Network security threat detection system and method based on deep learning

Abstract

The invention discloses a network security threat detection system and method based on deep learning, and particularly relates to the field of network security trapping analysis based on a honeynet and a honeypot, and the method comprises the steps: collecting trapping node log data in a network security behavior trapping process; extracting a behavior event set including access time, request action types, parameter structures and node identifiers, organizing the behavior event set according to a timestamp sequence, and constructing a basic behavior node chain; and performing access sequence consistency check on the behavior node chain. A path map structure based on access tension evolution is constructed in a honeynet environment, a deep learning model is fused to execute trend reasoning and behavior disturbance prediction on a high-tension path segment, and a redundant path induction feedback mechanism is combined to realize preposed recognition and active trapping intervention on an attack path. The problem that high-concealment attacks cannot be perceived and responded in advance in a behavior window period is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security trapping analysis based on honeynet and honeypot, and more specifically, to a network security threat detection system and method based on deep learning. Background Art

[0002] In modern network security defense systems, honeypot systems are a key means of trapping attackers and are widely used to detect unknown threats and deceive attack paths. However, in advanced persistent attacks (APTs) or organized attack groups, attackers often have the ability to identify honeypot environments and gradually approach system boundaries through methods such as delayed activation, obfuscated jump paths, and simulated legitimate traffic. These attacks typically do not trigger high-risk operations in a short period of time, but instead explore the honeynet environment in a multi-stage, low-frequency, and hopping manner. This makes it difficult for traditional alarm mechanisms based on abnormal feature values ​​to determine their malicious intent.

[0003] At the same time, most existing fault-tolerance mechanisms are based on the premise of "identified anomalies" and are unable to detect attackers' gradual tentative bypass strategies against honeypot systems. This is especially true in a distributed IoT environment, where paths between nodes no longer have a linear logical relationship, further amplifying response delays and blind spots in judgment. Although the system has response mechanisms such as isolation and interception, it cannot proactively intervene before the attack is explicitly exposed, allowing highly concealed attacks to exploit the "behavioral window period."

[0004] Therefore, how to identify the attacker's path trend of gradually approaching core resources in the honeynet environment before the attack behavior is explicitly triggered, and trigger a fault-tolerant response mechanism that is confusing and actively inducing, has become an urgent problem that needs to be solved in the current deep honeynet system. Summary of the Invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a network security threat detection system and method based on deep learning. By constructing a path graph structure based on access tension evolution in a honeynet environment, and integrating a deep learning model to perform trend reasoning and behavioral disturbance prediction on high-tension path segments, and combining a redundant path induction feedback mechanism to realize pre-identification and active trapping intervention of attack paths, it solves the problem that highly concealed attacks cannot be perceived and responded to in advance during the behavioral window period.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network security threat detection method based on deep learning, comprising:

[0007] In the network security behavior trapping process, the trapping node log data is collected, and the behavior event set including access time, request action type, parameter structure and node identifier is extracted. The behavior event set is organized in timestamp order to build a basic behavior node chain;

[0008] Perform access sequence consistency check on the behavior node chain, and construct a time series linked list with access flow trends by comparing the access logic structure, jump amplitude and parameter content between adjacent nodes;

[0009] Based on the number of access hops, time intervals, and parameter changes between nodes, the edge weights between node pairs are calculated to form a set of directed path edges with temporal dynamic properties.

[0010] Perform access tension calculation on each edge in the directed path edge set to generate a path tension matrix representing the access disturbance trend, and analyze the potential fluctuation trend in combination with the path structure changes;

[0011] Based on the tension increase rate and jump change value in the tension matrix, path segments in an evolutionarily unstable state are extracted and marked as path tension drift areas, which serve as warning areas for potential attack path approaching stages.

[0012] The edge weight distribution in the path tension drift region is mapped to the graph encoding tensor space, and the structural graph tensor is constructed as the input of the deep learning model to perform path drift trend prediction and decision support for subsequent intervention behavior.

