Big data network security adaptive defense system based on deep learning

Abstract

The invention discloses a big data network security adaptive defense system based on deep learning, and relates to the technical field of network security, the system comprises a monitoring center, the monitoring center is in communication connection with a deep learning module, a data capture module, a data processing module, a data analysis module and an adaptive defense module; a deep learning model is utilized to quickly identify risks of various network security events possibly occurring in real-time network interaction information, so as to obtain defense modes for each network security event, and meanwhile, the defense intensity of the corresponding defense modes is configured according to risk coefficients of various network security events, so that the defense efficiency is improved. Therefore, the limitation of a single defense mode is avoided, excessive defense is avoided, meanwhile, the adaptive configuration defense system can improve the network security to the maximum extent, and the network security defense efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a big data network security adaptive defense system based on deep learning. Background Art

[0002] The efficient information exchange provided by computer network technology has become an indispensable part of economic development. However, as a means of information exchange, computer network technology, due to its openness and interconnectedness, is extremely vulnerable to the penetration of computer viruses and Trojans, resulting in the leakage of computer users' privacy, threatening the safe use of computer technology, and causing computer users to worry about network security.

[0003] However, most existing network security defense strategies use a single defense strategy. How to use deep learning technology to quickly identify possible network security risks and adaptively configure the corresponding defense system to improve network security is a problem we need to solve. To this end, we now provide a big data network security adaptive defense system based on deep learning. Summary of the Invention

[0004] The purpose of this invention is to provide a big data network security adaptive defense system based on deep learning.

[0005] The object of the present invention can be achieved by the following technical solutions: A big data network security adaptive defense system based on deep learning, comprising a monitoring center, wherein the monitoring center is communicatively connected to a deep learning module, a data capture module, a data processing module, a data analysis module, and an adaptive defense module;

[0006] The deep learning module is used to build a deep learning model and train the deep learning model using historical network data;

[0007] The data capture module is used to obtain real-time network interaction information;

[0008] The data processing module is used to process the acquired real-time network interaction information to obtain corresponding network information features;

[0009] The data analysis module is used to perform network security event similarity matching on the obtained network information features, and determine whether there is a network security risk based on the matching results;

[0010] The adaptive defense module is used to configure a defense system according to existing network security risks.

[0011] Furthermore, the process of building a deep learning model and training it using historical network data includes:

[0012] Collect historical network data corresponding to various network security incidents;

[0013] Converting the collected historical network data into corresponding historical network data streams;

[0014] The deep learning model consists of a convolutional layer, a pooling layer, a fully connected layer, and an activation function;

[0015] The convolution layer is composed of several convolution kernels of different sizes, which slide on the historical network data stream by sliding the convolution kernels of different sizes, and extract the historical data features extracted after each slide;

[0016] Output the obtained historical data features, and perform homogeneous feature induction on the output historical data features to obtain corresponding feature sample data;

[0017] Divide the obtained feature sample data into training set, test set and validation set;

[0018] Train, test, and validate the deep learning model using feature sample data in the training set, test set, and validation set;

[0019] The correlation between various network security events and each feature sample data and the corresponding correlation coefficient are input, and the network defense method for the network security event is obtained.

[0020] Furthermore, the process of summarizing the homogeneous features of historical data is as follows:

[0021] Summarize the historical data features obtained from each slide to obtain the corresponding feature set and the feature value of each historical data feature in the feature set;

[0022] Select each feature set in turn and obtain the Euclidean distance between the selected feature set and other feature sets;

[0023] According to the Euclidean distance between the obtained feature sets, the similarity S between each feature set is obtained;

[0024] Set the similarity threshold, denoted as S0;

[0025] When S>S0, it means that the similarity between the selected feature set and other feature sets is high;

[0026] The selected feature set is summarized with other feature sets with high similarity to obtain the corresponding feature sample data.

[0027] Furthermore, the characteristic value of the summarized feature is the mean of the characteristic values ​​of the corresponding features in the selected feature set and other feature sets with high similarity.

