Network intrusion prevention method and system based on embedded real-time operating system terminal

Abstract

The application provides a network intrusion prevention method and system based on an embedded real-time operating system terminal, relates to the technical field of network security, and comprises the following steps: acquiring network data packets, extracting a characteristic sequence and calculating a correlation strength, performing singular value decomposition to obtain main characteristic components, performing wavelet transformation and kernel density estimation in a dynamically adjusted sliding time window, calculating a comprehensive abnormal value and determining an interception parameter, accurately intercepting abnormal network data packets, and updating a security strategy according to a characteristic distribution.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network intrusion prevention method and system based on an embedded real-time operating system terminal. Background Technology

[0002] Embedded real-time operating system terminals are commonly used in fields such as industrial control, smart devices, and medical devices. Once they are subjected to network intrusion, they may cause serious security incidents and economic losses. Traditional network intrusion prevention methods are mainly based on feature matching and rule detection. They analyze and filter network data packets through a preset rule base to identify and block possible network attacks.

[0003] As network attack methods continue to evolve and become more complex, traditional network intrusion prevention methods suffer from several problems, including a lack of in-depth analysis of the correlation between features, resulting in limited ability to identify complex attack patterns, inability to dynamically adjust the analysis window according to network traffic characteristics, easy to cause missed or false alarms in abnormal traffic bursts or continuous attack scenarios, and lack of fine-grained defense mechanisms based on the severity of the attack, which can easily cause unnecessary impact on the normal operation of embedded real-time operating systems.

[0004] Therefore, a solution is urgently needed to address the problems existing in the current technology. Summary of the Invention

[0005] This invention provides a network intrusion prevention method and system based on an embedded real-time operating system terminal, which can at least solve some of the problems existing in the prior art.

[0006] A first aspect of this invention provides a network intrusion prevention method based on an embedded real-time operating system terminal, comprising:

[0007] Acquire network data packets from the embedded real-time operating system terminal;

[0008] Based on the communication characteristics of network data packets, feature numerical sequences are extracted. The correlation coefficients between each feature in the feature numerical sequence are calculated to construct a correlation coefficient matrix to obtain the correlation strength between features. Singular value decomposition is performed on the correlation strength to obtain the main feature components and their importance. The main feature components are sorted according to their importance. The main feature components with an importance greater than the preset importance threshold are selected, and the Euclidean distance with the abnormal features in the preset abnormal feature library is calculated to obtain the abnormality score.

[0009] The sliding time window length is dynamically adjusted based on the anomaly score. Wavelet transform is performed within the sliding time window to obtain the fluctuation characteristics of the feature components. Kernel density estimation is performed on the feature components to obtain the feature distribution curve. The JS divergence between the feature distribution curve and the normal traffic baseline distribution curve is calculated to obtain the degree of deviation. The degree of deviation is weighted with the anomaly score to obtain the comprehensive anomaly value, and the interception threshold and interception duration are determined.

[0010] Based on the interception threshold and interception duration, network intrusion prevention strategies are executed to intercept abnormal network data packets, and the security policy library is updated based on the feature distribution curve and the degree of deviation.

[0011] In one alternative implementation,

[0012] The network data packets acquired from the embedded real-time operating system terminal include:

[0013] Register a network interface listening process in the embedded real-time operating system, receive terminal network data packets transmitted by the network interface, and cache the received data packets in a preset data buffer;

[0014] Parse the header information of the network data packets in the data buffer, and extract the protocol type identifier, source address information, and destination address information from the header information;

[0015] Establish a corresponding data storage queue based on the protocol type identifier, and classify and store the network data packets into the corresponding data storage queue according to the source address information and the destination address information.

[0016] In one alternative implementation,

[0017] Feature numerical sequences are extracted based on the communication characteristics of network data packets. Correlation coefficients are calculated among the features in these sequences to construct a correlation coefficient matrix, yielding the correlation strength between features. Singular value decomposition is then performed on the correlation strength to obtain the main feature components and their importance, including:

[0018] The communication features of the network data packets are extracted to construct a feature value sequence. Standardization processing is performed on each feature component of the feature value sequence to generate standardized feature values.

[0019] Calculate the correlation coefficients between features based on the standardized eigenvalues, organize the correlation coefficients into a correlation coefficient matrix, perform singular value decomposition on the correlation coefficient matrix, and output a left singular vector matrix, a singular value diagonal matrix, and a right singular vector matrix.

[0020] extracting singular values in the singular value diagonal matrix, calculating a mode importance corresponding to each singular value and performing an accumulation operation according to a size order of the mode importance, and determining a number of singular values involved in the accumulation process as the number of principal components when the accumulation value first exceeds a preset mode importance threshold value;

[0021] filtering corresponding singular values in the singular value diagonal matrix according to the number of principal components, constructing a reduced dimension singular value diagonal matrix, selecting singular vectors corresponding to the number of principal components from the left singular vector matrix and the right singular vector matrix respectively, constructing a reduced dimension feature transformation matrix based on the selected singular vectors, multiplying the feature value sequence by the reduced dimension feature transformation matrix, and obtaining a reduced dimension main feature component.

[0022] In an optional implementation,

[0023] sorting the main feature components according to importance, selecting main feature components with importance greater than a preset threshold value, and calculating a Euclidean distance with an abnormal feature in a preset abnormal feature library to obtain an abnormality degree score, including:

[0024] obtaining a main feature component, performing a numerical integral operation on the main feature component through a pre-set parameterized neural network, and obtaining a dynamic evolution trajectory;

[0025] extracting an evolution feature index group from the dynamic evolution trajectory, and performing weighted summation on each index in the evolution feature index group to obtain importance, wherein the evolution feature index group includes a stability numerical index, an evolution speed numerical index, and an energy dissipation numerical index;

[0026] descendingly sorting the main feature components according to a numerical size of the importance, extracting main feature components with importance greater than a preset importance threshold value, comparing dynamic evolution trajectories of the extracted main feature components with dynamic evolution trajectories of abnormal features in a preset abnormal feature library, calculating an integral two-norm distance in an entire time interval, and obtaining a trajectory distance;

[0027] calculating a Euclidean distance between the extracted main feature component and an abnormal feature in the preset abnormal feature library, and normalizing the Euclidean distance by a Euclidean distance standard deviation;

[0028] normalizing the trajectory distance by a trajectory distance standard deviation, and performing an arithmetic average of the normalized Euclidean distance and the normalized trajectory distance to obtain an abnormality degree score.

[0029] In an optional implementation,

[0030] The length of the sliding time window is dynamically adjusted according to the abnormality degree score, wavelet transform operation is performed in the sliding time window to obtain the fluctuation characteristics of the feature components, and kernel density estimation operation is performed on the feature components to obtain the feature distribution curve, including:

[0031] An abnormality degree score is obtained, a nonlinear mapping function is constructed using an exponential function according to the abnormality degree score, the abnormality degree score is mapped into an interval between a preset minimum window length and a preset maximum window length, an exponential term of the nonlinear mapping function includes a negative value of a product of the abnormality degree score and an adjustment coefficient, and the length of the sliding time window is dynamically adjusted according to a calculation result of the nonlinear mapping function;

[0032] Continuous wavelet transform operation is performed on the feature components in the sliding time window, a Morlet wavelet function is used as a wavelet mother function, wavelet coefficients in a time-frequency domain are obtained through integral operation of the feature components and the Morlet wavelet function, an energy spectrum is calculated for the wavelet coefficients, and fluctuation characteristics of the feature components are obtained.

[0033] Kernel density estimation operation is performed on the feature components and the fluctuation characteristics corresponding to the feature components, a Gaussian kernel function is selected as a kernel function, an optimal bandwidth parameter is calculated according to a sample standard deviation, a quartile range and a sample number of the feature components by using the Silverman rule, the bandwidth parameter is substituted into the Gaussian kernel function, and a feature distribution curve of the feature components is obtained through convolution operation of the feature components and the Gaussian kernel function.

[0034] In an optional implementation,

[0035] The JS divergence of the feature distribution curve and the normal flow baseline distribution curve is calculated to obtain a deviation degree, a comprehensive abnormal value is calculated by weighting the deviation degree and the abnormality degree score, and the interception threshold and the interception time length are determined, including:

[0036] Time-sequentially adjacent feature distribution curves are obtained, a peak value drift amount, a curve shape change rate and a probability density change amount of the feature distribution curves are extracted to obtain a deformation feature sequence, and an evolution trend of the deformation feature sequence over time is calculated using a nonlinear state equation.

[0037] Based on the evolution trend, a deformation amount of the distribution curve per unit time is calculated to obtain an evolution speed feature sequence, a change rate of the evolution speed feature sequence is calculated to obtain an evolution acceleration feature sequence, abnormality identification is performed based on the evolution speed feature sequence and the evolution acceleration feature sequence, and an abnormal type of density evolution is obtained.