[0013] In a preferred embodiment, within the path node neighborhood corresponding to the path tension drift region, the node aggregation strength is determined based on the path aggregation degree, jump discontinuity, and access chain depth as behavioral characteristics, and the target risk path segment with redundant path insertion conditions is identified;

[0014] Analyze the structural stability of the target risk path segment, combine the historical access path coverage and node jump trend, and select the insertion position set that meets the structural guidance conditions;

[0015] Redundant path branches are introduced into the selected insertion position set, and a variable response state is preset for each redundant path branch, wherein the variable response state includes communication failure feedback, permission check exception, and system behavior simulation response of call failure.

[0016] In a preferred embodiment, based on the path tension fluctuation rate, access jump rate and path history sensitivity as behavioral features, it is determined whether the current path meets the triggering redundant path induction condition, and if so, a redundant path response is triggered;

[0017] After the redundant path is triggered, the manifestation of its disturbance to the main path is collected, including path direction deviation, access node fallback, and behavior jump intensity. The disturbance displacement index is calculated and a path intervention feedback structure is constructed. Based on the propagation path of the disturbance and the node variation trend in the path intervention feedback structure, a retrospective analysis of the path behavior is performed to evaluate whether the current induced behavior has caused the attack path to deviate or bifurcate.

[0018] The induced feedback behavior with path deflection results is recorded as a disturbance sample and used as a pseudo-induced reference sample in subsequent path reasoning to support the next round of graph deduction training process.

[0019] In a preferred embodiment, the structural graph tensor within the continuous time window is input into the deep learning path trend prediction model, and the node aggregation probability, path jump factor and historical access sequence are jointly modeled to generate a path target aggregation area prediction graph;

[0020] Perform spatial comparison between the predicted map of the aggregation area and the target tension area in the current map to identify the convergence trend of the path toward the induced structure and form a path warning vector;

[0021] The activation intensity in the path warning vector is matched with the current path status. When the behavior meets the preset threshold range, the deployed redundant path induction response is triggered.

[0022] Perform structural analysis on the access path after triggering, evaluate the disturbance amplitude, access chain reversal degree and jump point diffusion range caused by the pseudo-feedback behavior in the path structure, and construct a set of disturbance impact indicators.

[0023] In a preferred embodiment, the disturbance impact index of the disturbance impact index set is combined with the current path convergence trend evaluation result to calculate the induced intervention benefit value, and the path feedback behavior is strategically scored as the input basis for the next round of disturbance judgment;

[0024] If the disturbance behavior is identified as an effective induction path, the result is parameterized through the graph model. The parameter adjustment through the graph model is used to enhance the model's recognition ability and response sensitivity to similar behavior paths in the future.

[0025] During multiple rounds of disturbances, the link evolution record is executed for each round of induced feedback path to form a disturbance behavior evolution sequence, which is used as a closed-loop reference to update the path judgment system and induced feedback response strategy.

[0026] In a preferred embodiment, all disturbance path feedback behavior sequences triggered by pseudo-node responses are extracted and archived, and path segment clustering is performed based on the disturbance occurrence frequency, path variation density, and behavior jump distribution as structural features;

[0027] A node-level matching analysis is performed on various perturbed path sequences in the path segment clustering results, and the target jumping behavior nodes involved are overlapped with the real resource access trajectories mapped in the standard path set to evaluate the error amplitude and structural interference intensity generated by the false paths during the structural guidance process.

[0028] Based on the evaluation of the results of the perturbation fragment-guided behavior, a path induction benefit function is constructed. This function takes the path structure complexity, the success probability of induced intervention and the pseudo-feedback resource overhead as function input variables, and outputs strategy priority evaluation values ​​for different path types; a multi-level classification processing is performed on the strategy priority evaluation value set, and an induced response strategy hierarchy system is constructed through a hierarchical aggregation mechanism. The adaptive application boundary conditions of each level strategy in the dynamic evolution of the path structure are clarified.