[0028] Furthermore, the data processing module processes the acquired real-time network interaction information to obtain corresponding network information features, including:

[0029] Converting the obtained real-time network interaction information to obtain corresponding real-time network interaction data stream;

[0030] Divide the obtained real-time network interaction data stream into data stream segments of corresponding different lengths according to the types of convolution kernel sizes;

[0031] All data stream segments are input into the trained deep learning model, and according to the length of the data stream segment, the corresponding convolution kernel is matched to extract the features of the data stream segment to obtain the corresponding network information features.

[0032] Furthermore, the process of dividing the obtained real-time network interaction data stream into data stream segments of different lengths according to the type of convolution kernel size is as follows:

[0033] Constructing correlation functions for segmenting data streams;

[0034] Summarize the proportional coefficients in the correlation function to obtain the corresponding proportional coefficient sequence;

[0035] The length of the data stream segment corresponding to each convolution kernel is input into the correlation function expression. If there exists a proportional coefficient sequence that makes the error coefficient in the correlation function equal to 0, the real-time network interaction data stream is divided according to each proportional coefficient in the corresponding proportional coefficient sequence. If there does not exist a proportional coefficient sequence that makes the error coefficient equal to 0, the proportional coefficient sequence corresponding to the minimum error coefficient is obtained, and the real-time network interaction data stream is divided according to each proportional coefficient in the corresponding proportional coefficient sequence, and the excess part is padded with 0;

[0036] By pre-dividing the real-time network interaction data stream into data stream segments of matching data length according to the convolution kernel size type in the deep learning model.

[0037] Furthermore, the data analysis module performs network security event similarity matching on the obtained network information features, and determines whether a network security risk exists based on the matching results. The process includes:

[0038] Compare the obtained network information features with each feature sample data in various network security events to obtain the similarity value between each network information feature and each feature sample data;

[0039] Set similarity threshold;

[0040] If the obtained similarity value is higher than the similarity threshold, it means that the network information feature is similar to the corresponding feature sample data;

[0041] If any network information feature is similar to at least one feature sample data in a network security incident, the corresponding network information feature will be recorded as a suspected event feature corresponding to the network security incident;

[0042] The feature sample data with the highest similarity to each suspected event feature in the network security event is recorded as the standard event feature, and the risk factor fX of the network information feature causing the network security event is obtained based on the similarity value of the standard event feature corresponding to the suspected event feature;

[0043] Set the risk factor threshold f0;

[0044] When fX≥f0, it means that there is a network security risk of the network security incident occurring in the real-time network interaction information. Otherwise, it means that there is no network security risk of the network security incident occurring.

[0045] Furthermore, the process of configuring the defense system according to the existing network security risks by the adaptive defense module includes:

[0046] Summarize cybersecurity events that pose cybersecurity risks in real-time network interaction information and obtain cybersecurity defense methods corresponding to each cybersecurity event;

[0047] Set up several risk gradients, each corresponding to a different defense strength;

[0048] Match the risk factor of each network security incident with the set risk gradient range, and configure the defense strength of the corresponding network security defense method based on the risk gradient to which the risk factor belongs.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] By using deep learning models, we can quickly identify the risks of various network security incidents that may occur in real-time network interaction information, thereby obtaining defense methods for various network security incidents. At the same time, we configure the defense strength of the corresponding defense method according to the risk coefficient of various network security incidents, thereby avoiding the limitations of a single defense method and avoiding excessive defense. At the same time, the adaptive configuration defense system can maximize network security and improve network security defense efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0052] Figure 1 This is a schematic diagram of the present invention. DETAILED DESCRIPTION

[0053] like Figure 1 As shown, a big data network security adaptive defense system based on deep learning includes a monitoring center, which is communicatively connected to a deep learning module, a data capture module, a data processing module, a data analysis module, and an adaptive defense module;

[0054] The deep learning module is used to build a deep learning model and train the deep learning model using historical network data;

[0055] The data capture module is used to obtain real-time network interaction information;

[0056] The data processing module is used to process the acquired real-time network interaction information to obtain corresponding network information features;

[0057] The data analysis module is used to perform network security event similarity matching on the obtained network information features, and determine whether there is a network security risk based on the matching results;

[0058] The adaptive defense module is used to configure a defense system according to existing network security risks.

