Network threat immune detection method and device based on double-layer tolerance training

Abstract

The application discloses a network threat immune detection method and device based on double-layer tolerance training, relates to the technical field of network security, and comprises the following steps: S1, acquiring a set and a set; S2, judging whether t is greater than 1; if yes, proceeding to S3; otherwise, calculating the set and proceeding to S4; S3, performing detector tolerance training; S4, performing self-tolerance training; evolved antigens successfully passing the self-tolerance training are used as mature antibodies, and are added to the set; S5, generating mature detectors to obtain a detector collection; S6, acquiring the set; S7, judging whether training is terminated; if not, proceeding to S8; otherwise, outputting and proceeding to S9; S8, setting t+1=t and returning to S2; S9, acquiring network data to be detected; S10, detecting the network data to be detected to output a detection result; the detector generation mechanism based on double-layer tolerance training significantly reduces the number of redundant detectors, improves the detection process efficiency, effectively avoids false positives, and improves the detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network threat immune detection method and device based on two-layer tolerance training. Background Technology

[0002] In recent years, with the rapid development and widespread adoption of internet technology, the cybersecurity situation has become increasingly severe and complex. Cyberattacks are no longer limited to known malicious code and attack patterns; unknown threats, such as zero-day vulnerability attacks, advanced persistent threats (APTs), and various new types of malware, are emerging in an endless stream, posing a significant challenge to cybersecurity protection. Traditional signature- or rule-based detection methods, due to their lag and reliance on known threats, are inadequate in the face of the ever-emerging unknown threats and struggle to effectively respond.

[0003] To address the growing number of unknown threats, researchers have drawn inspiration from the biological immune system, proposing an immune evolutionary approach to network threat detection. The core idea of ​​this method is to mimic the evolutionary and learning mechanisms of the biological immune system. By performing mutation, crossover, and selection operations on known network threat samples, a large number of "antibodies" or "detectors" are generated, enabling them to identify and defend against unknown threats that are similar to known threats. This approach attempts to overcome the limitations of traditional detection methods by constructing a detection system that can continuously learn and evolve, thereby improving the ability to identify novel and mutated threats. However, while immune evolution-based methods theoretically have the potential to address unknown threats, the subsequent crucial step of tolerance training often faces the challenge of balancing efficiency and effectiveness, which significantly limits the practical detection performance of such methods. The goal of tolerance training is to enable the evolved detectors to distinguish between malicious traffic and variants in normal traffic, avoiding misclassifying normal network behavior as a threat, i.e., reducing the false positive rate. Ideal tolerance training requires a large number of representative normal traffic variants for "negative selection," eliminating detectors that react to normal traffic and retaining those that are only sensitive to malicious traffic. However, in practice, constructing a comprehensive and representative set of normal traffic variants is extremely challenging. Normal network behavior is diverse and dynamic, making it difficult to exhaustively list all possible variants. Furthermore, efficiently training a large-scale detector population to withstand various conditions is also limited by computational resources and time costs. Summary of the Invention

[0004] The purpose of this invention is to design a network threat immune detection method and device based on two-layer tolerance training in order to solve the above problems.

[0005] The present invention achieves the above objectives through the following technical solutions:

[0006] Network threat immune detection methods based on two-layer tolerance training include:

[0007] S1. Obtain the training autoantigen set and training non-self antigen sets ;

[0008] S2. Determine if t is greater than 1. If yes, proceed to S3; otherwise, proceed to... Antigen selection is performed, and the retained non-self antigens constitute the first-generation evolutionary antigen set. And directly proceed to S4; t is a positive integer;

[0009] S3, using the (t-1)th generation detector set Detectors in On the evolutionary antigen set Evolutionary antigens in Detector tolerance training was conducted to obtain evolutionary antigens that successfully passed the detector tolerance training. , Center of the detector For the detector radius, A collection of detectors;