[0029] In a preferred embodiment, during the continuous evolution phase of path behavior, adaptive adjustments to the induction strategy are performed based on the path tension change curve and the number of recorded disturbance feedbacks. The false path distribution density, response activation probability, and induced response time point are dynamically corrected to ensure the guidance accuracy and continuity of the intervention path. The disturbance structure evolution trajectory formed by each round of induced feedback behavior and its path response sequence is serialized and compressed, and a path map evolution memory structure is constructed based on this. This structure serves as the historical behavior input of the trend prediction mechanism, which is used to improve the path judgment stability of the deep learning model in the continuous attack evolution environment.

[0030] During the entire induced feedback response cycle, collaborative scheduling management is performed by combining the operating status of the behavior drift identification process, the path evolution trend judgment process and the feedback control trigger process, and a response intensity weight mechanism is established in the multi-stage response state to achieve cross-wheel linkage and stable adaptation of the induced strategy.

[0031] A network security threat detection system based on deep learning, including a behavior acquisition module, a sequence restoration module, a path edge building module, a tension calculation module, a drift recognition module, and a graph encoding module;

[0032] The behavior collection module collects the log data of the trapped nodes in the network security behavior trapping process, extracts the behavior event set including access time, request action type, parameter structure and node identifier, and organizes the behavior event set in timestamp order to build a basic behavior node chain;

[0033] The sequential restoration module performs access sequence consistency checks on the behavior node chain. By comparing the access logic structure, jump amplitude, and parameter content between adjacent nodes, it constructs a time series linked list with access flow trends.

[0034] The path edge building module calculates the edge weights between node pairs based on the number of access hops, time intervals, and parameter changes between nodes, forming a directed path edge set with temporal dynamic properties.

[0035] The tension calculation module performs access tension calculation operations on each edge in the directed path edge set, generates a path tension matrix representing the access disturbance trend, and analyzes the potential fluctuation trend in combination with the path structure changes;

[0036] The drift identification module extracts path segments that are in an evolutionarily unstable state based on the tension increase rate and jump change value in the tension matrix, marking them as path tension drift areas, which serve as warning areas for potential attack path approaching stages.

[0037] The graph encoding module maps the edge weight distribution in the path tension drift area to the graph encoding tensor space, constructs the structural graph tensor as the input of the deep learning model, and is used to perform path drift trend prediction and decision support for subsequent intervention behaviors.

[0038] Technical effects and advantages of the present invention:

[0039] 1. By building an access tension calculation mechanism and a path tension drift identification mechanism, we can extract path disturbance trends before the attack is exposed, achieving the ability to pre-emptively perceive and implicitly identify advanced persistent attack paths in the honeynet environment.

[0040] 2. By encoding behavioral features such as access time, jump frequency, and parameter variability into a structural graph tensor and inputting it into a deep learning model for path trend prediction, the team has improved its ability to model the continuity of low-frequency jump attack paths and determine their evolutionary trends.

[0041] 3. Through the identification of path-inducing conditions based on high-tension regions and the construction of redundant path responses, dynamic insertion of pseudo-behavior feedback is achieved, thereby enabling pre-disturbance intervention before the attack path reaches the target node;

[0042] 4. Through the linkage calculation of path perturbation vectors, path aggregation scores and graph benefit functions, the intervention benefits of induced behaviors are comprehensively evaluated, and this is used to drive the dynamic update of deep learning model parameters, thereby improving the model's sensitivity and stability in path recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The figure is a flow chart of the method steps of the present invention.

[0044] Figure 2 This is a timing diagram of the path prediction drive of the present invention.

[0045] Figure 3 Optimize the timing of the disturbance closed loop of the present invention Figure 1 .

[0046] Figure 4 Optimize the timing of the disturbance closed loop of the present invention Figure 2 .

[0047] Figure 5 This is a flow chart of the behavior acquisition and tension identification stages of the present invention.

[0048] Figure 6 This is a flow chart of the path prediction and redundant intervention phase of the present invention.

