An intelligent network security threat detection method based on big data analysis

Abstract

The application relates to the technical field of network security, and discloses a network security threat intelligent detection method based on big data analysis, which comprises the following steps: collecting network equipment flow log data, constructing a network behavior space-time fusion matrix, and calling the optimal threat detection algorithm; through an innovatively designed dynamic feature dimension alignment mechanism, the tensor structure mismatch problem caused by the difference between asset static data and network flow data sampling frequency in a traditional scheme is overcome; an adaptive tensor interpolation technology is used to realize the mapping of dynamic and static logs in the space-time dimension, reduce systematic deviation during feature fusion, and improve the accuracy of subsequent threat analysis; through the established network behavior space-time fusion matrix, asset service topology, vulnerability fingerprints and real-time flow behavior are three-dimensionally associated and modeled for the first time, the behavior chain characteristics of an attacker in the process of horizontal movement and privilege escalation are described, and the attack path restoration capability for advanced sustainable threats is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security threat intelligent detection method based on big data analysis. BACKGROUND

[0002] Network security refers to the protection of the hardware, software and data in the system from being damaged, altered or leaked due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system and uninterrupted network service.

[0003] However, the prior art has the following problems:

[0004] 1. Single-dimensional log analysis defects;

[0005] 2. Dynamic and static data fragmentation;

[0006] 3. Algorithm selection solidification.

[0007] Therefore, the present application provides a network security threat intelligent detection method based on big data analysis, which solves the above problems by collecting network device flow log data, constructing a network behavior space-time fusion matrix and calling the optimal threat detection algorithm. SUMMARY

[0008] (I) Technical problems solved

[0009] In view of the deficiencies of the prior art, the present application provides a network security threat intelligent detection method based on big data analysis, which solves the problems raised in the background art.

[0010] (II) Technical solutions

[0011] To achieve the above purpose, the present application provides the following technical solutions: a network security threat intelligent detection method based on big data analysis, the method comprising the following steps:

[0012] S1, collecting network device dynamic flow log data and asset static baseline log data;

[0013] S2, performing feature sampling dimension measurement processing on the dynamic flow log data and static baseline log data to generate dynamic flow feature dimension data and static baseline feature dimension data;

[0014] S3, judging the feature dimension alignment based on the dynamic flow feature dimension data and the static baseline feature dimension data to generate feature dimension alignment identification data; if the dimensions are consistent, execute S5;

[0015] S4, if the dimensions are inconsistent, adjust the feature dimension of the static baseline log data using a tensor interpolation algorithm to generate static baseline feature adjustment data;

[0016] S5, the dynamic flow log data is adjusted with static baseline log data and static baseline feature adjustment data, feature fusion is carried out based on timestamp, and network behavior space-time fusion matrix is constructed;

[0017] S6, the network behavior space-time fusion matrix is matched with the standard threat feature matrix corresponding to the pre-stored multi-class threat detection algorithm, and the optimal threat detection algorithm type is screened through bionic optimization algorithm;

[0018] S7, calling the optimal threat detection algorithm to analyze the network behavior space-time fusion matrix, and generating real-time threat map and disposal instruction.

[0019] Preferably, the S1 comprises:

[0020] S11, five tuple flow data packets of network equipment in running state are collected through distributed probe, session connection frequency, load entropy value and protocol distribution vector are extracted, and dynamic flow log data Q is generated;

[0021] S12, asset port baseline, service dependency topology and vulnerability fingerprint vector are extracted through configuration management database, and static baseline log data R is generated.

[0022] Preferably, the S2 comprises:

[0023] S21, multi-scale sliding window is adopted to carry out time slicing processing on Q, sampling interval standard deviation of each time window feature is calculated, and dynamic flow feature dimension data is generated .

[0024] S22, topological feature analysis is carried out on R, dimension parameters of asset service chain are extracted, and static baseline feature dimension data is generated.