[0010] S4, on the set of evolutionary antigens Evolutionary antigens in the assay, or those that have successfully passed detector tolerance training, undergo self-tolerance training. Evolutionary antigens that have successfully passed self-tolerance training are used as mature antibodies, and these mature antibodies are added to the first... non-self-antigen collection ;

[0011] S5, Calculate the... non-self-antigen collection The radius corresponding to the intermediate-mature antibody, in order to generate One mature detector and add it to the t-1 generation detector collection. The set of detectors of generation t is obtained. ;

[0012] S6, according to the first non-self-antigen collection Obtain the set of evolutionary antigens for generation t+1. ;

[0013] S7. Determine whether to terminate training. If not, proceed to S8; otherwise, output the detector set. And enter S9;

[0014] S8. Let t+1=t, and return to S2;

[0015] S9. Obtain the network data to be detected;

[0016] S10, Utilizing detector collection The system performs tests on the network data to be tested and outputs the test results.

[0017] A network threat immune detection device based on two-layer tolerance training includes:

[0018] Storage; storage is used to store computer programs;

[0019] An actuator; the actuator is used to execute a computer program in the storage, which, when executed, implements the network threat immune detection method based on two-layer tolerance training as described above.

[0020] A computer-readable storage medium storing a computer program that is executed by a processor to implement the network threat immune detection method based on two-layer tolerance training as described above.

[0021] The beneficial effects of this invention are as follows:

[0022] This invention is based on a detector generation mechanism using two-layer tolerance training. The core of this mechanism lies in performing two-layer tolerance training, ensuring that only antigens that neither overlap with the functional scope of existing detectors nor recognize normal network behavior (self-antigens) are allowed to be used to generate new detectors. This strategy significantly reduces the number of redundant detectors, improves the efficiency of the detection process, and effectively avoids false positives for normal network traffic from the source, thereby improving detection accuracy. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the network threat immune detection method based on two-layer tolerance training according to the present invention;

[0024] Figure 2 This is an example diagram showing the distribution of evolved antigens and existing detectors. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0026] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0027] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0028] In the description of this invention, it should be understood that the terms "upper," "lower," "inner," "outer," "left," "right," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this invention is in use, or the orientation or positional relationship commonly understood by those skilled in the art. They are only used to facilitate the description of this invention and to simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0029] Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0030] In the description of this invention, it should also be noted that, unless otherwise explicitly specified and limited, terms such as "set" and "connection" should be interpreted broadly. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0031] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0032] like Figure 1 As shown, the network threat immune detection method based on two-layer tolerance training includes:

[0033] S1. Obtain the training autoantigen set and training non-self antigen sets .

[0034] S2. Determine if t is greater than 1. If yes, proceed to S3; otherwise, proceed to... Antigen selection is performed, and the retained non-self antigens constitute the first-generation evolutionary antigen set. And directly proceed to S4; t is a positive integer, The number of antigens is .

[0035] S3, using the (t-1)th generation detector set Detectors in On the evolutionary antigen set Evolutionary antigens in Detector tolerance training was conducted to obtain evolutionary antigens that successfully passed the detector tolerance training. , Center of the detector For the detector radius, This is a collection of detectors; specifically:

[0036] Taking 2D space as an example, the evolution of antigens Compared with existing detectors ( Examples of distributions of ) are as follows Figure 2 As shown in the figure, and The corresponding marginal autoantigens are denoted as follows: and According to evolutionary antigens With the center of the detector distance The location distribution of evolved antigens and existing detectors is divided into... and There are two types. The rules for detector tolerance training will be analyzed and discussed below for these two location distribution scenarios.

