Network security collaborative integration analysis system and method based on multi-modal processing

Abstract

The application discloses a network security collaborative integration analysis system and method based on multi-modal processing, relates to the field of network security, solves the problem of network security blacklist update lag, and comprises a data acquisition module, a feature extraction module, a data packet analysis module and a log analysis module.The data acquisition module is used for acquiring session access data and session log data.The feature extraction module is used for extracting different types of data in the session access data and classifying the data to obtain data packet quintuples and time features.The data packet analysis module is used for judging the security of a network node to be detected through a network analysis unit and a session analysis unit to obtain newly added blacklists.The log analysis module is used for judging the security of the network node to be detected in combination with the session log data to obtain newly added blacklists.The application realizes timely updating of the blacklist through multi-modal data analysis of access users.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a network security collaborative integrated analysis system and method based on multimodal processing. Background Technology

[0002] Multimodal processing refers to a system or model's ability to simultaneously process and understand multiple data types, and to ensure the accuracy of analysis results through information from different modalities. Network security collaborative integration is a comprehensive concept that emphasizes the integration of different security components, technologies, and processes in the field of network security to achieve collaborative work, thereby improving overall security protection capabilities and efficiency.

[0003] However, traditional solutions often analyze network traffic or application behavior in isolation. Attackers can bypass single detection by encrypting traffic or imitating legitimate protocols. Traditional detection methods are not only easy to bypass, but also difficult to distinguish between malicious scanning and normal high-concurrency access, which leads to a lag in blacklist updates.

[0004] Therefore, this invention proposes a network security collaborative integrated analysis system and method based on multimodal processing. Summary of the Invention

[0005] The purpose of this invention is to propose a network security collaborative integrated analysis system and method based on multimodal processing to solve the problems mentioned in the background art.

[0006] Firstly, in order to achieve the above objectives, the present invention adopts the following technical solution:

[0007] A network security collaborative integrated analysis system based on multimodal processing includes a data acquisition module, a feature extraction module, a data packet analysis module, a log analysis module, and a storage terminal;

[0008] The data acquisition module is used to collect session access data and session log data of the corresponding session of the accessing user. The data acquisition module sends the session access data to the feature extraction module and the session log data to the log analysis module.

[0009] The feature extraction module is used to extract and classify different types of data from the session access data, and send the data packet five-tuple and time features to the data packet analysis module.

[0010] The packet analysis module is used to determine the security of the network nodes to be detected through the network analysis unit and the session analysis unit, obtain the newly added blacklist, and send it to the storage terminal;

[0011] The log analysis module is used to combine session log data to determine the security of network nodes to be detected, obtain the newly added blacklist, and send it to the storage terminal.

[0012] The storage terminal is used to receive newly added blacklists, update them, and then store the updated blacklists.

[0013] Furthermore, the session access data includes: the session data packets received by the network node from the accessing user and the corresponding data packet size; the session log data includes logs left by the accessing user during a series of operations in a session.

[0014] Furthermore, the specific working process of the feature extraction module is as follows:

[0015] Obtain session access data of the network node to be tested, and get multiple session data packets sent by the accessing user received by the corresponding network node to be tested;

[0016] Extract the source IP, source port, destination IP, destination port, and sending protocol of each session data packet, and summarize them into a 5-tuple;

[0017] Identify the timestamps of multiple session data packets, read the sending time of multiple session data packets, and arrange the session data packets in descending order of their timestamps;

[0018] Obtain the start and end times of the corresponding data packet based on the timestamp of the session data packet; subtract the start time of the same session data packet from the end time to obtain the transmission duration of the corresponding session data packet;

[0019] Identify the packet size of the session data packet, obtain the transmission rate by dividing the packet size by the transmission duration of the corresponding session data packet, obtain the inter-packet wait time of the current data packet by subtracting the transmission completion time of the previous data packet from the transmission start time of the current data packet, and use the inter-packet wait time and transmission rate as the time characteristics of the corresponding session.

[0020] Furthermore, the working process of the network analysis unit is as follows:

[0021] Obtain multiple packet 5-tuples to get the corresponding session packet's source IP, source port, destination IP, destination port, and packet sending protocol;

[0022] If the source IP of the data packet is on the IP blacklist or the source port of the data packet is on the port blacklist, the corresponding session data packet is marked as a dangerous file and deleted; if the source IP of the data packet is not on the IP blacklist and the source port of the data packet is not on the port blacklist, proceed to the next step.