[0025] Preferably, the S3 comprises:

[0026] S31, the Euclidean distance between is calculated , wherein is dynamic flow feature dimension data, is static baseline feature dimension data;

[0027] S32, if , feature dimension alignment identification data is generated and S5 is executed, wherein is a preset dimension alignment threshold;

[0028] otherwise is generated.

[0029] Preferably, the S4 comprises:

[0030] S41, when , the feature tensor of static baseline is constructed , the high-order interpolation is performed in the dimension of

[0031]

[0032] wherein, is a tensor interpolation function, is an interpolation target dimension;

[0033] generate static baseline feature adjustment data .

[0034] Preferably, the S5 comprises:

[0035] S51, aligning with and in the time axis, constructing a three-dimensional fusion matrix:

[0036]

[0037] wherein, is a network behavior space-time fusion matrix, is a dynamic traffic data packet feature, is a static service dependency topology feature, is a dynamic load entropy value feature, is a static vulnerability fingerprint feature, represents a tensor splicing operation.

[0038] Preferably, the S6 comprises:

[0039] S61, establishing a threat detection algorithm feature library , represents a standard threat feature matrix corresponding to the algorithm;

[0040] S62, calculating the matching degree of and by improving the peregrine algorithm:

[0041] initialize the peregrine population position:

[0042]

[0043] wherein is a feature dimension, is the position of the i-th individual in the d-dimensional space in the peregrine population, is the lower boundary of the search space,​ for search space upper bound, is a random number in [0,1];

[0044] Exploration phase update position:

[0045]

[0046] wherein, is the current optimal solution, is the attack strength constant, is a random number in [0,1];

[0047] Development phase: refined search wherein is the current algorithm iteration number;

[0048] S63, output the optimal matching algorithm type identifier .

[0049] Preferably, the fish eagle algorithm further comprises:

[0050] Introducing adaptive weight Control search step size;

[0051] wherein, is the information entropy value of the space-time fusion matrix is the maximum entropy value of the system; Define fitness function:

[0052]

[0053]

[0054] wherein, is the cosine similarity calculation, is the Frobenius norm of matrix and

[0055] When the iteration number , start the elite reservation mechanism to replace the last 20% individuals.

[0056] Preferably, the S7 comprises:

[0057] S71, input to the corresponding detection engine, execute threat pattern matching:

[0058]

[0059] wherein is a threat feature pattern library;

[0060] ​​​S72. Generate a threat map containing attack paths and risk levels. .

[0061] Preferably, the threat pattern matching process employs a multi-level confidence verification mechanism, including:

[0062] Primary verification layer: Generates a candidate threat set through regular expression matching using a pre-built threat rule base.

[0063]

[0064] in For rule matching threshold, For threat signature pattern library, For rule matching scoring function;

[0065] Intermediate verification layer: Perform behavioral chain analysis on the candidate threat set and calculate contextual relevance.

[0066]

[0067] in Let be the time decay function. As an indicator of the continuity of the behavior chain, For the completeness of the behavioral chain, This represents the total length of the behavior chain;

[0068] Advanced verification layer: for Threat adversarial sample testing was performed, and robustness was verified through perturbation injection:

[0069]

[0070] in, To add perturbation The subsequent similarity calculation This is the original threat assessment result. For the size of the threat pattern library;

[0071] Only when Output the final threat assessment at that time.

[0072] (III) Beneficial Effects

[0073] Compared with existing technologies, this invention provides an intelligent detection method for network security threats based on big data analysis, which has the following beneficial effects:

[0074] 1. Address the core shortcomings of multi-source log fusion.

[0075] Through the innovative design of dynamic feature dimension alignment mechanism, the tensor structure mismatch problem caused by the difference in sampling frequency between static asset data and network traffic data in traditional solutions is overcome. Adaptive tensor interpolation technology is used to realize the mapping of dynamic and static logs in the time and space dimensions, reduce systematic bias during feature fusion, and improve the accuracy of subsequent threat analysis.

