is considered to have an abnormal risk.
[0086] Example 3
[0087] Based on Example 2, further description is given
[0088] See Figure 2 、 Figure 3 、 Figure 4 、 Figure 5 、 Figure 6 Specifically, each segment feature is recombined into the original data feature tensor data value to represent X s ∈R N×t×f As an example, the tensor:
[0089]
[0090] The feature tensor X s Input multi-layer 2DConv (two-dimensional convolution) network model.
[0091] In order to automatically obtain high-density network data feature vectors, considering the continuity of the time dimension t and the proximity of the segmentation dimension N, a two-dimensional convolution operation is used to perform convolution along these two dimensions, fuse the information of these two dimensions, and use a network model composed of multi-layer convolution operations to extract its features. Finally, a fully connected operation is used to output a low-dimensional and high-density feature vector. The mathematical formula of its calculation process is as follows:
[0092] v d =f θ (X s )=FC(σ(2DConv((σ(2DConv(X s ))))∈R d ,
[0093] in, represents the activation function, and FC(x)=wx+b represents a fully connected neural network.
[0094] Extract user behavior profile features through access logs.
[0095] Since network attacks can usually be seen through the access behavior of model users, it is necessary to model user behavior portrait features and automatically integrate them into the entire feature vector.
[0096] Based on this, we extract user behavior information such as monthly visits, daily visits, average monthly visit duration, average daily visit duration, recent visits, and recent visit duration from the network access log as user profile feature X. u ∈R k , where k represents the type of behavioral features.
[0097] In order to obtain high-order and high-density behavioral portrait features, the behavioral feature data X u Input into the deep network model and automatically extract features. Considering the behavioral feature data X u In the k-dimensional disorder, we exemplarily choose a multi-layer fully connected neural network for feature extraction. The specific operation is expressed by the following formula:
[0098] v u =f θ (X s )=FC(σ(FC(σ(FC(X u ))))∈R d .
[0099] Feature v d and v u Input into the feature fusion deep network model.
[0100] Users need to assess the security of their network access by referring to both their network access data and their daily access behavior.
[0101] Based on this, the two types of information are fused to obtain the final discriminative features. The fusion process can optionally connect the two features at the feature level and input the connection vector into a multi-layer deep network for automatic feature extraction. The process can be referred to Figure 3 , mathematically described as:
[0102] v=FC(σ(FC(σ(FC(concat(v d ,v u ))))))∈R d .
[0103] The features are input into One-Class SVM to generate training loss.
[0104] The above description is merely a preferred embodiment of the present invention; however, the scope of protection of the present invention is not limited thereto. Any person skilled in the art who, within the technical scope disclosed by the present invention, makes equivalent substitutions or modifications based on the technical solutions and improved concepts of the present invention shall be covered by the scope of protection of the present invention.
Claims
1. A network attack risk assessment system, characterized by: The network attack risk assessment system includes a data information extraction module, a data feature fusion processing module, and a risk assessment and analysis module; The data information extraction module extracts features from network messages and user behavior features to obtain message features V d and user behavior characteristics V u ; The data feature fusion processing module combines the message feature V d and user behavior characteristics V u Perform the connection and combine it with the deep network fusion to obtain the joint feature vector V; The risk assessment and analysis module uses a one-class SVM model to train normal sample features and calculates the distance between the test sample and the center of the hypersphere as the risk score. Access exceeding the threshold γ is considered an abnormal access.
2. A network attack risk assessment system according to claim 1, characterized in that: In the data information extraction module, the characteristic information of the network message is extracted, specifically: The message data X in the T time window m ∈R T×f It is regarded as sequence data, where f represents the original feature data representing the content of the data packet, such as the original data, communication frequency, and data protocol hot encoding representation; Divide into N segments along the time dimension to form a three-dimensional tensor X s =∈R N×t×f Use a two-dimensional convolutional neural network to extract high-density feature vector V d .
3. A network attack risk assessment system according to claim 1, characterized in that: In the data information extraction module, feature information of the data feature fusion processing module is extracted, specifically: Extract statistical features X from access logs u ∈R k ; Use a fully connected neural network to extract the user behavior feature vector V u .
4. A network attack risk assessment method according to any one or more of claims 1 to 3, characterized in that: The specific implementation steps of this research and judgment method are as follows: Step 1: Data preprocessing: A deep learning model based on automatic message data automatically obtains the characteristics of the current access, and automatically extracts user behavior feature profiles based on log access. The preprocessing is then completed by normalizing the message feature data, segmenting the data along the time dimension, and performing user behavior feature statistics. Step 2: Model training: Based on the preprocessed data features, the message feature extraction network and the user feature extraction network are trained separately. Then, the feature fusion network is trained and the parameters of the one-class SVM hypersphere are optimized to obtain the judgment model. Step 3: Apply the model and output risk assessment results: extract message features and user behavior features in real time, calculate the risk score, compare it with the threshold, and output the risk assessment results.
5. A network attack risk assessment method according to claim 4, characterized in that: In step 1, the data volume based on the network access data characteristics includes: The number a consisting of every 8 bits of binary in the data segment of a data frame satisfies 0≤a<256; For each frame, the first 1500 bytes of the data segment are taken, any bytes less than 1500 are filled with 0, and any bytes exceeding 1500 are truncated. The average of the values is taken as the data feature of the frame. Discrete values such as communication mode and communication frequency are represented by discrete values 0, 1, ..., and the transmission amount is represented by a digital representation.
6. A network attack risk assessment method according to claim 4, characterized in that: In the step 1, the original characteristic data X of the data message is d The time axis is evenly divided into N segments, and the features of each segment are recombined into the original data feature tensor data. The formula is: X s =concat(X m [0:t],X d [t+1:2t],…,X m [(N-1)*t,T])∈R N×t×f in, Indicates the length of each segmentation, and concat(.) indicates the connection operation along the new dimension; For the original data packet X s Tensor based 2D convolution deep network feature extraction, the formula is: v d =f θ (X s )∈R d Among them, f θ Represents a deep learning network based on 2D convolution, θ represents its parameters, v d The feature vector representing the data packet data finally obtained by the operation; Through the network access log file, the user access profile statistical features are obtained, which mainly include monthly visits, daily visits, average monthly visit duration, average daily visit duration, recent visits and recent visit duration, etc., indicating that X u ∈R k .
7. A network attack risk assessment method according to claim 4, characterized in that: In step 2, the original data features and the user behavior profile features are integrated to represent v=g θ (v m ,v u ), where g θ Represents a deep fusion network model.
8. A network attack risk assessment method according to claim 4, characterized in that: In step 3, the fused features are fed into a one-class SVM unsupervised trainable model. This model compresses the data without abnormalities into a small hypersphere without adding data labels. The optimization objective function is expressed as: ||v i -o||2≤r+ξ i ,i=1,2,3…m x i ≥0,i=1,2,…m Assume that the parameters of the generated hypersphere are the center o and the corresponding hypersphere radius r>0, the hypersphere volume V(r) is minimized, the center o is a linear combination of the supported , and the distance from all training data points v to the center is required to be strictly less than r. At the same time, a slack variable ξ with a penalty coefficient C is constructed. i ; Then, the data message to be predicted is extracted to obtain the feature vector v, which is then converted into the feature vector v by the formula ||vv o || Calculate its distance from the center o of the hypersphere. If it is greater than the tolerable threshold γ, the message is considered to have an abnormal risk.