[0023] Identify the node IP and node port corresponding to the network node to be detected;

[0024] The node IP is compared with the destination IP of the data packet. If the node IP and the destination IP of the data packet are the same, proceed to the next step. If the node IP and the destination IP of the data packet are different, increment the abnormal IP operand of the source IP of the data packet by one.

[0025] Furthermore, the operation of the network analysis unit also includes:

[0026] Match the node port with the destination port of the data packet. If the node port contains the destination port of the data packet, proceed to the next step; if the node port does not contain the destination port of the data packet, increment the abnormal port operand of the source port of the data packet.

[0027] And so on, perform the above operation on the packet 5-tuple of all session packets;

[0028] Count the total number of abnormal IP operations for all source IPs and the total number of abnormal port operations for all source ports;

[0029] The total number of abnormal IP operations and the total number of abnormal port operations are compared with the corresponding thresholds. If either the total number of abnormal IP operations or the total number of abnormal port operations is greater than or equal to the corresponding threshold, the corresponding IP address or port number is added to the blacklist and the session data packets received in this session are cleared. If neither the total number of abnormal IP operations nor the total number of abnormal port operations is less than the corresponding threshold, no operation is performed.

[0030] Furthermore, the working process of the session analysis unit specifically includes:

[0031] Obtain the temporal characteristics of session data packets to get the inter-packet wait time and transmission rate; sum the inter-packet wait times of all session data packets and take the average value to get the average inter-packet wait time.

[0032] Based on the mean and duration of the session's waiting time, the standard deviation of the session's waiting time for the data packets is calculated.

[0033] The first boundary value is obtained by subtracting the standard deviation of the room waiting time from the mean room waiting time, and the second boundary value is obtained by adding the mean room waiting time to the standard deviation of the room waiting time. The filtering range of the room waiting time corresponding to the session data packet is obtained with the first boundary value as the left endpoint and the second boundary value as the right endpoint. Room waiting times outside the filtering range are discarded.

[0034] The average of the remaining packet waiting times is obtained by summing the remaining packet waiting times;

[0035] The average waiting time of the denoised private rooms is compared with the average waiting time threshold. If the average waiting time of the denoised private rooms is less than the average waiting time threshold, a frequency anomaly signal is generated; if the average waiting time of the private rooms is greater than or equal to the average waiting time threshold, subsequent steps are performed.

[0036] The transmission rates of the remaining session data packets are summed and averaged to obtain the average transmission rate. The average transmission rate is then compared with a threshold. If the average transmission rate is greater than or equal to the threshold, a rate anomaly signal is generated; otherwise, subsequent steps are performed.

[0037] If both frequency and rate anomalies are present, the source IP address corresponding to the session data packet is added to the blacklist; otherwise, no action is taken.

[0038] Furthermore, the analysis process of the log analysis module is as follows:

[0039] Obtain session log data and extract session login logs from the session log data; based on the session login logs, obtain the start and end times of the accessing user;

[0040] Extract timestamps from multiple system logs located between the start and end times of access.

[0041] Based on reading the system logs, the target file accessed by the user is obtained, and the file access path, number of file accesses, and file access duration of the target file are obtained.

[0042] Read the historical system logs of the target file over the past seven days as the training set, and obtain the historical access path, historical access count and historical access duration of the target file based on the historical system logs.

[0043] The types of historical access paths are counted. If only one type exists, the corresponding historical access path is used as the access path baseline. If multiple types exist, the historical access path that appears most frequently is retained, and the other historical access paths and their corresponding historical system logs are discarded.

[0044] The average historical access duration of the target file is obtained by summing all the historical access durations and then calculating the standard deviation of the historical access duration corresponding to the average historical access duration.

[0045] Match the file access path of the target file with the access path baseline;

[0046] If the file access path is different from the access path baseline, the file access path of the target file is considered abnormal; if the file access path is the same as the access path baseline, the file access path of the target file is considered normal, and proceed to the next step.

[0047] Furthermore, the analysis process of the log analysis module also includes:

[0048] Calculate the access time deviation of the target file;

[0049] Construct the normal interval standard, offset interval standard, and abnormal interval standard corresponding to the access duration deviation;

[0050] Count the number of times the target file appears in the normal range, the number of times it appears in the offset range, and the number of times it appears in the abnormal range.

[0051] If the number of exceptions is greater than or equal to one, the access duration is considered abnormal; if the number of exceptions is less than one, the abnormal access duration value of the target file is calculated.

[0052] Anomalies in access duration are compared to anomaly thresholds. If anomalies in access duration are greater than or equal to the threshold, the access duration is considered abnormal; if anomalies in access duration are less than the threshold, the access duration is considered normal.