[0037] when hour:

[0038] At this time, the antigen evolves. Falling on the detector Outside of its coverage area (see) Figure 2 (a) and Figure 2 (b)). For the sake of sufficiency, when At that time, Relative to detector The location information has been further subdivided: Figure 2 (a) and Corresponding marginal autoantigens and Same, and Figure 2 (b) and Corresponding marginal autoantigens and Different. As can be seen from the diagram, regardless of Whether it holds true depends on the evolution of antigens. Falling on the detector In addition, by Most of the coverage of the newly generated detector will not be the same as The coverage overlaps (see the blue shaded area in the figure). Therefore, this type of evolutionary antigen can successfully pass through... The detector tolerates training.

[0039] when hour:

[0040] Can the evolutionary antigen successfully pass through? Detector tolerance training requires the use of angles To make a further judgment. Figure 2 (c) and ,as well as Figure 2 (d) satisfy .exist Figure 2 (c) And because Greater than , The non-overlapping portion of the generated new detector is larger than However, when As it continues to increase, The non-overlapping coverage of the newly generated detectors may not necessarily continue to increase, such as Figure 2 (d) Because During the growth process, The corresponding marginal autoantigens may fall within other autogenous regions. And when... Large enough and hour, The newly generated detector can repair existing detectors. Pores in other self-regions. Therefore, when evolving antigens... Falling on the detector When within the coverage area, as the angle The increase, The non-overlapping coverage of the newly generated detector will increase accordingly, or The newly generated detector can repair existing detectors. Holes between other regions of the body. Therefore, when At that time, if Larger than detector tolerance angle Then the evolutionary antigen can successfully pass through Detector tolerance training. Unlike previous studies where all existing detectors had the same tolerance angle, this method trains the tolerance angle... With detector radius The radius increases, thus increasing the probability that existing detectors with larger radii will replace new detectors. Tolerance angle Represented as: ;in, This represents the maximum tolerance angle. These are the adjustment parameters for the tolerance angle; This is a natural constant. Tolerance angle. The table allows for a significant degree of overlap between small-radius detectors located close to the body region.

[0041] In summary, when evolving antigens Compared with existing detectors satisfy:

[0042] or At that time, the evolution of antigens Considered a successful pass The detector is tolerant to training. The cosine value of the angle is expressed as:

[0043] ;

[0044] in:" "" represents the dot product between vectors, when evolving antigens The detector set was passed. After tolerance training of all detectors, Those who pass the detector tolerance training are considered to have successfully completed the training and will continue to participate in subsequent self-tolerance training.

[0045] Detector tolerance training avoids significant overlap between detectors generated from newly evolved antigens and existing detectors, thus ensuring the effectiveness of detector coverage.

[0046] S4, on the set of evolutionary antigens Evolutionary antigens in the assay, or those that have successfully passed detector tolerance training, undergo self-tolerance training. Evolutionary antigens that have successfully passed self-tolerance training are used as mature antibodies, and these mature antibodies are added to the first... non-self-antigen collection Specifically, this involves: determining evolutionary antigens. Does the condition for self-tolerance meet? If so, then evolve the antigen. Successfully trained by self-tolerance to transform the antigen As a mature antibody, and the mature antibody is added to the first non-self-antigen collection Conversely, the evolution of antigens... Unable to successfully undergo self-tolerance training, abandon the evolutionary antigen. .

[0047] This method is based on the hierarchical variation vector magnitude. By moving the peripheral autoantigens away from the autoregion in an order of increasing size, we obtain evolving antigens that are closer to the autoregion than to the autoregion. This ensures that the small-radius detectors generated earlier will not be eliminated during detector tolerance training because they are covered by the large-radius detectors generated later. It also ensures that the non-autoregions adjacent to the autoregion can be fully covered by the small-radius detectors, thereby reducing the gap between the detectors and the autoregion.

[0048] S5, Calculate the... non-self-antigen collection The radius corresponding to the intermediate-mature antibody, in order to generate The first mature detector and added to the first Collection of substitute detectors , obtained the Collection of substitute detectors In order to maximize the coverage of the detector without covering its own region, Corresponding radius Represented as: ,in, It is a marginal autoantigen. To train the autoantigen set Autoantigens in The radius of the autoantigen.