[0049] Figure 7 This is a flow chart of the disturbance assessment and strategy feedback phase of the present invention. DETAILED DESCRIPTION

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0051] Refer to the instruction manual Figure 1-7 A network security threat detection method based on deep learning according to an embodiment of the present invention includes:

[0052] In the network security behavior trapping process, the trapping node log data is collected, and the behavior event set including access time, request action type, parameter structure and node identifier is extracted. The behavior event set is organized in timestamp order to build a basic behavior node chain;

[0053] Perform access sequence consistency check on the behavior node chain, and construct a time series linked list with access flow trends by comparing the access logic structure, jump amplitude and parameter content between adjacent nodes;

[0054] Based on the number of access hops, time intervals, and parameter changes between nodes, the edge weights between node pairs are calculated to form a set of directed path edges with temporal dynamic properties.

[0055] Perform access tension calculation on each edge in the directed path edge set to generate a path tension matrix representing the access disturbance trend, and analyze the potential fluctuation trend in combination with the path structure changes;

[0056] Based on the tension increase rate and jump change value in the tension matrix, path segments in an evolutionarily unstable state are extracted and marked as path tension drift areas, which serve as warning areas for potential attack path approaching stages.

[0057] The edge weight distribution in the path tension drift region is mapped to the graph encoding tensor space, and the structural graph tensor is constructed as the input of the deep learning model to perform path drift trend prediction and decision support for subsequent intervention behavior.

[0058] In the path node neighborhood corresponding to the path tension drift area, the node aggregation strength is determined based on the path aggregation degree, jump discontinuity, and access chain depth as behavioral characteristics, and the target risk path segments with redundant path insertion conditions are identified;

[0059] Analyze the structural stability of the target risk path segment, combine the historical access path coverage and node jump trend, and select the insertion position set that meets the structural guidance conditions;

[0060] Redundant path branches are introduced into the selected insertion position set, and a variable response state is preset for each redundant path branch, wherein the variable response state includes communication failure feedback, permission check exception, and system behavior simulation response of call failure.

[0061] Based on the path tension fluctuation rate, access jump rate and path history sensitivity as behavioral features, it determines whether the current path meets the triggering redundant path induction conditions. If so, a redundant path response is triggered;

[0062] After the redundant path is triggered, the manifestation of its disturbance to the main path is collected, including path direction deviation, access node fallback, and behavior jump intensity. The disturbance displacement index is calculated and a path intervention feedback structure is constructed. Based on the propagation path of the disturbance and the node variation trend in the path intervention feedback structure, a retrospective analysis of the path behavior is performed to evaluate whether the current induced behavior has caused the attack path to deviate or bifurcate.

[0063] The induced feedback behavior with path deflection results is recorded as a disturbance sample and used as a pseudo-induced reference sample in subsequent path reasoning to support the next round of graph deduction training process.

[0064] The structural graph tensor within the continuous time window is input into the deep learning path trend prediction model, and the node aggregation probability, path jump factor and historical access sequence are jointly modeled to generate the path target aggregation area prediction graph;

[0065] Perform spatial comparison between the predicted map of the aggregation region and the target high-tension region in the current map to identify the possible convergence trend of the path toward the induced structure and form a path warning vector;

[0066] The activation intensity in the path warning vector is matched with the current path status. When the behavior meets the preset threshold range, the deployed redundant path induction response is triggered.

[0067] Perform structural analysis on the access path after triggering, evaluate the disturbance amplitude, access chain reversal degree and jump point diffusion range caused by the pseudo-feedback behavior in the path structure, and construct a set of disturbance impact indicators.

[0068] The disturbance impact index of the disturbance impact index set and the current path convergence trend evaluation result are combined to calculate the induced intervention benefit value, and the path feedback behavior is strategically scored as the input basis for the next round of disturbance judgment;

[0069] If the disturbance behavior is identified as an effective induction path, the result is parameterized through the graph model. The parameter adjustment through the graph model is used to enhance the model's recognition ability and response sensitivity to similar behavior paths in the future.

[0070] During multiple rounds of disturbances, the link evolution record is executed for each round of induced feedback path to form a disturbance behavior evolution sequence, which is used as a closed-loop reference to update the path judgment system and induced feedback response strategy.