[0053] If both the file access path and the file access duration are normal, no operation will be performed; if either the file access path or the file access duration is abnormal, the existence of an attack intent corresponding to the access operation of the target file will be determined.

[0054] Similarly, determine the presence of attack intent for all target files. If any access to a target file indicates an attack intent, add the IP address of the accessing user to the blacklist; otherwise, do nothing.

[0055] Furthermore, the process for determining whether an access attempt has malicious intent is as follows:

[0056] Obtain the target file and get its original sequence.

[0057] After appending bits "1" to the original sequence, fill it with K zeros to obtain the processed sequence;

[0058] The original sequence is converted into a 64-bit binary form and then concatenated after the processing sequence to obtain the calculation sequence;

[0059] The computation sequence is divided into n 64-byte computation subsequences; the first 32 digits of the fractional part of the square root of the first eight prime numbers in the natural numbers are selected and then converted into hexadecimal representation to obtain eight initial check values. The eight initial check values ​​are used as the initial values ​​of the first check value to the eighth check value in turn.

[0060] The first check value to the eighth check value are sequentially appended to the first intermediate variable to the eighth intermediate variable; wherein the initial value of the first intermediate variable to the eighth intermediate variable is 0.

[0061] Update functions that update the first intermediate variable up to the eighth update variable;

[0062] Add the updated first intermediate variable to the initial first check value to obtain the updated value of the first check value; similarly, obtain the updated values ​​of the second to eighth check values.

[0063] After iterating through the operation n times or more, the final first to eighth check values ​​are obtained. The first to eighth check values ​​are then concatenated to obtain the complete file check value corresponding to the initial state of the target file.

[0064] Similarly, calculate the file integrity check value of the target file after it has been accessed;

[0065] If the file integrity check value in the initial state is inconsistent with the file integrity check value after being accessed, the access operation to the target file is considered to have malicious intent; otherwise, the access operation to the target file is considered to have no malicious intent and no operation is performed.

[0066] Secondly, this invention also proposes a network security collaborative integrated analysis method based on multimodal processing, the method comprising:

[0067] Step S101: Collect session access data and session log data of the user's corresponding session;

[0068] Step S102: Extract session access data and different types of data from the session access data, and classify them to obtain the packet quintuple and time features;

[0069] Step S103: Based on the packet quintuple and time characteristics, determine the security of the corresponding network node to be detected, and then add the access user corresponding to the session packet to the blacklist.

[0070] Step S104: Combine session log data to determine the security of the network nodes to be tested, and obtain the newly added blacklist.

[0071] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0072] 1. This invention first collects session access data and session log data of the user's corresponding session through a data acquisition module. Then, it extracts and classifies different types of data from the session access data to obtain the data packet five-tuple and time feature transmission. Subsequently, the data packet analysis module is used to determine the security of the network node to be detected through the network analysis unit and the session analysis unit, obtains the newly added blacklist and sends it to the storage terminal. This invention realizes network security monitoring of the network node to be detected at the data transmission layer.

[0073] 2. This invention combines session log data to determine the security of network nodes to be detected, obtains a newly added blacklist, and sends it to the storage terminal; finally, the storage terminal receives the newly added blacklist, updates it, and then stores the updated blacklist. This invention achieves timely updates of the blacklist through multimodal data analysis of accessing users. Attached Figure Description

[0074] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0075] Figure 1 This is an overall system block diagram of the present invention;

[0076] Figure 2 This is a system architecture diagram of the present invention;

[0077] Figure 3 This is a flowchart of the method involved in the present invention. Detailed Implementation

[0078] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0079] Example 1, please refer to Figure 1 and Figure 2 As shown, the technical solution provided by the present invention is: a network security collaborative integrated analysis system based on multimodal processing. The system monitors the data interaction between the accessing user and the network node to be detected, performs synchronous analysis at the network layer and application layer, and then accurately identifies the attack behavior of the accessing user and adds it to the blacklist in a timely manner, so as to ensure the reliable operation of the network node to be detected.

[0080] The system includes: a data acquisition module, a feature extraction module, a data packet analysis module, a log analysis module, and a storage terminal;

[0081] In this invention, the data acquisition module is used to detect the session operation of data interaction between any accessing user and the network node to be detected, and then collect the session access data and session log data of the corresponding session of the accessing user. The data acquisition module sends the session access data to the feature extraction module and the session log data to the log analysis module.