[0049] Because of the evolutionary antigens acquired during self-tolerance. The distances to all autoantigens are such that calculating their corresponding radii only requires a comparison operation. The closest distance to the autoantigen, without having to traverse all autoantigens again.

[0050] S6, according to the first non-self-antigen collection Obtain the set of evolutionary antigens for generation t+1. Specifically:

[0051] use Calculate the first Marginal autoantigen set obtained in generation , is represented as: , , ,in, It is a marginal autoantigen. To train the autoantigen set Autoantigens in To train a non-self antigen set Non-self antigens;

[0052] Extracting edge autoantigen sets The marginal autoantigens of generation t+1 are used as the parent antigen set. ; indicates as: ;

[0053] Based on the hierarchical variation vector magnitude To arrange the parent antigens in ascending order The peripheral autoantigens in the middle deviate from the autogenous region, resulting in evolved antigens that are closer to the autogenous region than to the autogenous region. and evolutionary antigen set .

[0054] S7. Determine whether to terminate training. If not, proceed to S8; otherwise, output the detector set. Then proceed to S9; specifically: if condition 1 or condition 2 is met, determine to terminate training;

[0055] Condition 1 is: the first Attrition rate of the middle detector tolerance training Greater than the preset threshold ;

[0056] Condition 2 is, the first +1 generation paternal antigen set It is an empty set; the elimination rate Represented as: ,in, To pass through the first The number of antigens retained during detector tolerance training in the -1 generation To participate in the The number of evolutionary antigens that the detector is tolerant to in generation -1.

[0057] Both Condition 1 and Condition 2 measure whether sufficient detectors have been generated to cover the non-self regions, ensuring that the generated detectors can adequately detect known / unknown non-self antigens within these regions. Condition 1 indicates that there are more than If a proportion of the evolved antigens fall within the coverage area of ​​existing detectors, the newly generated detectors will have significant overlap with existing detectors. In this case, it can be considered that the coverage area of ​​existing detectors already includes approximately [a certain percentage]. The proportion of non-self regions. Condition 2 indicates that in the current training generation, it is impossible to obtain new edge self antigens as the starting point for the next generation of evolution. At this time, it can be considered that the evolutionary algorithm has fully traversed the edges of the self regions, and the non-self regions around the self regions have been searched sufficiently.

[0058] Let the total number of iterations for training be denoted as . The training process is shown in Table 1.

[0059] Table 1. Flowchart of Double-Layer Endurance Training

[0060]

[0061] S8. Let t+1=t, and return to S2.

[0062] S9. Obtain the network data to be detected.

[0063] S10, Utilizing detector collection The network data to be tested is analyzed, and the test results are output; specifically, this includes:

[0064] (1) The network data to be detected is obtained through feature encoding. A 3D network data sample is represented as a Vitamin A antigen ;

[0065] (2) Using training autoantigen sets and training non-self antigen sets extreme value pairs Standardization is performed to obtain standardized antigens. , is represented as: ,in, antigen The 3D eigenvalues; To standardize the testing antigen The 3D eigenvalues; and for The Middle Maximum and minimum values ​​of features in dimension 1 ;

[0066] (3) Identify antigens Does condition 3 or condition 4 meet? If condition 3 or condition 4 meets, then the antigen... The data is not autoantigen, and the output test result is the network data to be detected, which is a network attack.

[0067] Condition 3: Antigen With the center of the detector distance Is it not greater than the detector radius? If yes, then condition 3 is satisfied; otherwise, condition 3 is not satisfied.

[0068] Condition 4: Antigen Does it fall within the abnormal range? If so, then condition 4 is satisfied; otherwise, condition 4 is not satisfied. The abnormal region is... , For the maximum magnitude of the mutation vector, It is an adjustment parameter for detecting boundaries.