[0038] determine an influence interval range according to the abnormal type, multiply the influence interval range by a pre-obtained abnormal degree score to obtain a propagation influence index, accumulate the propagation influence index at different time scales to obtain a risk score sequence, compare a maximum value in the risk score sequence with a preset risk threshold to obtain a risk level;

[0039] calculate a JS divergence of the feature distribution curve and a pre-set normal flow baseline distribution curve to obtain a deviation degree, weight the deviation degree and the abnormal degree score to obtain a comprehensive abnormal value, and determine an interception threshold and an interception duration according to the comprehensive abnormal value and the risk level.

[0040] In an optional implementation,

[0041] According to the interception threshold and the interception duration, an network intrusion prevention policy is executed to intercept abnormal network data packets, and a security policy library is updated based on the feature distribution curve and the deviation degree, including:

[0042] According to the interception threshold, the abnormal network data packets are marked, and within the interception duration, blocking, speed limiting and redirection operations are performed on the marked abnormal network data packets.

[0043] The peak value and the morphological features of the feature distribution curve are stored as a new feature template in the security policy library, and the deviation degree is updated as an abnormality determination threshold for defense rules, for subsequent identification and defense of abnormal flow.

[0044] In a second aspect of the embodiment of the application, a network intrusion prevention system based on an embedded real-time operating system terminal is provided, including:

[0045] A first unit is configured to acquire network data packets of the embedded real-time operating system terminal.

[0046] A second unit is configured to extract a feature value sequence according to communication features of the network data packets, calculate correlation coefficients between features in the feature value sequence to construct a correlation coefficient matrix and obtain correlation strengths between features, perform singular value decomposition operation on the correlation strengths to obtain main feature components and importance degrees, sort the main feature components according to the importance degrees, select main feature components with importance degrees greater than a pre-set importance degree threshold, and calculate Euclidean distances between the main feature components and abnormal features in a pre-set abnormal feature library to obtain an abnormal degree score.

[0047] The third unit is configured to dynamically adjust the length of the sliding time window according to the abnormality degree score, perform wavelet transform operation in the sliding time window to obtain the fluctuation characteristics of the feature components, perform kernel density estimation operation on the feature components to obtain the feature distribution curve, calculate the JS divergence of the feature distribution curve and the normal flow baseline distribution curve to obtain the deviation degree, and calculate the comprehensive abnormal value by weighting the deviation degree and the abnormality degree score, and determine the interception threshold and the interception duration.

[0048] The fourth unit is configured to intercept the abnormal network data packets according to the interception threshold and the interception duration, and update the security policy library based on the feature distribution curve and the deviation degree.

[0049] In a third aspect, the embodiment of the present application provides an electronic device, comprising:

[0050] a processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0051] In a fourth aspect, the embodiment of the present application provides a computer readable storage medium, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0052] In the present application, the main feature components of the network data packets are extracted by using the correlation coefficient matrix and the singular value decomposition method, and the abnormality degree score is calculated by comparing with the preset abnormal feature library, thereby realizing the efficiency and accuracy of feature extraction, and greatly improving the accuracy of network intrusion detection. The dynamic sliding time window is combined with the wavelet transform and the kernel density estimation technology, which can more comprehensively capture the fluctuation characteristics and distribution characteristics of the network flow. The deviation degree is calculated by the JS divergence, the abnormal situation is comprehensively evaluated, the false positive rate is significantly reduced, the interception threshold and the duration are dynamically determined based on the comprehensive abnormal value, the security policy library can be updated according to the real-time detection result, the adaptive adjustment and continuous optimization of the network defense mechanism are realized, the system defense capability is continuously improved, and the present application is especially suitable for the resource-limited embedded real-time operating system environment. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 FIG. 1 is a flowchart of the network intrusion prevention method based on the embedded real-time operating system terminal according to the embodiment of the present application;

[0054] Figure 2 FIG. 2 is a feature distribution curve analysis and abnormal interception flowchart of the network intrusion prevention method based on the embedded real-time operating system terminal according to the embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0056] The technical solutions of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and some embodiments may not be described again for the same or similar concepts or processes.

[0057] Figure 1 The flowchart of the network intrusion prevention method based on the embedded real-time operating system terminal of the embodiments of the present application is shown in FIG. 1, which comprises the following steps. Figure 1

[0058] Obtaining the network data packet of the embedded real-time operating system terminal;

[0059] According to the communication characteristics of the network data packet, a characteristic value sequence is extracted, a correlation coefficient matrix is constructed by calculating the correlation coefficients between the characteristics in the characteristic value sequence to obtain the correlation strength between the characteristics, a singular value decomposition operation is performed on the correlation strength to obtain the main characteristic components and the importance, the main characteristic components are sorted according to the importance, the main characteristic components with an importance greater than a preset importance threshold are selected, and the Euclidean distance between the selected main characteristic components and the abnormal characteristics in the preset abnormal characteristic library is calculated to obtain an abnormal degree score;

[0060] According to the abnormal degree score, the length of the sliding time window is dynamically adjusted, a wavelet transform operation is performed in the sliding time window to obtain the fluctuation characteristics of the characteristic components, a kernel density estimation operation is performed on the characteristic components to obtain a characteristic distribution curve, a JS divergence is calculated between the characteristic distribution curve and a normal flow baseline distribution curve to obtain a deviation degree, a comprehensive abnormal value is calculated by weighting the deviation degree and the abnormal degree score, an interception threshold and an interception duration are determined;

[0061] According to the interception threshold and the interception duration, a network intrusion prevention strategy is executed to intercept abnormal network data packets, and a security policy library is updated based on the characteristic distribution curve and the deviation degree.

[0062] In an optional embodiment,

[0063] Obtaining the network data packet of the embedded real-time operating system terminal comprises:

[0064] Registering a network interface listening process in the embedded real-time operating system, receiving the terminal network data packet transmitted by the network interface, and buffering the received data packet to a preset data buffer.​

[0065] Parsing the packet header information of the network data packet in the data buffer, extracting the protocol type identifier, source address information and target address information from the packet header information;

[0066] According to the protocol type identifier, a corresponding data storage queue is established, and the network data packet is classified and stored into the corresponding data storage queue according to the source address information and the target address information.

[0067] In the embedded real-time operating system, a network interface monitoring process is registered, a system API function registerNetworkMonitor() is called, the function contains a network interface identifier and a callback function parameter. The callback function is automatically triggered when the network data packet arrives, ensuring real-time response to network traffic. The monitoring process detects the network interface state every 10 milliseconds through polling, or triggers processing immediately when the data packet arrives in the interrupt-driven mode.

[0068] In the process of receiving the terminal network data packet transmitted by the network interface, the recvPacket() function is called to read the original data packet from the network interface, and the zero-copy technology is used to directly map the data to the memory buffer, avoiding additional memory copy operations. The preset data buffer adopts a ring buffer structure, and the default size is 4MB, which can be dynamically adjusted according to the resource situation. The ring buffer contains a read pointer and a write pointer. When a new data packet is written, the write pointer moves forward, and when the data packet is processed, the read pointer moves forward. When the buffer occupancy exceeds 75%, the alarm mechanism is triggered and the buffer size is temporarily increased or the data processing rate is accelerated.

[0069] Parsing the packet header information of the network data packet in the data buffer, calling the parsePacketHeader() function to analyze the data packet header. For Ethernet frames, the first 14 bytes are parsed to obtain the target MAC address (6 bytes), the source MAC address (6 bytes) and the Ethernet type (2 bytes). For IP packets, the IP header (usually 20 bytes) is parsed to extract the version number, header length, service type, total length, identification, flag, fragment offset, time to live, protocol, header checksum, source IP address and target IP address. The protocol type identifier is obtained by extracting the 9th byte of the IP header, for example, the value 6 represents the TCP protocol, the value 17 represents the UDP protocol, and the value 1 represents the ICMP protocol. The source address and target address information are extracted from the 13th-16th byte and the 17th-20th byte of the IP header respectively, and are formatted as dotted decimal representation. For IPv6 packets, 128-bit address information is extracted from the corresponding fields, and the checksum value is checked to ensure the integrity of the data packet. If the checksum does not match, the data packet is marked as suspicious and an exception log is recorded.

[0070] According to the protocol type identifier, a corresponding data storage queue is established, a createQueueByProtocol() function is called to dynamically create a data structure, a TCP data queue is established for a TCP protocol (type value 6), a UDP data queue is established for a UDP protocol (type value 17), and an ICMP data queue is established for an ICMP protocol (type value 1). Other protocol types are classified into a general protocol queue. Each queue is implemented in a linked list structure, including a head pointer and a tail pointer, supporting FIFO (First In First Out) operation. The queue node includes a packet pointer, a timestamp, a source address, a target address, and a protocol type field. The default maximum length of each queue is 1000 packets, and when the threshold is exceeded, automatic expansion or a processing mechanism is triggered. The queue is allocated independent memory space when created, and relevant counters and state flags are initialized.