[0076] 2. Enhance the perception of complex threats

[0077] Through the established network behavior spatio-temporal fusion matrix, the asset service topology, vulnerability fingerprint, and real-time traffic behavior are first associated and modeled in three dimensions. This matrix breaks through the limitations of traditional single-dimensional log analysis, characterizes the behavior chain characteristics of attackers during horizontal movement and privilege escalation, and improves the attack path restoration ability of advanced persistent threats. It is particularly effective in detecting long-latency and behavior-dispersed targeted attacks.

[0078] 3. Realize the dynamic optimization of detection algorithm

[0079] By constructing an intelligent algorithm decision engine, the bionic optimization algorithm matches the best detection model in real time, changing the traditional scheme that relies on fixed algorithms. Based on network behavior characteristics, the detection strategy is dynamically selected, which not only guarantees efficient identification of known threats, but also enhances the adaptability to new attacks, effectively addressing the attack challenges of massive variant threats.

[0080] 4. Optimize the reliability of the whole chain verification

[0081] Through the innovative multi-level confidence verification mechanism, from basic rule matching, behavior chain continuity analysis to adversarial robustness testing, it filters layer by layer, reduces the false positive rate, and ensures the rigor of threat determination conclusions. This mechanism particularly enhances the identification ability of carefully disguised evasive attacks, solving the logical vulnerabilities in the threat verification link of traditional solutions.

[0082] 5. Improve the real-time response performance of the system

[0083] Through the architecture design of online feature fusion and stream processing, the redundant data preprocessing link in traditional solutions is reduced. Based on parallel tensor computation and optimized algorithm convergence strategy, efficient processing is realized from data acquisition to instruction generation, meeting the stringent demand of critical infrastructure for threat response timeliness.

[0084] 6. Reduce the complexity of defense system deployment

[0085] Through the integrated technical solution, the organic integration of dynamic and static defense elements is realized, reducing the compatibility risks brought by the separate deployment of independent systems for log collection, asset scanning, and traffic analysis. The standardized data interface design between system modules reduces the integration difficulty with existing security devices, and promotes the smooth evolution of the defense system towards intelligence.

[0086] 7. Technical resilience in adversarial environment

[0087] Through the introduced disturbance robustness test mechanism, the stability of the detection conclusion is verified by actively injecting noise samples, the mechanism identifies the model deception behavior implemented by the attacker through subtle features tampering, so that the system maintains stable detection performance in the adversarial attack scene, and fills the technical blind area of the current mainstream scheme. BRIEF DESCRIPTION OF DRAWINGS

[0088] Figure 1 It is a schematic diagram of the overall method framework of the application. DETAILED DESCRIPTION

[0089] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0090] Please refer to Figure 1 The network security threat intelligent detection method based on big data analysis comprises the following steps:

[0091] S1, collecting network equipment dynamic traffic log data and asset static baseline log data;

[0092] S2, performing feature sampling dimension measurement processing on the dynamic traffic log data and static baseline log data to generate dynamic traffic feature dimension data and static baseline feature dimension data;

[0093] S3, performing feature dimension alignment judgment based on the dynamic traffic feature dimension data and the static baseline feature dimension data to generate feature dimension alignment identification data; if the dimensions are consistent, S5 is performed;

[0094] S4, if the dimensions are inconsistent, performing feature dimension adjustment on the static baseline log data by using a tensor interpolation algorithm to generate static baseline feature adjustment data;

[0095] S5, performing feature fusion on the dynamic traffic log data, the static baseline log data and the static baseline feature adjustment data based on a timestamp to construct a network behavior space-time fusion matrix;

[0096] S6, matching the network behavior space-time fusion matrix with a standard threat feature matrix corresponding to a plurality of threat detection algorithms stored in advance, and selecting an optimal threat detection algorithm type by using a bionic optimization algorithm;

[0097] S7, calling the optimal threat detection algorithm to perform threat analysis on the network behavior space-time fusion matrix, and generating a real-time threat map and disposal instructions;