[0059] It should be further explained that, in the specific implementation process, the process of building a deep learning model and training the deep learning model using historical network data includes:

[0060] Collect historical network data corresponding to various network security incidents;

[0061] Converting the collected historical network data into corresponding historical network data streams;

[0062] The deep learning model consists of a convolutional layer, a pooling layer, a fully connected layer, and an activation function;

[0063] The convolution layer is composed of several convolution kernels of different sizes, which slide on the historical network data stream by sliding the convolution kernels of different sizes, and extract the historical data features extracted after each slide;

[0064] Output the obtained historical data features, and perform homogeneous feature induction on the output historical data features to obtain corresponding feature sample data;

[0065] Divide the obtained feature sample data into training set, test set and validation set;

[0066] The deep learning model is trained, verified, and tested using the feature sample data in the training set, test set, and validation set, thereby obtaining a trained deep learning model. It should be noted that the process of training, verifying, and testing the deep learning model is a common technical means used by those skilled in the art and will not be described in detail here.

[0067] The correlation between various network security events and each feature sample data and the corresponding correlation coefficient are input, and based on big data, the most effective network defense method among various network security events is obtained and corresponds to the network security event.

[0068] It should be further explained that, in the specific implementation process, the process of summarizing the homogeneous features of historical data features is as follows:

[0069] Summarize the historical data features obtained from each slide to obtain the corresponding feature set;

[0070] Each feature in the obtained feature set is labeled as i, where i = 1, 2, ..., n;

[0071] Then the eigenvalue corresponding to the feature labeled i is recorded as X i , and record the feature set as [X i ];

[0072] Select each feature set in turn and obtain the Euclidean distance between the selected feature set and other feature sets, denoted as d(x, y), where:

[0073] ;

[0074] in, Represents the feature value of each feature in the selected feature set, Represents the feature values ​​of each feature in other feature sets;

[0075] According to the Euclidean distance between the obtained feature sets, the similarity between each feature set is obtained, which is recorded as S, where:

[0076] ;

[0077] Set the similarity threshold, denoted as S0;

[0078] When S>S0, it means that the similarity between the selected feature set and other feature sets is high;

[0079] The selected feature set is summarized with other feature sets with high similarity to obtain corresponding feature sample data; it should be noted that the characteristic value of the summarized feature is the average of the characteristic values ​​of the corresponding features in the selected feature set and other feature sets with high similarity.

[0080] It should be further explained that, in a specific implementation process, the data processing module processes the acquired real-time network interaction information to obtain corresponding network information features, including:

[0081] Converting the obtained real-time network interaction information to obtain corresponding real-time network interaction data stream;

[0082] The obtained real-time network interaction data stream is divided into data stream segments of different lengths according to the types of convolution kernel sizes. It should be further explained that the length of the divided data stream segments corresponds to the size of the convolution kernel, that is, each convolution kernel of a certain size corresponds to a data stream segment of a certain length, and the length of the data stream segment corresponding to the convolution kernel is directly proportional to the size of the convolution kernel, that is, the length of the data stream segment can be divided by the size of the convolution kernel.

[0083] All data stream segments are input into the trained deep learning model, and according to the length of the data stream segment, the corresponding convolution kernel is matched to extract the features of the data stream segment to obtain the corresponding network information features.

[0084] It should be further explained that, in the specific implementation process, the process of dividing the obtained real-time network interaction data stream into data stream segments of different lengths according to the type of convolution kernel size is as follows:

[0085] The convolution kernel types of different sizes contained in the deep learning model are marked as j, where j = 1, 2, ..., m;

[0086] Then the length of the data stream segment corresponding to the convolution kernel type labeled i is recorded as K j ;

[0087] Construct the correlation function for dividing the data stream segments. The correlation function expression is:

[0088] ;

[0089] Where L is the total data length of the real-time network interactive data stream, represents the proportional coefficient corresponding to the convolution kernel type labeled j, and is an integer greater than or equal to 1, is the error coefficient;

[0090] Summarize the proportional coefficients in the correlation function expression to obtain the corresponding proportional coefficient sequence;

[0091] The data stream segment length K j Input into the correlation function expression, if there is a proportional coefficient sequence such that If it is 0, the real-time network interactive data stream is divided according to the corresponding proportional coefficients in the proportional coefficient sequence. If there is no proportional coefficient sequence that If it is 0, then The proportional coefficient sequence corresponding to the minimum value divides the real-time network interactive data stream according to each proportional coefficient in the corresponding proportional coefficient sequence, and fills the excess part with 0 so that the data length of the excess part can meet the minimum data segment length corresponding to each convolution kernel;

[0092] By dividing the real-time network interaction data stream into data stream segments of matching data length according to the convolution kernel size type in the deep learning model in advance, the data stream segments input into the deep learning model can call all the convolution kernels for synchronous feature extraction, thereby improving the efficiency of feature extraction. At the same time, the length of the data stream segment is made corresponding to the convolution kernel size, so that the convolution kernel can slide at a fixed distance when sliding on the data stream segment to extract features, thereby indirectly optimizing the feature extraction process.