[0071] According to the source address information and the target address information, the network data packets are classified and stored in the corresponding data storage queue, and a classifyAndStore() function is called for processing. A hash table structure is established, the key value is the combination of the source address and the target address, and it points to the corresponding data sub-queue. The hash function uses the bit operation of each byte of the 32-bit IP address to obtain the modulus, and the collision processing uses the chain address method. For a TCP connection, a session tracking mechanism is established based on the five-tuple (source IP, source port, target IP, target port, protocol type). For UDP communication, classification is performed based on the four-tuple (source IP, source port, target IP, target port). The capacity upper limit is set for each classification queue, and the default is 500 packets. When the threshold is exceeded, an alarm or old packets may be discarded. During the classification and storage process, frequency monitoring is set for the case of a single source address sending a large number of data packets in a short time. When the data packet rate of a single source address exceeds a predetermined threshold (such as 100 per second), it is marked as a potential DDoS attack and the related data packets are stored in a high-risk queue.

[0072] In this embodiment, by registering a network interface listening process in the embedded real-time operating system, real-time reception and caching of terminal network data packets are realized, avoiding loss of data packets during transmission. By analyzing the packet header information and extracting the protocol type identifier, source address information, and target address information, fast classification of network data packets is realized. According to the protocol type identifier, a corresponding data storage queue is established, and according to the source address and target address information, the network data packets are classified and stored, effectively improving the storage efficiency of data packets and the subsequent processing speed.

[0073] In an alternative embodiment,

[0074] According to the communication characteristics of network packets, a feature value sequence is extracted, a correlation coefficient matrix is constructed by calculating the correlation coefficients between features in the feature value sequence to obtain the correlation strength between features, and a main feature component and an importance degree are obtained by performing singular value decomposition operation on the correlation strength, including:

[0075] The communication characteristics of the network packets are extracted to construct a feature value sequence, and a standardization process is performed on each feature component of the feature value sequence to generate a standardized feature value.

[0076] According to the standardized feature value, a correlation coefficient between features is calculated, the correlation coefficient matrix is organized into a correlation coefficient matrix, and a left singular vector matrix, a singular value diagonal matrix, and a right singular vector matrix are output by performing singular value decomposition operation on the correlation coefficient matrix.

[0077] The singular values in the singular value diagonal matrix are extracted, the mode importance corresponding to each singular value is calculated, and an accumulation operation is performed according to the size order of the mode importance. When the accumulation value first exceeds a preset mode importance threshold, the number of singular values involved in the accumulation process is determined as the number of principal components.

[0078] According to the number of principal components, the corresponding singular values in the singular value diagonal matrix are screened, a reduced singular value diagonal matrix is constructed, the singular vectors corresponding to the number of principal components are selected from the left singular vector matrix and the right singular vector matrix, respectively, and a reduced feature transformation matrix is constructed based on the selected singular vectors. The feature value sequence is multiplied by the reduced feature transformation matrix to obtain the reduced main feature component.

[0079] The communication characteristics of the network packets are extracted to construct a feature value sequence, and the extractFeatures() function is called to process the packets. The communication characteristics include packet size, arrival time interval, protocol type, port number, flag state, connection duration, data transmission rate, retransmission rate, and other indicators. For TCP packets, the SYN, ACK, FIN, RST, and other flag states are extracted. For UDP packets, the packet length distribution is recorded. For ICMP packets, the type and code fields are extracted. The feature values are quantized into numerical values, such as converting TCP flags into binary values, mapping protocol types to integers (TCP=6, UDP=17, ICMP=1), and converting time intervals to millisecond counts. For N consecutive packets, an M-dimensional feature vector is constructed to form an N×M feature value sequence matrix.

[0080] The standardization processing is performed on each feature component of the feature value sequence, and the normalizeFeatures() function is called for calculation. The standardization processing adopts the Z-score method, calculates the average value and standard deviation of each feature component, and obtains the standardized feature value by subtracting the average value from the original feature value and dividing by the standard deviation. The standardization processing makes the dimensions of the features consistent and eliminates the influence of dimensional differences on subsequent analysis. Taking the data packet size feature as an example, assuming that the original data is [64, 1500, 256, 512, 128] bytes, the average value is calculated to be 492 bytes, and the standard deviation is about 573.94 bytes. After standardization, [-0.75, 1.76, -0.41, 0.03, -0.63] is obtained. The standardization processing ensures that each feature is in a similar numerical range, preventing some features with large values from dominating the analysis results.

[0081] When calculating the correlation coefficient between the features according to the standardized feature values, the calculateCorrelation() function is called, and the Pearson correlation coefficient calculation method is used to calculate the correlation coefficient. The covariance of any two feature vectors is calculated and divided by the product of the respective standard deviations. The correlation coefficient has a value range of [-1, 1], where 1 represents complete positive correlation, -1 represents complete negative correlation, and 0 represents no correlation. The correlation coefficients between all features are organized into an MxM correlation coefficient matrix R. The correlation coefficient matrix has a symmetric structure, and the diagonal elements are all 1.

[0082] The singular value decomposition operation is performed on the correlation coefficient matrix, and the computeSVD() function is called for processing. Singular value decomposition decomposes the correlation coefficient matrix R into the product of three matrices: the left singular vector matrix U, the singular value diagonal matrix S, and the transpose of the right singular vector matrix V. U and V are both orthogonal matrices, and S is a diagonal matrix with singular values on the diagonal, arranged in descending order.

[0083] When extracting singular values in the singular value diagonal matrix, the extractSingularValues() function is called to obtain the diagonal elements from the matrix S. The singular values represent the variance contribution of each principal component in the data set, and the principal component corresponding to the larger singular value contains more information of the original data. The mode importance corresponding to each singular value is calculated by calling the calculateImportance() function, and the mode importance is the square of the singular value divided by the sum of the squares of all singular values. For example, for the extracted 5 singular values [4.2, 2.8, 1.5, 0.9, 0.6], the calculated mode importance is [0.49, 0.22, 0.06, 0.02, 0.01] respectively. According to the order of the mode importance, the accumulation operation is performed, and when the accumulation value first exceeds the preset mode importance threshold (usually set to 0.85 or 0.9), the number of singular values involved in the accumulation process is determined as the number of principal components. In the above example, if the threshold is set to 0.85, the accumulation process is 0.49→0.71→0.77→0.79→0.80, and the principal components corresponding to the first 4 singular values are taken.

[0084] According to the number of principal components, the singular values in the singular value diagonal matrix are filtered, and the filterSingularValues() function is called to retain the first k singular values (k is the number of principal components) and set the remaining singular values to 0, thereby constructing the singular value diagonal matrix S' after dimension reduction. When selecting singular vectors corresponding to the number of principal components from the left singular vector matrix and the right singular vector matrix, the selectSingularVectors() function is called to retain the first k columns of the U matrix and the V matrix, thereby forming the U' and V' matrices after dimension reduction. Based on the selected singular vectors, the feature transformation matrix T after dimension reduction is constructed by calculating the product of U' and S'. The feature value sequence is multiplied by the feature transformation matrix after dimension reduction, and the transformFeatures() function is called to obtain the main feature components after dimension reduction.

[0085] In this embodiment, by calculating the feature correlation coefficient matrix and performing singular value decomposition operation, the internal correlation between the features is effectively captured, the number of principal components is adaptively determined based on the accumulation operation of the mode importance, which avoids unreasonable dimension selection caused by manual setting, and by constructing the feature transformation matrix after dimension reduction and extracting the main feature components, the key information of the data packet is retained while the data dimension is significantly reduced, the calculation resource consumption is reduced, the accuracy of subsequent analysis is ensured, and the processing efficiency is improved.

[0086] In an alternative embodiment,

[0087] The main characteristic components are sorted according to importance, main characteristic components with importance greater than a preset threshold are selected, and the Euclidean distance with the abnormal features in the preset abnormal feature library is calculated to obtain an abnormality degree score, including:

[0088] The main characteristic components are obtained, numerical integration is performed on the main characteristic components by a pre-set parameterized neural network to obtain a dynamic evolution trajectory;

[0089] Evolution characteristic index groups are extracted from the dynamic evolution trajectory, and the importance is obtained by weighted sum of each index in the evolution characteristic index group, wherein the evolution characteristic index group includes stability numerical index, evolution speed numerical index and energy dissipation numerical index;

[0090] The main characteristic components are sorted in descending order according to the numerical value of the importance, the main characteristic components with importance greater than a preset importance threshold are extracted, the dynamic evolution trajectory of the extracted main characteristic components is compared with the dynamic evolution trajectory of the abnormal features in the preset abnormal feature library, the integral two norm distance in the whole time interval is calculated to obtain a trajectory distance;

[0091] The Euclidean distance between the extracted main characteristic components and the abnormal features in the preset abnormal feature library is calculated, and the Euclidean distance is standardized by dividing by the standard deviation of the Euclidean distance;

[0092] The trajectory distance is standardized by dividing by the standard deviation of the trajectory distance, the standardized Euclidean distance and the standardized trajectory distance are arithmetically averaged to obtain an abnormality degree score.