[0098] S1 includes:

[0099] S11, collecting five-tuple flow data packets of network devices in a running state through a distributed probe, extracting session connection frequency, payload entropy value, and protocol distribution vector, and generating dynamic flow log data Q;

[0100] S12, extracting asset port baseline, service dependency topology, and vulnerability fingerprint vector through a configuration management database, and generating static baseline log data R;

[0101] S2 includes:

[0102] S21, performing time slicing processing on Q by using a multi-scale sliding window, calculating the sampling interval standard deviation of each time window feature, and generating dynamic flow feature dimension data ;

[0103] S22, performing topology feature analysis on R, extracting dimension parameters of asset service chain, and generating static baseline feature dimension data ;

[0104] S3 includes:

[0105] S31, calculating the Euclidean distance between , wherein is the dynamic flow feature dimension data, is the static baseline feature dimension data;

[0106] S32, if , generating feature dimension alignment identification data and performing S5, wherein is a preset dimension alignment threshold;

[0107] otherwise, generating ;

[0108] S4 includes:

[0109] S41, when , constructing a feature tensor of the static baseline, and performing high-order interpolation according to the dimension :

[0110]

[0111] wherein is a tensor interpolation function, is an interpolation target dimension;​

[0112] Generating static baseline feature adjustment data ;

[0113] S5 includes:

[0114] S51, the and and are aligned in time axis, and a three-dimensional fusion matrix is constructed:

[0115]

[0116] wherein, is a network behavior space-time fusion matrix, is a dynamic flow data packet feature, is a static service dependency topology feature, is a dynamic load entropy value feature, is a static vulnerability fingerprint feature, denotes a tensor splicing operation;

[0117] S6 includes:

[0118] S61, a threat detection algorithm feature library is established , denotes a standard threat feature matrix corresponding to the algorithm;

[0119] S62, the matching degree of and is calculated by improving the fish-eagle algorithm:

[0120] Initialize the fish-eagle population position:

[0121]

[0122] wherein is a feature dimension, is the position of the i-th individual in the fish-eagle population in a d-dimensional space, is the lower boundary of the search space, is the upper boundary of the search space, is a random number in the interval [0,1];

[0123] Update the position in the exploration stage:

[0124]

[0125] wherein, is the current optimal solution, is an attack intensity constant, is a random number in the interval [0,1];

[0126] Development stage: refined search wherein is the current number of algorithm iterations;

[0127] S63, output the optimal matching algorithm type identifier ;

[0128] The fish eagle algorithm also includes:

[0129] Introducing adaptive weights Control the search step size;

[0130] wherein, is the information entropy value of the space-time fusion matrix , is the maximum entropy value of the system;

[0131] Define fitness function:

[0132]

[0133] wherein, is the cosine similarity calculation, is the matrix and Frobenius norm of

[0134] When the number of iterations , start the elite reservation mechanism to replace the last 20% individuals;

[0135] S7 includes:

[0136] S71, input to the corresponding detection engine, execute threat pattern matching:

[0137]

[0138] wherein is the threat feature pattern library;

[0139] S72, generate a threat map containing attack paths and risk levels ;

[0140] The threat pattern matching process adopts a multi-level confidence verification mechanism, including:

[0141] Primary verification layer: regular matching is performed through the pre-constructed threat rule library to generate a candidate threat set:

[0142]

[0143] wherein is the rule matching threshold, is the threat feature pattern library,​ For rule matching scoring function;

[0144] Intermediate verification layer: Perform behavioral chain analysis on the candidate threat set and calculate contextual relevance.

[0145]

[0146] in It is a time decay function. As an indicator of the continuity of the behavior chain, For the completeness of the behavioral chain, This represents the total length of the behavior chain;

[0147] Advanced verification layer: for Threat adversarial sample testing was performed, and robustness was verified through perturbation injection:

[0148]

[0149] in, To add perturbation The subsequent similarity calculation This is the original threat assessment result. For the size of the threat pattern library;

[0150] Only when Output the final threat assessment at that time.