[0071] Extract and archive all perturbation path feedback behavior sequences triggered by pseudo-node responses, and perform path segment clustering based on perturbation frequency, path variation density, and behavior jump distribution as structural features;

[0072] A node-level matching analysis is performed on various perturbed path sequences in the path segment clustering results. The target high-jump behavior nodes involved are overlapped with the real resource access trajectories mapped in the standard path set to evaluate the error amplitude and structural interference intensity generated by the false paths during the structural guidance process.

[0073] Based on the evaluation of the results of the perturbation fragment-guided behavior, a path induction benefit function is constructed. This function takes the path structure complexity, the success probability of induced intervention and the pseudo-feedback resource overhead as function input variables, and outputs strategy priority evaluation values ​​for different path types; a multi-level classification processing is performed on the strategy priority evaluation value set, and an induced response strategy hierarchy system is constructed through a hierarchical aggregation mechanism. The adaptive application boundary conditions of each level strategy in the dynamic evolution of the path structure are clarified.

[0074] During the continuous evolution of path behavior, adaptive adjustments to the induction strategy are performed based on the path tension change curve and the number of recorded disturbance feedbacks. The false path distribution density, response activation probability, and induced response time points are dynamically corrected to ensure the guidance accuracy and continuity of the intervention path. The disturbance structure evolution trajectory formed by each round of induced feedback behavior and its path response sequence is serialized and compressed, and a path map evolution memory structure is constructed based on this. This serves as the historical behavior input of the trend prediction mechanism, which is used to improve the path judgment stability of the deep learning model in the continuous attack evolution environment.

[0075] During the entire induced feedback response cycle, collaborative scheduling management is performed by combining the operating status of the behavior drift identification process, the path evolution trend judgment process and the feedback control trigger process, and a response intensity weight mechanism is established in the multi-stage response state to achieve cross-wheel linkage and stable adaptation of the induced strategy.

[0076] A network security threat detection system based on deep learning, including a behavior acquisition module, a sequence restoration module, a path edge building module, a tension calculation module, a drift recognition module, and a graph encoding module;

[0077] The behavior collection module collects the log data of the trapped nodes in the network security behavior trapping process, extracts the behavior event set including access time, request action type, parameter structure and node identifier, and organizes the behavior event set in timestamp order to build a basic behavior node chain;

[0078] The sequential restoration module performs access sequence consistency checks on the behavior node chain. By comparing the access logic structure, jump amplitude, and parameter content between adjacent nodes, it constructs a time series linked list with access flow trends.

[0079] The path edge building module calculates the edge weights between node pairs based on the number of access hops, time intervals, and parameter changes between nodes, forming a directed path edge set with temporal dynamic properties.

[0080] The tension calculation module performs access tension calculation operations on each edge in the directed path edge set, generates a path tension matrix representing the access disturbance trend, and analyzes the potential fluctuation trend in combination with the path structure changes;

[0081] The drift identification module extracts path segments that are in an evolutionarily unstable state based on the tension increase rate and jump change value in the tension matrix, marking them as path tension drift areas, which serve as warning areas for potential attack path approaching stages.

[0082] The graph encoding module maps the edge weight distribution in the path tension drift area to the graph encoding tensor space, constructs the structural graph tensor as the input of the deep learning model, and is used to perform path drift trend prediction and decision support for subsequent intervention behaviors.

[0083] It should be further explained that the behavior jump factor function is further constructed. The behavior jump factor function is used to uniformly express the multi-dimensional behavior differences between behavior nodes i and j. The multi-dimensional behavior differences include considering parameter structure complexity, access latency, access jumps, and parameter variability. It is also the fundamental component of subsequent graph edge construction.