[0093] After obtaining the main characteristic components, the neuralNetworkIntegration() function is called to perform numerical integration on the main characteristic components by a pre-set parameterized neural network, a multi-layer perceptron structure is adopted, including an input layer, a hidden layer and an output layer, the number of nodes in the input layer is the same as the dimension of the main characteristic components, the hidden layer adopts a double-layer structure, each containing 16 neurons, and the activation function selects ReLU function. Neural network weight parameters are obtained by pre-training and stored in the non-volatile memory of the embedded device. Numerical integration adopts the fourth-order Runge-Kutta algorithm to solve ordinary differential equations, wherein the variable represents the characteristic state vector, the independent variable represents time, the right side of the equation is a nonlinear function defined by the neural network, the integration step is set to 0.01 seconds, the total integration time is 10 seconds, and a dynamic evolution trajectory with 1000 points is generated. During the integration process, each step includes four function evaluations, which are calculated at the current point, the intermediate point and the end point, and the next state value is obtained by combining the four evaluation results.

[0094] The evolution characteristic index group is extracted from the dynamic evolution trajectory, the extractEvolutionMetrics() function is called for processing, the stability numerical index is obtained by calculating the Lyapunov index of the trajectory in the phase space, the calculation method is to select two adjacent points on the trajectory, calculate the change rate of the distance between the two points with time, exemplarily, take N adjacent point pairs, calculate the natural logarithm of the distance ratio of each pair of points, take the average value to obtain the stability index, and the instantaneous speed is obtained by calculating the Euclidean distance of adjacent points in the trajectory divided by the time interval, and the average value of the instantaneous speed of the whole trajectory is obtained. The energy dissipation numerical index is obtained by defining the energy function as the sum of squares of the state vector, calculating the change rate of the energy function with time, integrating the absolute value of the change rate over the whole trajectory and normalizing to obtain the energy dissipation index. The weighted sum of each index in the evolution characteristic index group is called the weightedSum() function, and the stability index, evolution speed index and energy dissipation index are respectively assigned weight coefficients of 0.4, 0.35 and 0.25. The importance value is obtained by weighted sum.

[0095] The main characteristic components are sorted in descending order according to the numerical size of the importance, the sortByImportance() function is called, the quicksort algorithm is used, the time complexity is O(n log n), and the space complexity is O(log n). The key value pair of feature index and importance value is used in the sorting process, and the correspondence between the original feature and the importance is maintained. When extracting the main characteristic components with importance greater than the preset importance threshold, the threshold is set to 0.65, the linear scanning method is used to traverse the sorted feature list, and only the characteristic components with importance greater than the threshold are retained. The dynamic evolution trajectory of the extracted main characteristic component is compared with the dynamic evolution trajectory of the abnormal feature in the preset abnormal feature library, and the compareTrajectories() function is called to realize it. The preset abnormal feature library is stored in a hash table structure, the key is the attack type identifier, and the value is the corresponding feature trajectory data. In the comparison process, the integral two norm distance in the whole time interval is calculated, the Euclidean distance square of the two trajectories at each corresponding time point is summed, and the trajectory distance value is obtained by square root.

[0096] The Euclidean distance between the extracted main feature components and the abnormal features in the preset abnormal feature library is calculated, and the calculateEuclideanDistance() function is called to receive two feature vectors as input to calculate the Euclidean distance. The implementation is to calculate the square sum of the difference between the two vectors and then take the square root. The Euclidean distance is standardized by dividing the Euclidean distance by the standard deviation of the Euclidean distance, and the standard deviation value is obtained by statistical analysis of historical data. The standard deviation is calculated based on all Euclidean distance samples observed in a period of time (such as the last 24 hours), and the standard deviation is obtained using an unbiased estimation method. The standardized value is obtained by dividing the original Euclidean distance by the standard deviation.

[0097] The trajectory distance is standardized by dividing the trajectory distance by the standard deviation of the trajectory distance, and the standard deviation is calculated using historical trajectory distance data. The normalized trajectory distance is obtained by normalizing the standardized trajectory distance. The standardized Euclidean distance and the standardized trajectory distance are arithmetically averaged to obtain an abnormality degree score. The abnormality degree score is used as an index to quantify the degree of network traffic anomaly, which is used for subsequent decision-making.

[0098] For example, the embedded terminal monitors a set of network traffic and extracts 5-dimensional main feature components [0.83, -0.42, 0.65, 0.21, -0.37]. Numerical integration is performed by a parameterized neural network to generate a dynamic evolution trajectory containing 1000 points. The first point in the trajectory is [0.83, -0.42, 0.65, 0.21, -0.37], the second point is [0.85, -0.41, 0.67, 0.20, -0.36], and so on.

[0099] The evolution feature index is extracted from the trajectory: the stability index is calculated to be 0.78, indicating that the divergence degree of the trajectory is moderate; the evolution speed index is calculated to be 0.92, indicating that the feature changes quickly; the energy dissipation index is calculated to be 0.85, indicating that the energy changes significantly. According to the weight coefficients 0.4, 0.35 and 0.25, the weighted sum is calculated to obtain the importance degree of 0.84.

[0100] According to the importance of the feature components, the sorting result is [-0.42, 0.83, 0.65, -0.37, 0.21], and the corresponding importance values are [0.91, 0.84, 0.73, 0.61, 0.52]. The features with importance greater than 0.65 are extracted, and the three components [-0.42, 0.83, 0.65] are obtained, which correspond to the 2nd, 1st and 3rd components of the original features. The dynamic evolution trajectories of these features are compared with the DDoS attack feature trajectories in the preset abnormal feature library. The first point of the DDoS attack feature trajectory is [-0.45, 0.79, 0.68], the second point is [-0.46, 0.80, 0.70], and so on. The sum of the squared Euclidean distances of the two trajectories at 1000 time points is 5.6169, and the square root of the squared Euclidean distance is 2.37. The Euclidean distance between the feature vector [-0.42, 0.83, 0.65] and the DDoS attack feature [-0.45, 0.79, 0.68] is 1.82. The Euclidean distance standard deviation 0.45 and the trajectory distance standard deviation 0.62 obtained by historical statistics are used for standardization, and the standardized Euclidean distance is 4.04, the standardized trajectory distance is 3.82, and the abnormality degree score is 3.93.

[0101] In this embodiment, numerical integration operation is performed on the main feature components by parameterized neural network, which realizes accurate description of the dynamic evolution characteristics of network data packets. The stability, evolution speed and energy dissipation and other multi-dimensional evolution feature indicators are extracted and weighted to calculate the importance, which comprehensively reflects the dynamic change law of the feature components. Based on the importance screening and dynamic evolution trajectory comparison, the data components with abnormal features are effectively identified. The dual measurement of Euclidean distance and trajectory distance is adopted and standardized, which comprehensively evaluates the static deviation and dynamic change characteristics of the features, considers the instantaneous deviation of the feature value, and reflects the abnormality degree of the evolution process, thereby improving the accuracy and reliability of the anomaly detection.

[0102] In an alternative embodiment,

[0103] According to the abnormality degree score, the length of the sliding time window is dynamically adjusted, the wavelet transform operation is performed in the sliding time window to obtain the fluctuation characteristics of the feature components, and the kernel density estimation operation is performed on the feature components to obtain the feature distribution curve.

[0104] An abnormality degree score is obtained, a nonlinear mapping function is constructed using an exponential function according to the abnormality degree score, the abnormality degree score is mapped to an interval between a preset minimum window length and a preset maximum window length, an exponential term of the nonlinear mapping function includes a negative value of a product of the abnormality degree score and an adjustment coefficient, and the length of the sliding time window is dynamically adjusted according to the calculation result of the nonlinear mapping function.