[0151] Example 1: Actual Deployment Scenario of Financial Data Center

[0152] Step 1: Multi-source log collection and feature extraction

[0153] A distributed probe cluster deployed in the core switching area captures east-west traffic in real time and extracts dynamic traffic logs at 5-second intervals. This is being implemented in practice.

[0154] By parsing the quintuple information from the VXLAN encapsulated traffic and calculating the session connection frequency, and analyzing the load characteristics using the Shannon entropy formula, it was discovered that the load entropy value of a certain Kafka producer suddenly dropped to 0.3. Simultaneously, by retrieving static asset data from the CMDB, it was confirmed that the server corresponding to this IP address had opened unnecessary API ports and had an unpatched Log4j vulnerability.

[0155] Step 2: Feature Dimension Alignment and Fusion

[0156] When the dynamic traffic log sampling interval conflicts with the static scan period in terms of dimensions:

[0157] The Euclidean distance between the protocol distribution vector of the dynamic flow and the static baseline is 32.7, and the third-order tensor interpolation is started: the 19-dimensional topology features of the static baseline service are interpolated based on the dynamic flow time axis to generate dimensionally adjusted data, and a spatio-temporal fusion matrix is constructed at the 9:15:03 timestamp to associate the abnormal connection frequency in the dynamic flow with the static vulnerability fingerprint.

[0158] Step 3: Detection algorithm dynamic matching

[0159] The algorithm decision engine executes the fish eagle optimization algorithm:

[0160] Initialize 30 algorithm agents, in the exploration stage: calculate the cosine similarity of the current space-time matrix, the GNN algorithm becomes the current optimal solution with a matching degree of 0.92, in the development stage: refine the search parameters within the GNN neighborhood, adjust the node aggregation function to GraphSAGE, and improve the recognition accuracy of horizontal movement attack paths, output the final algorithm type identifier G_alg="GNN_GraphSAGE_V3".

[0161] Step 4: Threat judgment and response

[0162] Call the selected detection model to perform multi-level verification:

[0163] Primary verification: match CobaltStrike attack features with a confidence of 85%, intermediate verification: analyze the continuity of the behavior chain: 9:12:17 external scan of 8085 port, 9:14:53 exploit Log4j vulnerability to plant Webshell, 9:15:01 initiate horizontal movement, behavior chain integrity ρ=0.89, advanced verification: after injecting Gaussian noise, the attack path recognition result remains stable, generate threat graph containing: attack path: [external IP]→[vulnerability server]→[database cluster], risk level: serious, real-time trigger handling instructions: isolate infected servers, block ASN network segment of malicious IP.

[0164] Step 5: System dynamic tuning

[0165] In continuous operation:

[0166] When a DNS stealth tunnel attack is detected, the feature entropy value exceeds the trigger algorithm reselection mechanism, the adaptive weight ω is adjusted from 0.6 to 0.78, enhancing the sensitivity to payload features, and the threat rule library is incrementally updated with CNAME camouflage attack features.

[0167] Example 2: Defense against ransomware attacks in a commercial bank data center

[0168] Step 1: Dynamic and static log cooperative collection

[0169] The security probe cluster captures abnormal encrypted traffic on the core switch mirror port, triggering a multi-source collection mechanism:

[0170] Dynamic traffic layer: Real-time analysis of SSL handshake protocol, 17 internal IP addresses initiate TLS1.3 connections to the same external domain name within 180 seconds, each session lasts 8.2 seconds and the payload length is constant at 512KB, and the payload entropy value is constantly below 0.45;

[0171] Static asset layer: Linkage CMDB extracts target server group asset image, confirms that 12 of them are database nodes, there is an unpatched SMBv3 vulnerability, and the vulnerability fingerprint matches the exploitation characteristics of the Conti ransomware with a matching degree of 91%.