[0082] The process of a user establishing a network connection with a pre-detection network node and then disconnecting is considered a session. Session access data includes: session data packets sent by the user and the corresponding data packet size received by the pre-detection network node. Session log data includes logs left by the user during a series of operations within a session. Examples include session login logs, system logs, user file logs, file access logs, and network connection logs.

[0083] In this invention, the feature extraction module is used to extract and classify different types of data from the session access data. The specific working process is as follows:

[0084] Obtain session access data of the network node to be tested, and get multiple session data packets sent by the accessing user received by the corresponding network node to be tested;

[0085] Extract the source IP, source port, destination IP, destination port, and sending protocol of each session data packet, and summarize them into a 5-tuple;

[0086] It needs to be explained in detail that the destination IP address of the data packet refers to the IP address to which the session data packet is expected to be sent; the destination port of the data packet refers to the port number to which the session data packet is expected to be sent.

[0087] Identify the timestamps of multiple session data packets, read the sending time of multiple session data packets, and arrange the session data packets in descending order of their timestamps;

[0088] It should be noted that this invention defines the communication between the accessing user and the pre-detection network node as a single channel, meaning that the accessing user and the pre-detection network node can only send one session data packet at a time.

[0089] Based on the timestamp of the session data packet, obtain the start time and completion time of the transmission of the corresponding data packet; subtract the start time of the transmission of the same session data packet from the completion time to obtain the transmission duration of the corresponding session data packet; identify the data packet size of the session data packet, and obtain the transmission rate by dividing the data packet size by the transmission duration of the corresponding session data packet; subtract the completion time of the previous data packet from the start time of the current data packet to obtain the inter-packet wait time of the current data packet; use the inter-packet wait time and the transmission rate as the time characteristics of the corresponding session;

[0090] It should be noted that the first session data packet does not have an inter-packet wait time;

[0091] The feature extraction module sends the data packet quintuple and time features to the data packet analysis module;

[0092] In this invention, the packet analysis module includes a network analysis unit and a session analysis unit. The network analysis unit is used to determine the security of the network node to be detected based on the packet's five-tuple. The determination process is as follows:

[0093] Obtain multiple packet 5-tuples to get the corresponding session packet's source IP, source port, destination IP, destination port, and packet sending protocol;

[0094] If the source IP of the data packet is on the IP blacklist or the source port of the data packet is on the port blacklist, the corresponding session data packet is marked as a dangerous file and deleted; if the source IP of the data packet is not on the IP blacklist and the source port of the data packet is not on the port blacklist, proceed to the next step.

[0095] Identify the node IP and node port corresponding to the network node to be detected; wherein, the number of node ports is greater than or equal to one.

[0096] The node IP is compared with the destination IP of the data packet. If the node IP and the destination IP of the data packet are the same, proceed to the next step. If the node IP and the destination IP of the data packet are different, increment the abnormal IP operand of the source IP of the data packet by one.

[0097] Match the node port with the destination port of the data packet. If the node port contains the destination port of the data packet, proceed to the next step; if the node port does not contain the destination port of the data packet, increment the abnormal port operand of the source port of the data packet.

[0098] And so on, perform the above operation on the packet 5-tuple of all session packets;

[0099] Count the total number of abnormal IP operations for all source IPs and the total number of abnormal port operations for all source ports;

[0100] The total number of abnormal IP operations and the total number of abnormal port operations are compared with the corresponding thresholds. If either the total number of abnormal IP operations or the total number of abnormal port operations is greater than or equal to the corresponding threshold, the corresponding IP address or port number is added to the blacklist and the session data packets received in this session are cleared. If neither the total number of abnormal IP operations nor the total number of abnormal port operations is less than the corresponding threshold, no operation is performed.

[0101] In this invention, the session analysis unit is used to determine the security of network nodes to be detected based on time characteristics. The determination process is as follows:

[0102] Obtain the temporal characteristics of session data packets to get the inter-packet wait time and transmission rate; sum the inter-packet wait times of all session data packets and take the average value to get the average inter-packet wait time.

[0103] Based on the mean and duration of the session's waiting time, the standard deviation of the session's waiting time for the data packets is calculated.

[0104] The first boundary value is obtained by subtracting the standard deviation of the room waiting time from the mean room waiting time, and the second boundary value is obtained by adding the mean room waiting time to the standard deviation of the room waiting time. The filtering range of the room waiting time corresponding to the session data packet is obtained with the first boundary value as the left endpoint and the second boundary value as the right endpoint. Room waiting times outside the filtering range are discarded.