[0105] The continuous wavelet transform operation is performed on the feature component within the sliding time window, a Morlet wavelet function is used as a wavelet mother function, a wavelet coefficient in a time-frequency domain is obtained through an integral operation of the feature component and the Morlet wavelet function, an energy spectrum is calculated for the wavelet coefficient, and a wave fluctuation characteristic of the feature component is obtained;

[0106] The kernel density estimation operation is performed on the feature component and the wave fluctuation characteristic corresponding to the feature component, a Gaussian kernel function is selected as a kernel function, an optimal bandwidth parameter is calculated according to a sample standard deviation, a quartile range and a sample number of the feature component by using the Silverman rule, the bandwidth parameter is substituted into the Gaussian kernel function, and a feature distribution curve of the feature component is obtained through a convolution operation of the feature component and the Gaussian kernel function.

[0107] After the abnormality degree score is obtained, a calculateWindowLength() function is called to construct a nonlinear mapping function, and the abnormality degree score is mapped to between a preset minimum window length and a preset maximum window length. The preset minimum window length is set to 500 milliseconds, and the preset maximum window length is set to 5000 milliseconds. The minimum window length and the maximum window length can be adjusted according to the processing capability of the embedded device and the network environment. The nonlinear mapping function adopts an exponential decay form, wherein the exponential term includes a negative value of a product of the abnormality degree score and an adjustment coefficient. The adjustment coefficient is set to 0.25 by default, and the adjustment coefficient value controls the steepness of the mapping curve and can be modified through a configuration file. The implementation of the exponential function is as follows: first, the abnormality degree score is multiplied by the adjustment coefficient to obtain a product, the negative value of the product is taken, the power of e is calculated, the result is multiplied by a window length difference value, and the minimum window length is added. The advantage of using the exponential mapping function is that the window length is close to the minimum value when the abnormality degree is high, the detection sensitivity is improved, and the window length is close to the maximum value when the abnormality degree is low, the calculation overhead is reduced.

[0108] The sliding time window length is dynamically adjusted according to the calculation result of the nonlinear mapping function, an adjustTimeWindow() function is called, a new window length value is received, internal time window parameters are updated, and a memory buffer area is reallocated to adapt to the new window size. When the window length decreases, only the latest data is retained; when the window length increases, the original data is retained and new space is reserved. The sliding window implementation adopts a circular buffer structure, including a head pointer, a tail pointer and a capacity parameter, supporting efficient data appending and expired data removal operations. The window sliding step is set to 10% of the window length, ensuring that there is 90% overlap between windows, enhancing the continuity and stability of detection. The window data sampling rate is set to 100 Hz, that is, feature data is collected every 10 milliseconds, ensuring that high-frequency network events are captured.

[0109] The continuous wavelet transform operation is performed on the feature component in the sliding time window, a waveletTransform() function is called, and a Morlet wavelet function is used as a wavelet mother function. The Morlet wavelet has good time-frequency positioning capability and is suitable for analyzing the mutation characteristics of network traffic. The wavelet mother function parameters are set as follows: a center frequency of 6 rad / s and a bandwidth parameter of 1.5, to ensure the sensitivity to network anomalies. The continuous wavelet transform obtains wavelet coefficients in the time-frequency domain through integral operation of the feature component and wavelet functions of different scales. In specific implementation, the scale parameter is exponentially increased by 2 from 1 to 64, to generate 6 scale layers. For each scale, the convolution of the wavelet function and the feature component is calculated to obtain a wavelet coefficient sequence of the corresponding scale. The convolution operation uses fast Fourier transform optimization to convert time domain convolution to frequency domain multiplication.

[0110] The energy spectrum is calculated for the wavelet coefficients, a calculateEnergySpectrum() function is called, the sum of squares of the wavelet coefficients at each scale is calculated, and the energy distribution of each frequency interval is obtained. The energy spectrum calculation uses a sliding average method, with a window size of 20 sample points, to ensure the smoothness of the energy estimation. For a network attack with strong mutation, the energy spectrum will show obvious peaks in the high-frequency region; for a persistent attack, the energy spectrum will have a sustained increase in the medium and low frequency regions. The fluctuation characteristics are obtained by calculating the statistical characteristics of the energy spectrum, including the energy proportion of each frequency band, the energy center frequency, the energy dispersion, and other indicators. The fluctuation characteristics indicators are organized in the form of a feature vector, which is used as the input of the subsequent kernel density estimation.

[0111] The kernel density estimation operation is performed on the feature component and the fluctuation characteristics corresponding to the feature component, a kernelDensityEstimation() function is called, and a Gaussian kernel function is selected as the kernel function. The Gaussian kernel has good smoothness and simple calculation. The key parameter of the kernel density estimation is the bandwidth, which determines the smoothness of the estimation result. The Silverman rule is used to calculate the optimal bandwidth parameter according to the sample standard deviation, quartile range, and sample size of the feature component. In specific implementation, after calculating the sample standard deviation, the sample quartile range (75th percentile minus 25th percentile) is calculated, and the smaller one of the two is divided by 1.34 to obtain the robust standard deviation estimate. The optimal bandwidth calculation considers the influence of the sample size. The larger the sample size, the smaller the bandwidth, and the more accurate the estimation result.

[0112] The bandwidth parameter is substituted into the Gaussian kernel function to construct a standard form of Gaussian density function, with the center at 0 and the standard deviation equal to the bandwidth value. The feature distribution curve of the feature component is obtained through the convolution operation of the feature component and the Gaussian kernel function. The convolution operation is implemented by calculating the distance between each estimation point and all sample points, substituting the distance into the Gaussian kernel function to obtain the weight, and the weighted sum of all weights is the density estimation value of the point. To improve the calculation efficiency, only the sample points within 3 times the bandwidth range are considered, and the points beyond this range have little contribution to the result. The selection of the estimation point uses an adaptive grid, which uses a finer grid in the dense data distribution area to improve the estimation accuracy of the key area.

[0113] Exemplarily, the embedded terminal detects suspicious network traffic, and the abnormality degree score is calculated to be 4.2. The length of the sliding time window is calculated through the nonlinear mapping function, 4.2 is multiplied by 0.25 to obtain 1.05, the negative value is obtained as -1.05, the -1.05 power of e is about 0.35, 0.35 is multiplied by the window length difference 4500 milliseconds to obtain 1575 milliseconds, and the minimum window length 500 milliseconds is added to obtain the final window length of 2075 milliseconds. About 208 feature sample points are collected in the window, the network packet arrival interval time is extracted as the feature component, and the sample value is [12, 15, 11, 13, 9, 40, 8, 7, 12, 11,...] milliseconds. The continuous wavelet transform is performed on the feature component to obtain a wavelet coefficient matrix of 6 scale layers. The energy spectrum is calculated to obtain the energy values of each frequency band [0.42, 0.28, 0.15, 0.08, 0.05, 0.02], which indicates that most of the energy is concentrated in the high frequency region, suggesting that the network traffic has a mutation characteristic. The fluctuation characteristic index is extracted to obtain the feature vector [0.42, 0.28, 1.75, 0.63], wherein 1.75 is the energy center frequency and 0.63 is the energy dispersion degree.

[0114] When the kernel density estimation is performed on the feature component, the sample standard deviation is calculated to be 8.3 milliseconds, the interquartile range is 5.4 milliseconds, the interquartile range divided by 1.34 is 4.03 milliseconds, and the smaller of the two values 4.03 milliseconds is taken as the robust standard deviation estimation. Considering the number of samples 208, the optimal bandwidth is calculated to be 1.06 milliseconds. The Gaussian kernel function is constructed using the bandwidth parameter, and the feature distribution curve is obtained through the convolution operation. The feature distribution curve has a main peak near 10 milliseconds, indicating a normal network traffic mode, and a small peak near 40 milliseconds, indicating possible abnormal behavior.

[0115] In this embodiment, by constructing a nonlinear mapping function based on the abnormal degree score, the adaptive adjustment of the sliding time window length is realized, so that the window length can dynamically change according to the abnormal degree, and the timeliness and accuracy of feature extraction are improved. The continuous wavelet transform using the Morlet wavelet function can effectively capture the local change characteristics of feature components in the time-frequency domain, obtain more detailed fluctuation characteristic information, and realize accurate estimation of feature distribution by using the kernel density estimation method combined with the Gaussian kernel function and the Silverman rule to adaptively calculate the optimal bandwidth parameter. Both parameter estimation bias and distribution form smoothness and continuity are avoided, and reliable feature representation is provided for subsequent abnormal traffic identification.

[0116] In an optional implementation,

[0117] The JS divergence of the feature distribution curve and the normal traffic baseline distribution curve is calculated to obtain the deviation degree, the deviation degree and the abnormal degree score are weighted to obtain a comprehensive abnormal value, and the interception threshold and the interception time length are determined.

[0118] The time-series adjacent feature distribution curves are obtained, the peak shift amount, the curve shape change rate and the probability density change amount of the feature distribution curve are extracted to obtain a deformation feature sequence, and a nonlinear state equation is used to calculate the evolution trend of the deformation feature sequence over time.