[0093] It should be further explained that the process in which the data analysis module performs network security event similarity matching on the obtained network information features and determines whether a network security risk exists based on the matching results includes:

[0094] Compare the obtained network information features with each feature sample data in various network security events to obtain the similarity value between each network information feature and each feature sample data;

[0095] Set similarity threshold;

[0096] If the obtained similarity value is higher than the similarity threshold, it means that the network information feature is similar to the corresponding feature sample data;

[0097] If any network information feature is similar to at least one feature sample data in a network security event, the corresponding network information feature is recorded as a suspected event feature corresponding to the network security event, and the suspected event feature is labeled as k, where k = 1, 2, ..., s;

[0098] The feature sample data with the highest similarity to each suspected event feature in the network security event is recorded as the standard event feature, and the similarity value of the standard event feature corresponding to the suspected event feature numbered k is recorded as Xs k ;

[0099] The risk factor of the network security incident occurring based on the obtained network information characteristics is obtained, denoted as fX, where:

[0100] ;

[0101] in, is the total number of network information features, is the correlation coefficient between the corresponding standard event feature and the network security event;

[0102] Set the risk factor threshold f0;

[0103] When fX≥f0, it means that there is a network security risk of the network security incident occurring in the real-time network interaction information. Otherwise, it means that there is no network security risk of the network security incident occurring.

[0104] It should be further explained that, in a specific implementation process, the process of configuring the defense system according to the existing network security risks by the adaptive defense module includes:

[0105] Summarize cybersecurity events that pose cybersecurity risks in real-time network interaction information and obtain cybersecurity defense methods corresponding to each cybersecurity event;

[0106] Set up several risk gradients, each corresponding to a different defense strength;

[0107] Match the risk factor of each cybersecurity incident with the set risk gradient range, and configure the defense strength of the corresponding cybersecurity defense method based on the risk gradient to which the risk factor belongs;

[0108] Complete the construction of the defense system based on the network security defense method and the corresponding defense strength configured.

[0109] The above description is merely a preferred embodiment of the present invention and does not constitute any form of limitation to the present invention. Although the present invention has been disclosed as a preferred embodiment as above, it is not intended to limit the present invention. Any person skilled in the art can make some changes or modifications to equivalent embodiments using the technical contents disclosed above without departing from the scope of the technical solution of the present invention. However, any modification or equivalent replacement of the above embodiments made according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the scope of the technical solution of the present invention.

Claims

1. A big data network security adaptive defense system based on deep learning, including a monitoring center, characterized in that: The monitoring center is communicatively connected to a deep learning module, a data capture module, a data processing module, a data analysis module, and an adaptive defense module; The deep learning module is used to build a deep learning model and train the deep learning model using historical network data; The data capture module is used to obtain real-time network interaction information; The data processing module is used to process the acquired real-time network interaction information to obtain corresponding network information features; The data analysis module is used to perform network security event similarity matching on the obtained network information features, and determine whether there is a network security risk based on the matching results; The adaptive defense module is used to configure a defense system according to existing network security risks.

2. A deep learning-based big data network security adaptive defense system according to claim 1, characterized in that: The process of building a deep learning model and training it using historical network data includes: Collect historical network data corresponding to various network security incidents; Converting the collected historical network data into corresponding historical network data streams; The deep learning model consists of a convolutional layer, a pooling layer, a fully connected layer, and an activation function; The convolution layer is composed of several convolution kernels of different sizes, which slide on the historical network data stream by sliding the convolution kernels of different sizes, and extract the historical data features extracted after each slide; Output the obtained historical data features, and perform homogeneous feature induction on the output historical data features to obtain corresponding feature sample data; Divide the obtained feature sample data into training set, test set and validation set; Train, test, and validate the deep learning model using feature sample data in the training set, test set, and validation set; The correlation between various network security events and each feature sample data and the corresponding correlation coefficient are input, and the network defense method for the network security event is obtained.