[0105] The average of the remaining packet waiting times is obtained by summing the remaining packet waiting times;

[0106] The average waiting time of the denoised private rooms is compared with the average waiting time threshold. If the average waiting time of the denoised private rooms is less than the average waiting time threshold, a frequency anomaly signal is generated; if the average waiting time of the private rooms is greater than or equal to the average waiting time threshold, subsequent steps are performed.

[0107] The transmission rates of the remaining session data packets are summed and averaged to obtain the average transmission rate. The average transmission rate is then compared with a threshold. If the average transmission rate is greater than or equal to the threshold, a rate anomaly signal is generated; otherwise, subsequent steps are performed.

[0108] If both frequency and rate anomalies are present, the source IP address corresponding to the session data packet is added to the blacklist; otherwise, no action is taken.

[0109] The newly added blacklist by the data packet analysis module is sent to the storage terminal.

[0110] The log analysis module is used to determine the security of network nodes to be tested based on session log data. The analysis process is as follows:

[0111] Obtain session log data and extract session login logs from the session log data; based on the session login logs, obtain the start and end times of the accessing user;

[0112] Extract timestamps from multiple system logs located between the start and end times of access. These system logs record the operations performed by the accessing user, such as accessing a file, subsequent actions, the number of operations, and the duration of the access.

[0113] Based on reading the system logs, the target file accessed by the user is obtained, and the file access path, number of file accesses, and file access duration of the target file are obtained.

[0114] Read the historical system logs of the target file over the past seven days as the training set, and obtain the historical access path, historical access count and historical access duration of the target file based on the historical system logs.

[0115] The types of historical access paths are counted. If only one type exists, the corresponding historical access path is used as the access path baseline. If multiple types exist, the historical access path that appears most frequently is retained, and the other historical access paths and their corresponding historical system logs are discarded.

[0116] The average historical access duration of the target file is obtained by summing all the historical access durations and then calculating the standard deviation of the historical access duration corresponding to the average historical access duration.

[0117] Match the file access path of the target file with the access path baseline;

[0118] If the file access path is different from the access path baseline, the file access path of the target file is considered abnormal; if the file access path is the same as the access path baseline, the file access path of the target file is considered normal, and proceed to the next step.

[0119] The access time deviation of the target file is calculated using a formula, specifically:

[0120] Access duration deviation = |File access duration - Historical access duration mean| / Historical access duration standard deviation;

[0121] Construct the normal interval standard for the access duration deviation: (0, 1], the offset interval standard: (1, 3], and the abnormal interval standard: (3, +∞);

[0122] Count the number of times the target file appears in the normal range, the number of times it appears in the offset range, and the number of times it appears in the abnormal range.

[0123] If the number of exceptions is greater than or equal to one, the access duration is considered abnormal; if the number of exceptions is less than one, the abnormal access duration value of the target file is calculated using the following formula:

[0124] Abnormal access duration = (Number of normal visits × A1 + Number of abnormal visits × A2) / (Number of normal visits + Number of abnormal visits); where A1 and A2 are weighting coefficients, and A1 < A2;

[0125] Anomalies in access duration are compared to anomaly thresholds. If anomalies in access duration are greater than or equal to the threshold, the access duration is considered abnormal; if anomalies in access duration are less than the threshold, the access duration is considered normal.

[0126] If both the file access path and the file access duration are normal, no operation will be performed; if either the file access path or the file access duration is abnormal, the existence of an attack intent corresponding to the access operation of the target file will be determined.

[0127] The process for determining whether an access attempt has malicious intent is as follows:

[0128] Obtain the target file and get its original sequence YX.

[0129] After appending bits "1" to the original sequence, fill it with K zeros to obtain the processed sequence;

[0130] It should be noted that the processing sequence must satisfy the following condition: the processing sequence mod the preset divisor = the preset remainder; where the preset remainder is preferably 488 and the preset divisor is preferably 512.

[0131] The original sequence is converted into a 64-bit binary form and then concatenated after the processing sequence to obtain the calculation sequence;

[0132] The calculation sequence is divided into n 64-byte subsequences; the first 32 digits of the fractional part of the square root of the first eight prime numbers in the natural numbers are selected and then converted into hexadecimal representation to obtain eight initial check values. The eight initial check values ​​are used as the initial values ​​of the first check value to the eighth check value in turn, and the first check value to the eighth check value are denoted as JY1 to JY8 respectively.