[0119] Based on the evolution trend, the deformation amount of the distribution curve per unit time is calculated to obtain an evolution speed feature sequence, the change rate of the evolution speed feature sequence is calculated to obtain an evolution acceleration feature sequence, and abnormal identification is performed based on the evolution speed feature sequence and the evolution acceleration feature sequence to obtain an abnormal type of density evolution.

[0120] According to the abnormal type, the influence interval range is determined, the influence interval range is multiplied by the pre-obtained abnormal degree score to obtain a propagation influence index, the propagation influence index is accumulated at different time scales to obtain a risk score sequence, and the maximum value in the risk score sequence is compared with a preset risk threshold to obtain a risk level.

[0121] The JS divergence of the feature distribution curve and the pre-set normal traffic baseline distribution curve is calculated to obtain the deviation degree, the deviation degree and the abnormal degree score are weighted to obtain a comprehensive abnormal value, and the interception threshold and the interception time length are determined according to the comprehensive abnormal value and the risk level.

[0122] After obtaining the time-adjacent feature distribution curves, the function extractDeformationFeatures() is called to extract the peak shift amount, curve shape change rate and probability density change amount of the feature distribution curves. The peak shift amount is obtained by calculating the difference of the maximum value positions of the adjacent time window distribution curves, reflecting the time offset characteristics of abnormal traffic. The curve shape change rate is obtained by calculating the reciprocal of the similarity of adjacent distribution curves, and the smaller the cosine value is, the greater the shape change is. The probability density change amount is obtained by calculating the average value of the difference of the corresponding point density values of adjacent distribution curves, reflecting the overall change trend of traffic intensity. The three indicators constitute the deformation feature sequence, and a three-dimensional vector is used to represent the distribution curve change characteristics of each time point.

[0123] The evolution trend of the deformation feature sequence over time is calculated using a nonlinear state equation, and the function evolutionTrendAnalysis() is called. An extended Kalman filter is used as a nonlinear state prediction tool, the state vector contains the deformation features and their first-order derivatives, and the state transition matrix uses a variable coefficient form, which is adaptively adjusted according to historical data. The process noise covariance matrix is set as a diagonal matrix, and the diagonal elements are set to 0.01 by default, which can be dynamically adjusted according to the stability of the network environment. The observation noise covariance matrix is also set as a diagonal matrix, and the diagonal elements are set to 0.05 by default, reflecting the measurement accuracy of the sensor. The extended Kalman filter calculates the optimal estimate of the deformation feature sequence through the prediction-update iteration process, considering the nonlinearity of the system and noise interference, and obtains a smooth evolution trend curve.

[0124] When calculating the deformation amount of the distribution curve per unit time based on the evolution trend to obtain the evolution velocity feature sequence, the function calculateEvolutionVelocity() is called. The difference between adjacent time points is divided by the time interval to obtain a three-dimensional evolution velocity vector, representing the peak shift speed, shape change speed and density change speed. The time interval is set to the step size of the sliding window, which is 200 milliseconds by default. When calculating the change rate of the evolution velocity feature sequence to obtain the evolution acceleration feature sequence, the difference between adjacent velocity vectors is calculated by using the difference method and divided by the time interval. Evolution acceleration reflects the acceleration characteristics of network traffic changes. Normal network traffic usually has a small acceleration value, while a sudden attack will cause the acceleration to increase significantly.

[0125] The abnormality recognition is performed based on the evolution speed feature sequence and the evolution acceleration feature sequence, a detectAnomalyType() function is called, a hybrid method based on threshold and pattern matching is adopted, whether the speed and acceleration features exceed preset thresholds is checked, the speed threshold is set as 3 times the average speed of normal traffic, and the acceleration threshold is set as 5 times the average acceleration of normal traffic. After exceeding the threshold, the feature vector is matched with a preset abnormal pattern library, the abnormal pattern library includes feature templates of typical attacks such as DDoS attacks, scanning attacks and worm propagation. The matching adopts cosine similarity measurement, and similarity greater than 0.8 is regarded as matching success. Through the combination of threshold detection and pattern matching, the abnormal type of density evolution is determined, including peak mutation type, morphological distortion type, density explosive type and the like.

[0126] According to the abnormal type, the impact interval range is determined, a calculateImpactRange() function is called, a basic impact range is obtained according to the abnormal type by table lookup, the basic impact range of the peak mutation type is 2, the basic impact range of the morphological distortion type is 3, and the basic impact range of the density explosive type is 4. The basic impact range is multiplied by the ratio of abnormal duration and reference time (default 1 second) to obtain a time adjustment coefficient. The impact interval range is equal to the basic impact range multiplied by the time adjustment coefficient, reflecting the influence breadth of the abnormal event. The impact interval range is multiplied by the abnormal degree score obtained in advance to obtain a propagation impact index, which comprehensively considers the severity and influence range of the abnormality and quantifies the security risk comprehensively.

[0127] The risk score sequence is obtained by accumulating the propagation impact index at different time scales, an accumulateRiskScores() function is called, and the propagation impact index is accumulated at three time scales of short term (10 seconds), medium term (1 minute) and long term (10 minutes). The short-term accumulation adopts simple summation, the medium-term accumulation adopts exponential weighting, and the long-term accumulation adopts smooth decay weight, so as to ensure that the recent events have higher weight. The maximum value in the risk score sequence is compared with a preset risk threshold to obtain a risk level, the risk threshold is divided into three levels: low risk (50), medium risk (100) and high risk (200). The risk level reflects the severity of network attacks, and provides a decision basis for subsequent defense strategies.

[0128] The deviation degree is calculated by the JS divergence of the feature distribution curve and the preset normal traffic baseline distribution curve, and the calculateJSDivergence() function is called. The JS divergence is constructed based on the KL divergence, but has symmetry and boundedness, and the value range is 0 to 1. In the calculation process, the average distribution of the two distributions is calculated, and the KL divergence of the original distribution and the average distribution is calculated respectively, and the average value of the two KL divergences is taken as the JS divergence. The normal traffic baseline distribution curve is obtained by long-term monitoring of the normal network state, and is saved in the read-only storage area of the embedded device. When the deviation degree and the abnormality degree score are weighted to obtain the comprehensive abnormal value, the deviation degree weight is set to 0.4, the abnormality degree score weight is set to 0.6, and the weighted sum is taken to obtain the normalized comprehensive abnormal value.

[0129] When the blocking threshold and the blocking duration are determined according to the comprehensive abnormal value and the risk level, the determineBlockingParameters() function is called for implementation. The function includes a two-dimensional lookup table, the horizontal axis is the comprehensive abnormal value (divided into 5 levels), the vertical axis is the risk level (divided into 3 levels), and the elements in the table are a two-element group of the blocking threshold and the blocking duration. The blocking threshold determines the sensitivity of triggering the defense measure, and the blocking duration determines the duration of the defense measure. The higher the comprehensive abnormal value and the risk level, the lower the corresponding blocking threshold and the longer the blocking duration, and the higher the defense strength.

[0130] Exemplarily, the embedded terminal detects suspicious network traffic, and obtains the feature distribution curves of 5 continuous time windows. The peak shift sequence [2.1, 5.3, 8.7, 15.2] is extracted, the curve shape change rate sequence [0.12, 0.18, 0.35, 0.62] is extracted, and the probability density change amount sequence [0.05, 0.08, 0.13, 0.24] is extracted, to form the deformation feature sequence. The nonlinear state equation is used to predict the evolution trend, and the smoothed deformation feature sequence is obtained. The evolution speed feature sequence is [16.5, 17.0, 32.5] (unit: per second), and the evolution acceleration feature sequence is [2.5, 77.5] (unit: per square second). The speed and acceleration increase significantly and exceed the preset threshold. The similarity is 0.87 after matching with the abnormal pattern library, and the density explosive type anomaly is identified, which corresponds to the DDoS attack feature.

[0131] According to the density burst type anomaly, the base influence range is determined as 4, the anomaly duration is 2.5 seconds, the time adjustment coefficient is 2.5, and the influence interval range is 10. Multiplying the pre-obtained anomaly degree score 4.2, the propagation influence index 42 is obtained. Accumulate the risk score at three time scales to obtain the risk score sequence [42, 115, 185]. The maximum value 185 is compared with the risk threshold to determine the medium risk level. The JS divergence of the feature distribution curve and the normal baseline is 0.78, indicating a significant deviation from the normal state. The deviation degree 0.78 is weighted with the anomaly degree score 4.2 to obtain the comprehensive anomaly value 2.9. According to the comprehensive anomaly value 2.9 and the medium risk level, the interception threshold 0.65 and the interception duration 300 seconds are obtained by looking up the table.