3. A deep learning-based big data network security adaptive defense system according to claim 2, characterized in that: The process of summarizing the homogeneous features of historical data features is as follows: Summarize the historical data features obtained from each slide to obtain the corresponding feature set and the feature value of each historical data feature in the feature set; Select each feature set in turn and obtain the Euclidean distance between the selected feature set and other feature sets; According to the Euclidean distance between the obtained feature sets, the similarity S between each feature set is obtained; Set the similarity threshold, denoted as S0; When S>S0, it means that the similarity between the selected feature set and other feature sets is high; The selected feature set is summarized with other feature sets with high similarity to obtain the corresponding feature sample data.

4. A deep learning-based big data network security adaptive defense system according to claim 3, characterized in that: The eigenvalue of the summarized feature is the mean of the eigenvalues ​​of the corresponding features in the selected feature set and other feature sets with high similarity.

5. The deep learning-based big data network security adaptive defense system according to claim 4 is characterized in that: The data processing module processes the acquired real-time network interaction information to obtain corresponding network information features, including: Converting the obtained real-time network interaction information to obtain corresponding real-time network interaction data stream; Divide the obtained real-time network interaction data stream into data stream segments of corresponding different lengths according to the types of convolution kernel sizes; All data stream segments are input into the trained deep learning model, and according to the length of the data stream segment, the corresponding convolution kernel is matched to extract the features of the data stream segment to obtain the corresponding network information features.

6. The deep learning-based big data network security adaptive defense system according to claim 5 is characterized in that: The process of dividing the obtained real-time network interaction data stream into data stream segments of different lengths according to the type of convolution kernel size is as follows: Constructing correlation functions for segmenting data streams; Summarize the proportional coefficients in the correlation function to obtain the corresponding proportional coefficient sequence; The length of the data stream segment corresponding to each convolution kernel is input into the correlation function expression. If there exists a proportional coefficient sequence that makes the error coefficient in the correlation function equal to 0, the real-time network interaction data stream is divided according to each proportional coefficient in the corresponding proportional coefficient sequence. If there does not exist a proportional coefficient sequence that makes the error coefficient equal to 0, the proportional coefficient sequence corresponding to the minimum error coefficient is obtained, and the real-time network interaction data stream is divided according to each proportional coefficient in the corresponding proportional coefficient sequence, and the excess part is padded with 0; By pre-dividing the real-time network interaction data stream into data stream segments of matching data length according to the convolution kernel size type in the deep learning model.

7. The deep learning-based big data network security adaptive defense system according to claim 6 is characterized in that: The data analysis module performs network security event similarity matching on the acquired network information features and determines whether there is a network security risk based on the matching results. The process includes: Compare the obtained network information features with each feature sample data in various network security events to obtain the similarity value between each network information feature and each feature sample data; Set similarity threshold; If the obtained similarity value is higher than the similarity threshold, it means that the network information feature is similar to the corresponding feature sample data; If any network information feature is similar to at least one feature sample data in a network security incident, the corresponding network information feature will be recorded as a suspected event feature corresponding to the network security incident; The feature sample data with the highest similarity to each suspected event feature in the network security event is recorded as the standard event feature, and the risk factor fX of the network information feature causing the network security event is obtained based on the similarity value of the standard event feature corresponding to the suspected event feature; Set the risk factor threshold f0; When fX≥f0, it means that there is a network security risk of the network security incident occurring in the real-time network interaction information. Otherwise, it means that there is no network security risk of the network security incident occurring.

8. The deep learning-based big data network security adaptive defense system according to claim 7 is characterized in that: The process of configuring the defense system according to the existing network security risks by the adaptive defense module includes: Summarize cybersecurity events that pose cybersecurity risks in real-time network interaction information and obtain cybersecurity defense methods corresponding to each cybersecurity event; Set up several risk gradients, each corresponding to a different defense strength; Match the risk factor of each network security incident with the set risk gradient range, and configure the defense strength of the corresponding network security defense method based on the risk gradient to which the risk factor belongs.

Images