[0069] Although it can be assumed that the immune detectors obtained through iterative training sufficiently cover the non-self regions within a certain range outside the self regions, the evolutionary algorithm cannot set an infinitely large mutation vector amplitude. Therefore, the generated detectors cannot be distributed in regions infinitely far from the self regions to identify unknown network attacks that deviate significantly from normal network behavior. The coverage boundary of the detector farthest from the self region is called the detection boundary, and regions beyond the detection boundary are considered anomalous regions. Antigens located in anomalous regions deviate greatly from known self antigens and are thus directly identified as non-self antigens. In this invention, the detection boundary is determined by the maximum amplitude of the mutation vector. Decision. Because the marginal autoantigen is normalized to In the [0,1] space of dimension 1, therefore the maximum range that the variant antigen can reach in each dimension is 1. Considering the radius of the detector that the antigen may generate, the limiting coverage of the detector in each dimension is: However, it is generally impossible to distribute marginal autoantigens at both "0" and "1" positions in every dimension, and the detector's maximum coverage is usually difficult to achieve. Therefore, the detection boundary is set as... ,in This is an adjustment parameter for detecting boundaries. The anomaly interval in each dimension is... .

[0070] A detector generation mechanism based on two-layer tolerance training was established to ensure that only antigens that do not fall within the coverage of existing detectors or autoantigens can be used to generate detectors. This reduces redundant detectors, improves detection efficiency, and avoids false alarms of autoantigens by the detectors.

[0071] A tolerance training process was designed for the evolved detector, which can perform different tolerance training according to the characteristics of the evolved detector, thereby improving the efficiency of tolerance training while ensuring its effectiveness.

[0072] An unknown attack identification mechanism based on anomaly intervals is proposed. Anomaly intervals are set to identify network attacks outside the maximum coverage of the detector, effectively discovering difficult-to-identify, novel or highly mutated network attacks, and further improving the detection model's ability to detect unknown threats.

[0073] A network threat immune detection device based on two-layer tolerance training includes:

[0074] Storage; storage is used to store computer programs;

[0075] An actuator; the actuator is used to execute a computer program in the storage, which, when executed, implements the network threat immune detection method based on two-layer tolerance training as described above.

[0076] A computer-readable storage medium storing a computer program that is executed by a processor to implement the network threat immune detection method based on two-layer tolerance training as described above.

[0077] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.

Claims

1. A network threat immune detection method based on two-layer tolerance training, characterized in that, include: S1. Obtain the training autoantigen set and training non-self antigen sets ; S2. Determine if t is greater than 1. If yes, proceed to S3; otherwise, proceed to... Antigen selection is performed, and the retained non-self antigens constitute the first-generation evolutionary antigen set. And directly proceed to S4; t is a positive integer; S3, using the (t-1)th generation detector set Detectors in On the evolutionary antigen set Evolutionary antigens in Detector tolerance training was conducted to obtain evolutionary antigens that successfully passed the detector tolerance training. , Center of the detector For the detector radius, A collection of detectors; S4, on the set of evolutionary antigens Evolutionary antigens in the dataset, or those that have successfully passed detector tolerance training, undergo self-tolerance training. Evolutionary antigens that have successfully passed self-tolerance training are used as mature antibodies, and these mature antibodies are added to the t-th non-self-antigen set. ; S5. Calculate the set of non-self antigens in generation t. The radius corresponding to the intermediate-mature antibody, in order to generate One mature detector and add it to the t-1 generation detector collection. The set of detectors of generation t is obtained. ; S6. Based on the t-th generation non-self antigen set Obtain the set of evolutionary antigens for generation t+1. ; S7. Determine whether to terminate training. If not, proceed to S8; otherwise, output the detector set. And enter S9; S8. Let t+1=t, and return to S2; S9. Obtain the network data to be detected; S10, Utilizing detector collection The system performs tests on the network data to be tested and outputs the test results.