[0084]

[0085] Where A(i,j) is the behavior jump factor, which is used to measure the behavior difference between nodes; i ,φ j is the node parameter complexity, in bit / structure (that is, the structure field bit complexity); Comp(φ i ,φ j ) is the complexity difference function, the unit is bit; τ ij is the node access delay, in milliseconds; Delay(τ ij ) is the delay impact factor, the unit is ms; Jmp(i,j) is the access jump degree, the unit is the number of hops / times; θ i ,θ j Param(θ i ,θ j ) is the structural parameter difference, the unit is bit;

[0086] Construct edge weight calculation function, which expresses the relationship between behavior intensity and access order through exponential mapping, which is the basic indicator for graph edge construction; formulate w ij represents the edge weight from node i to j, and the unit is expressed by the structural behavior strength, w ij Expressed as:

[0087] Where |ij| is the access jump step length, and the unit is the access sequence number spacing;

[0088] Construct a path tension calculation function. In the above scheme, the path tension calculation function is used to model the degree of disturbance of edge weight over time. The greater the tension, the more significant the access instability of the edge.

[0089]

[0090] Among them L ij is the path tension value, the unit is intensity / ms; is the edge weight change rate, the unit is intensity / ms; is the edge weighted acceleration (that is, the disturbance amplitude), the unit is intensity / ms 2 ; is the nonlinear structural amplification term, which is used to enhance tension;

[0091] Construct a path drift scoring function. In the above scheme, the path drift scoring function quantifies the structural drift tendency of the path through the combination of tension value and access jump length, and determines whether it has entered an abnormal state. The formula is as follows:

[0092] Where DriftScore(i,j) is the node pair path drift score; β jump is the jump intensity adjustment factor; then the path drift determination function is constructed, which is used to set the threshold to determine the drift area of ​​the path and trigger the early warning or fault tolerance mechanism;

[0093]

[0094] Among them S drift Indicates the path drift state. A path drift state of 0 indicates stability, and a path drift state of 1 indicates drift. drift The drift trigger threshold set for the system;

[0095] In the graph tensor input expression, the time evolution structure graph tensor is constructed as the input of the deep model. The formula is as follows:

[0096] G(t)=[w ij ·L ij Jmp(i,j)Delay(τ ij )Param(θ i ,θ j )Comp(φ i ,φ j )];

[0097] Where G(t) is the graph input tensor, and its unit is the set of structural variables. Each term in the formula is a structural behavior indicator, and in practical applications, it is normalized and processed in a unified unit.

[0098] Constructing a path perturbation vector function to express the degree of behavioral change after path induction is an important quantitative criterion for judging the effectiveness of perturbation.

[0099]

[0100] Where V is the path perturbation intensity, and its unit is the structural change intensity; δ dir is the directional offset, the unit is node displacement; δ rev is the degree of fallback, the unit is the access step length; δ spreadis the degree of diffusion, with the unit being the number of hops. The powers of 2, 1.5, and 2 are set in the formula to balance the nonlinear growth rates of different disturbance factors in terms of direction deviation, diffusion breadth, and fallback degree, so that they have differential sensitivity and relative weight control capabilities when constituting the disturbance intensity vector.

[0101] Construct a path aggregation trend function to characterize whether the paths converge toward a certain area, which is the criterion for judging the concentration of attacks.

[0102] Where S is the path aggregation strength score; ρ node is the node density (units include number of nodes / area); ρ jump is the hop frequency (units include hops / paragraph);

[0103] Construct an induced benefit function; the induced benefit function integrates disturbance and aggregation behavior to evaluate the tactical value of the induced response; R = α·V + β·S;

[0104] Where R is the intervention benefit, and the unit is the response score; α, β are the strategy adjustment factors; V is the path perturbation vector; S is the path aggregation trend score;

[0105] Finally, a strategy scoring function is constructed. The strategy scoring function is used to introduce model change response factors while evaluating returns, and to constrain overly sensitive model responses. The formula is as follows:

[0106] Where C is the strategy score, the unit is the response level; M(t) is the model parameter tensor (weight structure), the unit is the tensor value; Represents the rate of change and acceleration of model parameters.