[0132] In this embodiment, by extracting the peak shift amount, morphological change rate and other deformation characteristics of the feature distribution curve, and analyzing its evolution trend based on the nonlinear state equation, the distribution change is accurately described. Through the calculation of the evolution speed and acceleration characteristic sequence, the abnormal recognition is realized, which can timely capture the abnormal change mode of the distribution curve. Based on the abnormal type and influence interval, the propagation influence index is calculated, and the risk score sequence is accumulated at multiple time scales, which effectively evaluates the sustained impact and potential risk of abnormal behavior. The deviation degree of the feature distribution and the normal baseline is calculated by the JS divergence, and the comprehensive anomaly value is obtained by combining with the anomaly degree score, which realizes the accurate defense and dynamic regulation of abnormal network traffic, which not only ensures the timeliness of the defense measures, but also avoids the influence of excessive interception on normal business.

[0133] Figure 2 The feature distribution curve analysis and abnormal interception flowchart of the network intrusion prevention method based on the embedded real-time operating system terminal of the embodiment of the application.

[0134] In an alternative embodiment,

[0135] According to the interception threshold and the interception duration, the network intrusion prevention strategy is executed to intercept abnormal network data packets, and the security policy library is updated based on the feature distribution curve and the deviation degree, including:

[0136] According to the interception threshold, the abnormal network data packets are marked, and the marked abnormal network data packets are subjected to blocking, speed limiting and redirection operations within the interception duration;

[0137] The peak value and morphological characteristics of the feature distribution curve are stored as a new feature template in the security policy library, and the deviation degree is updated as an anomaly judgment threshold to update the defense rules for subsequent identification and defense of abnormal traffic.

[0138] According to the intercept threshold, the abnormal network packet is marked, the markAbnormalPackets() function is called, the hook function is inserted in the network protocol stack of the embedded terminal, and the abnormal feature score of each data packet passing through is calculated. The abnormal feature score is calculated based on five dimensions: packet size abnormality, arrival time interval abnormality, protocol field abnormality, destination address abnormality and source address abnormality. The abnormality of each dimension is calculated differently. The packet size abnormality is calculated by deviation from normal distribution; the arrival time interval abnormality is evaluated by Poisson distribution model; the protocol field abnormality is evaluated by compliance with protocol specification; the destination address abnormality and the source address abnormality are evaluated by historical access frequency. The abnormality of the five dimensions is obtained by weighted average to get the comprehensive abnormal feature score, and the weights are 0.15, 0.25, 0.2, 0.25 and 0.15 respectively. When the comprehensive abnormal feature score exceeds the intercept threshold, a marked bit is added in the data packet header or internal metadata for subsequent processing. The mark uses binary bit identification, including abnormal type code (3 bits) and processing priority (2 bits), a total of 5 bits, embedded in the reserved field of the IP packet header or the TCP option field.

[0139] The marked abnormal network packets are blocked, limited in speed and redirected within the intercept duration, the enforceDefenseMeasures() function is called, and different defense measures are selected according to the abnormal feature score and the abnormal type. For packets with an abnormal feature score exceeding 1.5 times the intercept threshold, blocking operation is performed, the packet is discarded directly and an ICMP destination unreachable message is sent to the source address. The blocking operation is realized by calling the network filtering interface provided by the embedded operating system, and the filtering rules are set for specific IP addresses and ports. For packets with an abnormal feature score between the intercept threshold and 1.5 times the intercept threshold, speed limiting operation is performed, and the speed limiting uses token bucket algorithm, the bucket capacity is set to 10 packets, and the token generation rate is 5 per second, limiting the bandwidth occupation of suspicious traffic. The speed limiting operation is realized at the network driver layer, and the sending rate of data packets is controlled by modifying the scheduling strategy of the sending queue. For packets with an abnormal feature score slightly higher than the intercept threshold, redirection operation is performed, the request is redirected to a honeypot system or a verification service, and the traffic is attracted by modifying the destination address and port of the data packet. The redirection operation is realized at the routing decision point of the network protocol stack, and the transmission path of the data packet is dynamically changed by modifying the routing table.

[0140] The peak value and morphological features of the characteristic distribution curve are stored as a new feature template in the security policy library, and the updateSecurityTemplates() function is called to extract the key feature point set from the characteristic distribution curve, including the main peak position, peak height, half-peak width, skewness and kurtosis, etc. For multi-peak distribution, the relative position and height ratio of each peak are recorded. The extracted feature point set is normalized to eliminate the absolute magnitude difference, facilitating subsequent comparison. The normalization method uses the maximum and minimum value scaling, which scales each feature to the [0, 1] interval. The normalized feature template is stored in the security policy library together with the attack type label in the form of key-value pairs. The security policy library uses a B+ tree index structure to support efficient feature retrieval and update operations. To prevent the policy library from growing indefinitely, the capacity is set to 1000 records, and when the upper limit is exceeded, the least recently used (LRU) strategy is used to discard old records. The update of the feature template follows the incremental learning principle, and for existing attack types, the new features are fused with the old features in a 7:3 ratio to maintain the stability and adaptability of the template.

[0141] The deviation degree is used as the abnormality judgment threshold to update the defense rules, and the updateDefenseRules() function is called. The calculated deviation degree is multiplied by the safety factor (default 1.05) as the new abnormality judgment benchmark threshold, which is used for subsequent traffic monitoring. The benchmark threshold is adaptively adjusted according to the daily fluctuations of network traffic, and a time factor correction term is introduced to use different thresholds during working hours and non-working hours, improving detection accuracy. The defense rules are organized in the form of decision trees, containing three elements: judgment conditions, action instructions and priority. The judgment conditions are based on traffic feature expressions, such as "source IP access frequency > 100 times per second and destination port = 80"; the action instructions specify defense measures, such as "limit speed to 50 packets per second"; and the priority determines the execution order of the rules, ranging from 1 to 100, with a smaller value indicating a higher priority. During the update process, new rules are compared with existing rules to avoid conflicts and redundancies. For rules with a similarity of more than 85%, only the threshold parameters are updated; for completely new rules, a lower priority (default 80) is assigned, which is gradually increased after verification. The defense rules are stored in the configuration file system of the embedded terminal in a compact binary format, reducing storage space occupation.

[0142] In the embodiment, by marking the abnormal network data packet according to the interception threshold value and performing the corresponding defense operation, the accurate interception and hierarchical processing of the abnormal traffic are realized, by taking the peak value and morphological characteristics of the feature distribution curve as a new feature template and storing the feature template in the security policy library, and by using the deviation degree to update the defense rule, a dynamic adaptive security policy updating mechanism is established, which can not only effectively intercept the current abnormal traffic in time, but also improve the defense capability of the security policy library through continuous accumulation and updating of the feature template, so that the system can better cope with new network attacks, and the adaptability and sustainability of the network security defense are improved.

[0143] In a second aspect of the embodiment of the application, a network intrusion prevention system based on an embedded real-time operating system terminal is provided, comprising:

[0144] A first unit is configured to acquire network data packets of the embedded real-time operating system terminal.

[0145] A second unit is configured to extract a feature value sequence according to the communication characteristics of the network data packets, calculate the correlation coefficients between the features in the feature value sequence to construct a correlation coefficient matrix to obtain the correlation strength between the features, perform singular value decomposition operation on the correlation strength to obtain main feature components and importance, sort the main feature components according to the importance, select the main feature components with an importance greater than a preset importance threshold value and calculate the Euclidean distance with the abnormal features in a preset abnormal feature library to obtain an abnormality degree score.

[0146] A third unit is configured to dynamically adjust the length of a sliding time window according to the abnormality degree score, perform wavelet transform operation in the sliding time window to obtain the fluctuation characteristics of the feature components, perform kernel density estimation operation on the feature components to obtain a feature distribution curve, calculate the JS divergence of the feature distribution curve and a normal traffic baseline distribution curve to obtain a deviation degree, and perform weighted calculation on the deviation degree and the abnormality degree score to obtain a comprehensive abnormal value, and determine an interception threshold value and an interception duration.

[0147] A fourth unit is configured to perform a network intrusion prevention strategy to intercept abnormal network data packets according to the interception threshold value and the interception duration, and update a security policy library based on the feature distribution curve and the deviation degree.

[0148] In a third aspect of the embodiment of the application, an electronic device is provided, comprising:

[0149] A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0150] In a fourth aspect of the embodiment of the application, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0151] The present application can be a method, an apparatus, a system, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for performing various aspects of the present application.