[0172] Step 2: Dynamic calibration of feature dimensions

[0173] When the dynamic traffic sampling interval and asset scanning period conflict in dimensions:

[0174] Calculate the protocol distribution vector offset: The proportion of SMB protocol in dynamic traffic suddenly increases to 63%, and the Euclidean distance value reaches 41.6;

[0175] Perform tensor interpolation reconstruction: Perform cubic B-spline interpolation on the 25-dimensional features of the static asset topology according to the dynamic time window to generate feature adjustment data with matched time resolution;

[0176] Construct a spatiotemporal threat matrix: At timestamp 11:27:45.023, associate the encrypted connection mode in dynamic traffic with the exploit characteristics in three dimensions to form a 32x32x16 behavior tensor.

[0177] Step 3: Optimal detection algorithm matching

[0178] Algorithm decision engine runs improved fish eagle optimization process:

[0179] Initialize population: 50 algorithm agents, exploration phase: calculate the cosine similarity between the current behavior tensor and the standard threat matrix library, knowledge graph algorithm temporarily ranks first with a matching degree of 0.89, development phase: adjust the relationship extraction depth to three levels within the knowledge graph neighborhood, identify abnormal encrypted propagation paths between database nodes, and output the algorithm identifier: KG_DeepLink_V2.

[0180] Step 4: Multi-level threat verification

[0181] Start a three-level confidence verification chain:

[0182] Rule matching layer: Hit ransomware behavior rule RL0723, original confidence 83%;

[0183] Behavior chain analysis layer: 11:25:11 exploits the SMBv3 vulnerability to break through the border firewall, 11:26:29 moves laterally to the database cluster, 11:27:32 starts encrypting system files, and the behavior chain completeness p = 0.92; Anti-robustness test layer: inject protocol confusion noise, inject load disturbance, attack path identification result remains unchanged, and robustness score reaches 0.93.

[0184] Step 5: Response treatment and evolution

[0185] Generate a deep threat map and perform blocking:

[0186] Attack path: [Overseas C2]→[border server]→[database cluster]→[backup storage], risk label: serious level, real-time treatment action: automatically isolate 12 infected nodes, block malicious domain name resolution, and start backup verification mechanism;

[0187] System dynamic optimization: when a new vulnerability exploit is detected, the adaptive weight ω increases from 0.7 to 0.85, and the incremental learning module captures new features of encrypted traffic.

[0188] It should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

[0189] Although embodiments of the present application have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions and alterations can be made thereto without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for intelligent detection of cybersecurity threats based on big data analysis, characterized in that: The method includes the following steps: S1. Collect dynamic traffic log data of network devices and static baseline log data of assets; S2. Perform feature sampling dimension measurement processing on the dynamic traffic log data and static baseline log data to generate dynamic traffic feature dimension data and static baseline feature dimension data. S3. Based on the dynamic traffic feature dimension data and the static baseline feature dimension data, determine the feature dimension alignment and generate feature dimension alignment identifier data; if the dimensions are consistent, proceed to S5. S4. If the dimensions are inconsistent, the static baseline log data is adjusted using a tensor interpolation algorithm to generate static baseline feature-adjusted data. S5. Combine the dynamic traffic log data with the static baseline log data and the static baseline feature adjustment data, and perform feature fusion based on the timestamp to construct a network behavior spatiotemporal fusion matrix. S5 includes: S51, will and and Construct a 3D fusion matrix aligned with the timeline: Where Q represents dynamic traffic log data. This is static baseline log data. Adjust the data for static baseline characteristics. For network behavior spatiotemporal fusion matrix, Characteristics of dynamic traffic data packets Static services depend on topological features. The characteristic of dynamic load entropy value, This is a static vulnerability fingerprint characteristic. This indicates a tensor concatenation operation; S6. Match the network behavior spatiotemporal fusion matrix with the standard threat feature matrix corresponding to the pre-stored multi-type threat detection algorithms, and select the optimal threat detection algorithm type through a biomimetic optimization algorithm; S7. Call the optimal threat detection algorithm to perform threat analysis on the network behavior spatiotemporal fusion matrix, and generate a real-time threat map and handling instructions; S71, will enter The corresponding detection engine performs threat pattern matching: in, This serves as an identifier for the optimal matching algorithm type. For threat signature pattern library, These are feature vectors from the threat feature pattern library; S72. Generate a threat map containing attack paths and risk levels. ; The threat pattern matching process employs a multi-level confidence verification mechanism, including: Primary verification layer: Generates a candidate threat set through regular expression matching using a pre-built threat rule base. in For rule matching threshold, For the candidate threat set, For rule matching scoring function; Intermediate verification layer: Perform behavioral chain analysis on the candidate threat set and calculate contextual relevance. in It is a time decay function. As an indicator of the continuity of the behavior chain, For the completeness of the behavioral chain, The total length of the behavior chain. For the behavior chain, For the number of iterations, For time; Advanced verification layer: for Threat adversarial sample testing was performed, and robustness was verified through perturbation injection: in, To add perturbation The subsequent similarity calculation Threat mode, For the size of the threat pattern library; Only when Output the final threat assessment at that time.