[0107] It should be noted that, first, the behavior jump factor function A(i,j) combines access delay, parameter difference, jump distance and complexity to uniformly characterize the node behavior characteristics. The jump factor is embedded in the edge weight function w ij It reflects the intensity change of the access relationship in the path; then the path tension function L ij The time derivative is used to model the disturbance trend of edge weight over time, and together with the distance between nodes, it forms the path drift score function DriftScore(i,j). drift Achieve automatic identification of high-risk paths and extraction of drift areas;

[0108] After mapping such tension behaviors and structural differences into tensors G(t), a structural graph input that can be parsed by the deep learning model is formed, ensuring the complete connection between the graph construction process and deep prediction;

[0109] During the induced response process, formula V describes the multi-dimensional manifestations of path disturbances, including directional deviation, jump diffusion, and fallback path reconstruction, and inputs them into the intervention benefit function R through the path aggregation trend function S to quantify the strategic benefits of the induced action. Finally, the response is weighed through the strategy scoring function C combined with the model parameter change rate to achieve strategic optimization and regulation of subsequent induced feedback.

[0110] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security threat detection method based on deep learning, comprising: In the network security behavior trapping process, the trapping node log data is collected, and the behavior event set including access time, request action type, parameter structure and node identifier is extracted. The behavior event set is organized in timestamp order to build a basic behavior node chain; Its characteristics are: Perform access sequence consistency check on the behavior node chain, and construct a time series linked list with access flow trends by comparing the access logic structure, jump amplitude and parameter content between adjacent nodes; Based on the number of access hops, time intervals, and parameter changes between nodes, the edge weights between node pairs are calculated to form a set of directed path edges with temporal dynamic properties. Perform access tension calculation on each edge in the directed path edge set to generate a path tension matrix representing the access disturbance trend, and analyze the potential fluctuation trend in combination with the path structure changes; Based on the tension increase rate and jump change value in the tension matrix, path segments in an evolutionarily unstable state are extracted and marked as path tension drift areas, which serve as warning areas for potential attack path approaching stages. The edge weight distribution in the path tension drift region is mapped to the graph encoding tensor space, and the structural graph tensor is constructed as the input of the deep learning model to perform path drift trend prediction and decision support for subsequent intervention behavior.

2. The method for detecting network security threats based on deep learning according to claim 1, characterized in that: In the path node neighborhood corresponding to the path tension drift area, the node aggregation strength is determined based on the path aggregation degree, jump discontinuity, and access chain depth as behavioral characteristics, and the target risk path segments with redundant path insertion conditions are identified; Analyze the structural stability of the target risk path segment, combine the historical access path coverage and node jump trend, and select the insertion position set that meets the structural guidance conditions; Redundant path branches are introduced into the selected insertion position set, and a variable response state is preset for each redundant path branch, wherein the variable response state includes communication failure feedback, permission check exception, and system behavior simulation response of call failure.

3. The method for detecting network security threats based on deep learning according to claim 2, wherein: Based on the path tension fluctuation rate, access jump rate and path history sensitivity as behavioral features, it determines whether the current path meets the triggering redundant path induction conditions. If so, a redundant path response is triggered; After the redundant path is triggered, the manifestation of its disturbance to the main path is collected, including path direction deviation, access node fallback, and behavior jump intensity. The disturbance displacement index is calculated and a path intervention feedback structure is constructed. Based on the propagation path of the disturbance and the node variation trend in the path intervention feedback structure, a retrospective analysis of the path behavior is performed to evaluate whether the current induced behavior has caused the attack path to deviate or bifurcate. The induced feedback behavior with path deflection results is recorded as a disturbance sample and used as a pseudo-induced reference sample in subsequent path reasoning to support the next round of graph deduction training process.

4. The method for detecting network security threats based on deep learning according to claim 3, wherein: The structural graph tensor within the continuous time window is input into the deep learning path trend prediction model, and the node aggregation probability, path jump factor and historical access sequence are jointly modeled to generate the path target aggregation area prediction graph; Perform spatial comparison between the predicted map of the aggregation area and the target tension area in the current map to identify the convergence trend of the path toward the induced structure and form a path warning vector; The activation intensity in the path warning vector is matched with the current path status. When the behavior meets the preset threshold range, the deployed redundant path induction response is triggered. Perform structural analysis on the access path after triggering, evaluate the disturbance amplitude, access chain reversal degree and jump point diffusion range caused by the pseudo-feedback behavior in the path structure, and construct a set of disturbance impact indicators.