2. The network threat immune detection method based on two-layer tolerance training according to claim 1, characterized in that, In S3, based on evolutionary antigens With the center of the detector distance and detector radius Relationship analysis of evolutionary antigens Whether the detector tolerance training was successfully completed; specifically: when At that time, the evolution of antigens Successfully passed detector tolerance training; when At that time, make a judgment Is it greater than the detector? tolerance angle If so, then it is an evolved antigen. Successfully passed Detector tolerance training; tolerance angle With detector radius It increases with the increase of [something]. for The corresponding marginal autoantigen.

3. The network threat immune detection method based on two-layer tolerance training according to claim 1, characterized in that, In S4, specifically: determining evolutionary antigens. Does the condition for self-tolerance meet? If so, then evolve the antigen. Successfully trained by self-tolerance to transform the antigen As a mature antibody, the mature antibody is added to the t-th generation non-self antigen set. Conversely, the evolution of antigens... Unable to successfully undergo self-tolerance training, abandon the evolutionary antigen. .

4. The network threat immune detection method based on two-layer tolerance training according to claim 1, characterized in that, In S5, radius Represented as: ,in, It is a mature antibody. To train the autoantigen set Autoantigens in The radius of the autoantigen.

5. The network threat immune detection method based on two-layer tolerance training according to claim 1, characterized in that, In S6, using Calculate the set of marginal autoantigens obtained in generation t+1. , is represented as: , , ,in, It is a marginal autoantigen. To train the autoantigen set Autoantigens in To train a non-self antigen set Non-self antigens; Extracting edge autoantigen sets The marginal autoantigens of generation t+1 are used as the parent antigen set. ; indicates as: ; Based on the hierarchical variation vector magnitude To arrange the parent antigens in ascending order The peripheral autoantigens in the middle deviate from the autogenous region, resulting in evolved antigens that are closer to the autogenous region than to the autogenous region. and evolutionary antigen set .

6. The network threat immune detection method based on two-layer tolerance training according to claim 5, characterized in that, In S7, training is terminated when either condition 1 or condition 2 is met. Condition 1 is: ... Attrition rate of the middle detector tolerance training Greater than the preset threshold Condition 2 is that the first +1 generation paternal antigen set It is an empty set; the elimination rate Represented as: ,in, To determine the number of antigens retained after detector tolerance training in generation t-1, The number of evolutionary antigens that participate in detector tolerance during generation t-1.

7. The network threat immune detection method based on two-layer tolerance training according to claim 1, characterized in that, S10 includes: (1) The network data to be detected is obtained through feature encoding. A 3D network data sample is represented as a Vitamin A antigen ; (2) Using training autoantigen sets and training non-self antigen sets right Standardization is performed to obtain standardized antigens. ; (3) Identify antigens Does condition 3 or condition 4 meet? If condition 3 or condition 4 meets, then the antigen... The data is not autoantigen, and the output test result is the network data to be detected, which is a network attack. Condition 3: Antigen With the center of the detector distance Is it not greater than the detector radius? If yes, then condition 3 is satisfied; otherwise, condition 3 is not satisfied. Condition 4: Antigen Does it fall within the abnormal range? If so, then condition 4 is satisfied; otherwise, condition 4 is not satisfied. The abnormal region is... , For the maximum magnitude of the mutation vector, It is an adjustment parameter for detecting boundaries.

8. The network threat immune detection method based on two-layer tolerance training according to claim 7, characterized in that, In (2), the training autoantigen set is used. and training non-self antigen sets extreme value pairs Standardization is performed to obtain standardized antigens. , is represented as: ,in, antigen The 3D eigenvalues; To standardize the testing antigen The 3D eigenvalues; and for The Middle Maximum and minimum values ​​of features in dimension 1 .

9. A network threat immune detection device based on two-layer tolerance training, characterized in that, include: Storage; Storage is used to store computer programs; Actuator; An actuator is used to execute a computer program in a storage device, which, when executing the computer program, implements the network threat immune detection method based on two-layer tolerance training as described in any one of claims 1-8.

Images