2. The intelligent network security threat detection method based on big data analysis according to claim 1, characterized in that: S1 includes: S11. Collect five-tuple traffic data packets of network devices in operation through distributed probes, extract session connection frequency, load entropy value, and protocol distribution vector, and generate dynamic traffic log data Q. S12. Extract asset port baselines, service dependency topologies, and vulnerability fingerprint vectors from the configuration management database to generate static baseline log data R.

3. The intelligent network security threat detection method based on big data analysis according to claim 2, characterized in that: S2 includes: S21. Use a multi-scale sliding window to slice Q over time, calculate the standard deviation of the sampling interval of the features within each time window, and generate dynamic traffic feature dimension data. ; S22. Perform topological feature parsing on R, extract the dimensional parameters of the asset service chain, and generate static baseline feature dimensional data. .

4. The intelligent network security threat detection method based on big data analysis according to claim 3, characterized in that: S3 includes: S31, Calculation and Euclidean distance ,in for and Euclidean distance, For dynamic traffic characteristic dimension data, This is static baseline feature dimension data; S32, if Generate feature dimension aligned identifier data And execute S5, where, The preset dimension alignment threshold, Align the identifier data with the feature dimensions; Otherwise generate .

5. The intelligent network security threat detection method based on big data analysis according to claim 4, characterized in that: S4 includes: S41, when When constructing the feature tensor of the static baseline ,according to Perform higher-order interpolation on the dimension: in, For tensor interpolation functions, The interpolation target dimension; generate ,in, Static baseline feature adjustment data.

6. The intelligent network security threat detection method based on big data analysis according to claim 5, characterized in that: S6 includes: S61. Establish a feature library for threat detection algorithms. , Indicates the first The standard threat feature matrix corresponding to the algorithm class, ; S62, Calculation by improving the Osprey algorithm and Match degree: Initialize the location of the osprey population: in For feature dimension, Let be the position of the i-th individual in the d-dimensional space of the osprey population. The lower boundary of the search space, The upper boundary of the search space, A random number in the interval [0,1]; Exploration phase update location: in, This is the current optimal solution. Let be the attack strength constant. A random number in the interval [0,1]; Development phase: Refined search ,in 0 represents the current algorithm iteration number; S63, Output ,in, This is the identifier for the optimal matching algorithm type.

7. The intelligent network security threat detection method based on big data analysis according to claim 6, characterized in that: The Osprey algorithm also includes: Introducing adaptive weights Control the search step size; in, Spatiotemporal fusion matrix Information entropy value, This represents the system's maximum entropy. Define the fitness function: in, For cosine similarity calculation, For matrix and Frobenius norm When the number of iterations When the time comes, the elite retention mechanism is activated to replace the bottom 20% of individuals, h=1,…,m.

Images