5. The method for detecting network security threats based on deep learning according to claim 4, characterized in that: The disturbance impact index of the disturbance impact index set and the current path convergence trend evaluation result are combined to calculate the induced intervention benefit value, and the path feedback behavior is strategically scored as the input basis for the next round of disturbance judgment; If the disturbance behavior is identified as an effective induction path, the result is parameterized through the graph model. The parameter adjustment through the graph model is used to enhance the model's recognition ability and response sensitivity to similar behavior paths in the future. During multiple rounds of disturbances, the link evolution record is executed for each round of induced feedback path to form a disturbance behavior evolution sequence, which is used as a closed-loop reference to update the path judgment system and induced feedback response strategy.

6. The method for detecting network security threats based on deep learning according to claim 5, characterized in that: Extract and archive all perturbation path feedback behavior sequences triggered by pseudo-node responses, and perform path segment clustering based on perturbation frequency, path variation density, and behavior jump distribution as structural features; A node-level matching analysis is performed on various perturbed path sequences in the path segment clustering results, and the target jumping behavior nodes involved are overlapped with the real resource access trajectories mapped in the standard path set to evaluate the error amplitude and structural interference intensity generated by the false paths during the structural guidance process. Based on the evaluation of the results of the perturbation fragment-guided behavior, a path induction benefit function is constructed. This function takes the path structure complexity, the success probability of induced intervention and the pseudo-feedback resource overhead as function input variables, and outputs strategy priority evaluation values ​​for different path types; a multi-level classification processing is performed on the strategy priority evaluation value set, and an induced response strategy hierarchy system is constructed through a hierarchical aggregation mechanism. The adaptive application boundary conditions of each level strategy in the dynamic evolution of the path structure are clarified.

7. The method for detecting network security threats based on deep learning according to claim 6, characterized in that: During the continuous evolution of path behavior, adaptive adjustments to the induction strategy are performed based on the path tension change curve and the number of recorded disturbance feedbacks. The false path distribution density, response activation probability, and induced response time points are dynamically corrected to ensure the guidance accuracy and continuity of the intervention path. The disturbance structure evolution trajectory formed by each round of induced feedback behavior and its path response sequence is serialized and compressed, and a path map evolution memory structure is constructed based on this. This serves as the historical behavior input of the trend prediction mechanism, which is used to improve the path judgment stability of the deep learning model in the continuous attack evolution environment. During the entire induced feedback response cycle, collaborative scheduling management is performed by combining the operating status of the behavior drift identification process, the path evolution trend judgment process and the feedback control trigger process, and a response intensity weight mechanism is established in the multi-stage response state to achieve cross-wheel linkage and stable adaptation of the induced strategy.

8. A network security threat detection system based on deep learning, comprising a behavior acquisition module, a sequence restoration module, a path edge building module, a tension calculation module, a drift identification module, and a graph encoding module, characterized by: The behavior collection module collects the log data of the trapped nodes in the network security behavior trapping process, extracts the behavior event set including access time, request action type, parameter structure and node identifier, and organizes the behavior event set in timestamp order to build a basic behavior node chain; The sequential restoration module performs access sequence consistency checks on the behavior node chain. By comparing the access logic structure, jump amplitude, and parameter content between adjacent nodes, it constructs a time series linked list with access flow trends. The path edge building module calculates the edge weights between node pairs based on the number of access hops, time intervals, and parameter changes between nodes, forming a directed path edge set with temporal dynamic properties. The tension calculation module performs access tension calculation operations on each edge in the directed path edge set, generates a path tension matrix representing the access disturbance trend, and analyzes the potential fluctuation trend in combination with the path structure changes; The drift identification module extracts path segments that are in an evolutionarily unstable state based on the tension increase rate and jump change value in the tension matrix, marking them as path tension drift areas, which serve as warning areas for potential attack path approaching stages. The graph encoding module maps the edge weight distribution in the path tension drift area to the graph encoding tensor space, constructs the structural graph tensor as the input of the deep learning model, and is used to perform path drift trend prediction and decision support for subsequent intervention behaviors.

Images