[0133] The first check value to the eighth check value are sequentially appended to the first intermediate variable to the eighth intermediate variable, and the first intermediate variable to the eighth intermediate variable are denoted as BL1 to BL8 respectively; wherein, the initial value of the first intermediate variable to the eighth intermediate variable is 0;

[0134] The update function updates the first intermediate variable to the eighth update variable using formulas. The specific function is as follows:

[0135] T1=BL8+HS1(BL5)+HS2(BL5, BL6, BL7)+CS1+CS2;

[0136] T2=HS3(BL1)+HS4(BL1, BL2, BL3);

[0137] HS1(BL5)=(BL5>>6)⊕(BL5>>11)⊕(BL5>>25);

[0138] HS2(BL5,BL6,BL7)=(BL5∧BL6)⊕(¬BL5∧BL7);

[0139] HS3(BL1)=(BL1>>2)⊕(BL1>>13)⊕(BL1>>22);

[0140] HS4(BL1,BL2,BL3)=(BL1∧BL2)⊕(BL1∧BL3)⊕(BL2∧BL3);

[0141] CS1 is a constant, consisting of 64 predefined 32-bit constants; CS2 is the message word, which is extracted from the original sequence of the target file.

[0142] >>> represents a circular right shift operation, ¬ represents a logical right shift operation, ⊕ represents an XOR operation, and ∧ represents an intersection operation.

[0143] Update the first intermediate variable to the eighth intermediate variable:

[0144] BL8=BL7; BL7=BL6; BL6=BL5; BL5=BL4+T1; BL4=BL3; BL3=BL2; BL2=BL1; BL1=T1+T2;

[0145] It should be noted that in the above operations of updating the first intermediate variable to the eighth intermediate variable, "=" represents assignment, that is, assigning the value on the right side of the equals sign to the left side of the equals sign;

[0146] Add the updated first intermediate variable to the initial first check value to obtain the updated value of the first check value; similarly, obtain the updated values ​​of the second to eighth check values.

[0147] The above operation is iterated n times to obtain the final first to eighth check values. The first to eighth check values ​​are then concatenated to obtain the complete file check value corresponding to the initial state of the target file.

[0148] Similarly, calculate the file integrity check value of the target file after it has been accessed;

[0149] If the file integrity check value in the initial state is inconsistent with the file integrity check value after being accessed, it is determined that the access operation of the target file has an attack intent, indicating that the target file has been tampered with; otherwise, it is determined that the access operation of the target file does not have an attack intent, and no operation is performed.

[0150] Similarly, determine the existence of attack intent for all target files. If any access to a target file indicates an attack intent, add the IP address of the accessing user to the blacklist and send the blacklist to the storage terminal; otherwise, do not perform any operation.

[0151] The storage terminal is used to receive newly added blacklists, update them, and then store the updated blacklists.

[0152] In this application, if a corresponding calculation formula appears, the above calculation formula is a dimensionless calculation. The weighting coefficient, proportional coefficient and other coefficients in the formula are set to quantify each parameter to obtain a result value. The size of the weighting coefficient and proportional coefficient is only required to not affect the proportional relationship between the parameter and the result value.

[0153] Example 2, as Figure 3 As shown, based on another concept of the same invention, a network security collaborative integrated analysis method based on multimodal processing is proposed, including the following steps:

[0154] Step S101: Collect session access data and session log data of the user's corresponding session;

[0155] Step S102: Extract session access data and different types of data from the session access data, and classify them to obtain the packet quintuple and time features;

[0156] Step S103: Based on the packet quintuple and time characteristics, determine the security of the corresponding network node to be detected, and then add the access user corresponding to the session packet to the blacklist.

[0157] Step S104: Combine session log data to determine the security of the network nodes to be tested, and obtain the newly added blacklist.

[0158] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to specific implementations. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security collaborative integrated analysis system based on multimodal processing, characterized in that, It includes a data acquisition module, a feature extraction module, a data packet analysis module, a log analysis module, and a storage terminal; The data acquisition module is used to collect session access data and session log data of the corresponding session of the accessing user. The data acquisition module sends the session access data to the feature extraction module and the session log data to the log analysis module. The feature extraction module is used to extract and classify different types of data from the session access data, and send the data packet five-tuple and time features to the data packet analysis module. The packet analysis module is used to determine the security of the network node to be detected through the network analysis unit and the session analysis unit, count the total number of abnormal IP operations and the total number of abnormal port operations, and add the IP address or port number to the blacklist when either the total number of abnormal IP operations or the total number of abnormal port operations is greater than or equal to the corresponding threshold; generate a frequency abnormal signal when the average waiting time between noise-reduced packets is less than the average waiting time threshold, generate a rate abnormal signal when the average transmission rate is greater than or equal to the average transmission rate threshold, and add the source IP address to the blacklist when both frequency abnormal signals and rate abnormal signals exist, obtain the newly added blacklist and send it to the storage terminal; The log analysis module is used to determine the security of the network node to be detected by combining session log data. When the file access path does not match the access path baseline, the file access path is determined to be abnormal. When the abnormal access duration value is greater than or equal to the abnormal access duration threshold, the access duration is determined to be abnormal. When there is an abnormal file access path or an abnormal file access duration, the target file is determined to have an attack intent. The IP address of the user accessing any target file with an attack intent is added to the blacklist, and the newly added blacklist is sent to the storage terminal. The storage terminal is used to receive newly added blacklists, update them, and then store the updated blacklists.

2. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The session access data includes: the session data packets received by the pre-detection network node from the accessing user and the corresponding data packet size; the session log data includes the logs left by the accessing user after a series of operations during a session.

3. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The specific working process of the feature extraction module is as follows: Obtain session access data of the network node to be tested, and get multiple session data packets sent by the accessing user received by the corresponding network node to be tested; Extract the source IP, source port, destination IP, destination port, and sending protocol of each session data packet, and summarize them into a 5-tuple; Identify the timestamps of multiple session data packets, read the sending time of multiple session data packets, and arrange the session data packets in descending order of their timestamps; Obtain the start and end times of the corresponding data packet based on the timestamp of the session data packet; subtract the start time of the same session data packet from the end time to obtain the transmission duration of the corresponding session data packet; Identify the packet size of the session data packet, obtain the transmission rate by dividing the packet size by the transmission duration of the corresponding session data packet, obtain the inter-packet wait time of the current data packet by subtracting the transmission completion time of the previous data packet from the transmission start time of the current data packet, and use the inter-packet wait time and transmission rate as the time characteristics of the corresponding session.

4. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The specific working process of the network analysis unit is as follows: Obtain multiple packet 5-tuples to get the corresponding session packet's source IP, source port, destination IP, destination port, and packet sending protocol; If the source IP of the data packet is on the IP blacklist or the source port of the data packet is on the port blacklist, the corresponding session data packet is marked as a dangerous file and deleted; if the source IP of the data packet is not on the IP blacklist and the source port of the data packet is not on the port blacklist, proceed to the next step. Identify the node IP and node port corresponding to the network node to be detected; The node IP is compared with the destination IP of the data packet. If the node IP and the destination IP of the data packet are the same, proceed to the next step. If the node IP and the destination IP of the data packet are different, increment the abnormal IP operand of the source IP of the data packet by one.

5. The network security collaborative integrated analysis system based on multimodal processing according to claim 4, characterized in that, The working process of the network analysis unit also includes: Match the node port with the destination port of the data packet. If the node port contains the destination port of the data packet, proceed to the next step; if the node port does not contain the destination port of the data packet, increment the abnormal port operand of the source port of the data packet. And so on, perform the above operation on the packet 5-tuple of all session packets; Count the total number of abnormal IP operations for all source IPs and the total number of abnormal port operations for all source ports; The total number of abnormal IP operations and the total number of abnormal port operations are compared with the corresponding thresholds. If either the total number of abnormal IP operations or the total number of abnormal port operations is greater than or equal to the corresponding threshold, the corresponding IP address or port number is added to the blacklist and the session data packets received in this session are cleared. If neither the total number of abnormal IP operations nor the total number of abnormal port operations is less than the corresponding threshold, no operation is performed.

6. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The working process of the session analysis unit specifically includes: Obtain the temporal characteristics of session data packets to get the inter-packet wait time and transmission rate; sum the inter-packet wait times of all session data packets and take the average value to get the average inter-packet wait time. Based on the mean and duration of the session's waiting time, the standard deviation of the session's waiting time for the data packets is calculated. The first boundary value is obtained by subtracting the standard deviation of the room waiting time from the mean room waiting time, and the second boundary value is obtained by adding the mean room waiting time to the standard deviation of the room waiting time. The filtering range of the room waiting time corresponding to the session data packet is obtained with the first boundary value as the left endpoint and the second boundary value as the right endpoint. Room waiting times outside the filtering range are discarded. The average of the remaining packet waiting times is obtained by summing the remaining packet waiting times; The average waiting time of the denoised private rooms is compared with the average waiting time threshold. If the average waiting time of the denoised private rooms is less than the average waiting time threshold, a frequency anomaly signal is generated; if the average waiting time of the private rooms is greater than or equal to the average waiting time threshold, subsequent steps are performed. The transmission rates of the remaining session data packets are summed and averaged to obtain the average transmission rate. The average transmission rate is then compared with a threshold. If the average transmission rate is greater than or equal to the threshold, a rate anomaly signal is generated; otherwise, subsequent steps are performed. If both frequency and rate anomalies are present, the source IP address corresponding to the session data packet is added to the blacklist; otherwise, no action is taken.

7. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The analysis process of the log analysis module is as follows: Obtain session log data and extract session login logs from the session log data; based on the session login logs, obtain the start and end times of the accessing user; Extract timestamps from multiple system logs located between the start and end times of access. Based on reading the system logs, the target file accessed by the user is obtained, and the file access path, number of file accesses, and file access duration of the target file are obtained. Read the historical system logs of the target file over the past seven days as the training set, and obtain the historical access path, historical access count and historical access duration of the target file based on the historical system logs. The types of historical access paths are counted. If only one type exists, the corresponding historical access path is used as the access path baseline. If multiple types exist, the historical access path that appears most frequently is retained, and the other historical access paths and their corresponding historical system logs are discarded. The average historical access duration of the target file is obtained by summing all the historical access durations and then calculating the standard deviation of the historical access duration corresponding to the average historical access duration. Match the file access path of the target file with the access path baseline; If the file access path is different from the access path baseline, the file access path of the target file is considered abnormal. If the file access path is the same as the access path baseline, the file access path of the target file is considered to be normal, and the process proceeds to the next step.

8. The network security collaborative integrated analysis system based on multimodal processing according to claim 1, characterized in that, The analysis process of the log analysis module also includes: Calculate the access time deviation of the target file; Construct the normal interval standard, offset interval standard, and abnormal interval standard corresponding to the access duration deviation; Count the number of times the target file appears in the normal range, the number of times it appears in the offset range, and the number of times it appears in the abnormal range. If the number of exceptions is greater than or equal to one, the access duration is considered abnormal; if the number of exceptions is less than one, the abnormal access duration value of the target file is calculated. Anomalies in access duration are compared to anomaly thresholds. If anomalies in access duration are greater than or equal to the threshold, the access duration is considered abnormal; if anomalies in access duration are less than the threshold, the access duration is considered normal. If both the file access path and the file access duration are normal, no operation will be performed; if either the file access path or the file access duration is abnormal, the existence of an attack intent corresponding to the access operation of the target file will be determined. Similarly, determine the presence of attack intent for all target files. If any access to a target file indicates an attack intent, add the IP address of the accessing user to the blacklist; otherwise, do nothing.

9. The network security collaborative integrated analysis system based on multimodal processing according to claim 8, characterized in that, The process for determining whether an access request has malicious intent is as follows: Obtain the target file and get its original sequence. After appending bits "1" to the original sequence, fill it with K zeros to obtain the processed sequence; The original sequence is converted into a 64-bit binary form and then concatenated after the processing sequence to obtain the calculation sequence; The computation sequence is divided into n 64-byte computation subsequences; the first 32 digits of the fractional part of the square root of the first eight prime numbers in the natural numbers are selected and then converted into hexadecimal representation to obtain eight initial check values. The eight initial check values ​​are used as the initial values ​​of the first check value to the eighth check value in turn. The first check value to the eighth check value are sequentially appended to the first intermediate variable to the eighth intermediate variable; wherein the initial value of the first intermediate variable to the eighth intermediate variable is 0. Update functions that update the first intermediate variable up to the eighth update variable; Add the updated first intermediate variable to the initial first check value to obtain the updated value of the first check value; similarly, obtain the updated values ​​of the second to eighth check values. After iterating through the operation n times or more, the final first to eighth check values ​​are obtained. The first to eighth check values ​​are then concatenated to obtain the complete file check value corresponding to the initial state of the target file. Similarly, calculate the file integrity check value of the target file after it has been accessed; If the file integrity check value in the initial state is inconsistent with the file integrity check value after being accessed, the access operation to the target file is considered to have malicious intent; otherwise, the access operation to the target file is considered to have no malicious intent and no operation is performed.

10. A network security collaborative integrated analysis method based on multimodal processing, characterized in that, The method of the network security collaborative integrated analysis system based on multimodal processing according to any one of claims 1 to 9 includes: Step S101: Collect session access data and session log data of the user's corresponding session; Step S102: Extract session access data and different types of data from the session access data, and classify them to obtain the packet quintuple and time features; Step S103: Based on the packet quintuple and time characteristics, determine the security of the corresponding network node to be detected, and then add the access user corresponding to the session packet to the blacklist. Step S104: Combine session log data to determine the security of the network nodes to be tested, and obtain the newly added blacklist.

Images