[0152] Finally, it should be noted that the above-mentioned embodiments are merely used to illustrate the technical solutions of the present application, rather than limit the present application; even though the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: they can still make modifications to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to part or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A network intrusion prevention method based on an embedded real-time operating system terminal, characterized in that, include: Acquire network data packets from the embedded real-time operating system terminal; Based on the communication characteristics of network data packets, feature numerical sequences are extracted. The correlation coefficients between each feature in the feature numerical sequence are calculated to construct a correlation coefficient matrix to obtain the correlation strength between features. Singular value decomposition is performed on the correlation strength to obtain the main feature components and their importance. The main feature components are sorted according to their importance. The main feature components with an importance greater than the preset importance threshold are selected, and the Euclidean distance with the abnormal features in the preset abnormal feature library is calculated to obtain the abnormality score. The sliding time window length is dynamically adjusted based on the anomaly score. Wavelet transform is performed within the sliding time window to obtain the fluctuation characteristics of the feature components. Kernel density estimation is performed on the feature components to obtain the feature distribution curve. The JS divergence between the feature distribution curve and the normal traffic baseline distribution curve is calculated to obtain the degree of deviation. The degree of deviation is weighted with the anomaly score to obtain the comprehensive anomaly value, and the interception threshold and interception duration are determined. Based on the interception threshold and interception duration, network intrusion prevention strategies are executed to intercept abnormal network data packets, and the security policy library is updated based on the feature distribution curve and the degree of deviation.

2. The method according to claim 1, characterized in that, The network data packets acquired from the embedded real-time operating system terminal include: Register a network interface listening process in the embedded real-time operating system, receive terminal network data packets transmitted by the network interface, and cache the received data packets in a preset data buffer; Parse the header information of the network data packets in the data buffer, and extract the protocol type identifier, source address information, and destination address information from the header information; Establish a corresponding data storage queue based on the protocol type identifier, and classify and store the network data packets into the corresponding data storage queue according to the source address information and the destination address information.

3. The method according to claim 1, characterized in that, Feature numerical sequences are extracted based on the communication characteristics of network data packets. Correlation coefficients are calculated among the features in these sequences to construct a correlation coefficient matrix, yielding the correlation strength between features. Singular value decomposition is then performed on the correlation strength to obtain the main feature components and their importance, including: The communication features of the network data packets are extracted to construct a feature value sequence. Standardization processing is performed on each feature component of the feature value sequence to generate standardized feature values. Calculate the correlation coefficients between features based on the standardized eigenvalues, organize the correlation coefficients into a correlation coefficient matrix, perform singular value decomposition on the correlation coefficient matrix, and output a left singular vector matrix, a singular value diagonal matrix, and a right singular vector matrix. Extract the singular values ​​from the singular value diagonal matrix, calculate the pattern importance corresponding to each singular value, and perform an accumulation operation in order of the magnitude of the pattern importance. When the accumulated value exceeds the preset pattern importance threshold for the first time, determine the number of singular values ​​involved in the accumulation process as the number of principal components. Based on the number of principal components, the singular values ​​corresponding to the singular values ​​in the singular value diagonal matrix are selected to construct a dimension-reduced singular value diagonal matrix. Singular vectors corresponding to the number of principal components are selected from the left singular vector matrix and the right singular vector matrix, respectively. A dimension-reduced feature transformation matrix is ​​constructed based on the selected singular vectors. The feature value sequence is multiplied by the dimension-reduced feature transformation matrix to obtain the dimension-reduced principal feature components.

4. The method according to claim 1, characterized in that, The main feature components are sorted by importance. The main feature components with an importance greater than a preset threshold are selected, and their Euclidean distance with abnormal features in a preset abnormal feature library is calculated to obtain an anomaly score, including: The main feature components are obtained, and numerical integration is performed on the main feature components through a pre-set parameterized neural network to obtain the dynamic evolution trajectory; An evolutionary feature index set is extracted from the dynamic evolutionary trajectory, and the importance of each index in the evolutionary feature index set is obtained by weighted summation. The evolutionary feature index set includes stability numerical index, evolutionary speed numerical index, and energy dissipation numerical index. The main feature components are sorted in descending order according to the numerical value of their importance. The main feature components with an importance greater than a preset importance threshold are extracted. The dynamic evolution trajectory of the extracted main feature components is compared with the dynamic evolution trajectory of abnormal features in a preset abnormal feature library. The integral 2 norm distance over the entire time interval is calculated to obtain the trajectory distance. Calculate the Euclidean distance between the extracted main feature components and the abnormal features in the preset abnormal feature library, and standardize the Euclidean distance by dividing it by the standard deviation of the Euclidean distance; The trajectory distance is standardized by dividing it by the standard deviation of the trajectory distance. The arithmetic mean of the standardized Euclidean distance and the standardized trajectory distance is then used to obtain the anomaly score.

5. The method according to claim 1, characterized in that, The sliding time window length is dynamically adjusted based on the anomaly score. Wavelet transform is performed within the sliding time window to obtain the fluctuation characteristics of the feature components. Kernel density estimation is then performed on the feature components to obtain the feature distribution curves, including: An anomaly score is obtained, and an exponential function is used to construct a nonlinear mapping function based on the anomaly score to map the anomaly score to an interval between a preset minimum window length and a preset maximum window length. The exponential term of the nonlinear mapping function includes the negative value of the product of the anomaly score and the adjustment coefficient. The sliding time window length is dynamically adjusted based on the calculation result of the nonlinear mapping function. Within the sliding time window, a continuous wavelet transform operation is performed on the feature component, using the Morley wavelet function as the wavelet mother function. Wavelet coefficients in the time-frequency domain are obtained through the integral operation between the feature component and the Morley wavelet function. The energy spectrum is calculated on the wavelet coefficients to obtain the wave characteristics of the feature component. Kernel density estimation is performed on the feature components and the corresponding fluctuation characteristics. A Gaussian kernel function is selected as the kernel function. The Silverman rule is used to calculate the optimal bandwidth parameter based on the sample standard deviation, interquartile range and sample size of the feature components. The bandwidth parameter is substituted into the Gaussian kernel function, and the feature distribution curve of the feature components is obtained by convolution operation between the feature components and the Gaussian kernel function.

6. The method according to claim 1, characterized in that, The deviation degree is obtained by calculating the JS divergence between the characteristic distribution curve and the normal traffic baseline distribution curve. The deviation degree and the anomaly degree score are weighted to obtain a comprehensive anomaly value. The interception threshold and interception duration are determined by: The characteristic distribution curves of temporally adjacent curves are obtained, and the peak drift, curve shape change rate and probability density change of the characteristic distribution curves are extracted to obtain the deformation characteristic sequence. The evolution trend of the deformation characteristic sequence over time is calculated using a nonlinear state equation. Based on the evolutionary trend, the deformation of the distribution curve per unit time is calculated to obtain the evolutionary velocity feature sequence. The rate of change of the evolutionary velocity feature sequence is calculated to obtain the evolutionary acceleration feature sequence. Anomaly identification is performed based on the evolutionary velocity feature sequence and the evolutionary acceleration feature sequence to obtain the anomaly type of density evolution. The range of impact is determined based on the anomaly type. The range of impact is multiplied by the pre-obtained anomaly degree score to obtain the propagation impact index. The propagation impact index is accumulated at different time scales to obtain a risk score sequence. The maximum value in the risk score sequence is compared with a preset risk threshold to obtain the risk level. The deviation degree is obtained by calculating the JS divergence between the characteristic distribution curve and the pre-set normal traffic baseline distribution curve. The deviation degree is weighted and calculated with the anomaly degree score to obtain a comprehensive anomaly value. The interception threshold and interception duration are determined together based on the comprehensive anomaly value and the risk level.

7. The method according to claim 1, characterized in that, Based on interception thresholds and durations, network intrusion prevention strategies are implemented to intercept abnormal network packets. The security policy library is updated based on characteristic distribution curves and deviations, including: Abnormal network packets are marked according to the interception threshold, and blocking, rate limiting, and redirection operations are performed on the marked abnormal network packets within the interception duration; The peak value and morphological features of the characteristic distribution curve are stored as new feature templates in the security policy library, and the degree of deviation is used as an anomaly judgment threshold to update the defense rules for subsequent identification and defense of abnormal traffic.

8. A network intrusion prevention system based on an embedded real-time operating system terminal, used to implement the method of any one of claims 1-7, characterized in that, include: The first unit is used to acquire network data packets from the embedded real-time operating system terminal. The second unit is used to extract feature value sequences based on the communication characteristics of network data packets, calculate the correlation coefficient between each feature in the feature value sequence to construct a correlation coefficient matrix to obtain the correlation strength between features, perform singular value decomposition on the correlation strength to obtain the main feature components and their importance, sort the main feature components according to their importance, select the main feature components whose importance is greater than the preset importance threshold, and calculate the Euclidean distance with the abnormal features in the preset abnormal feature library to obtain the abnormality score. The third unit is used to dynamically adjust the length of the sliding time window based on the anomaly score, perform wavelet transform operation within the sliding time window to obtain the fluctuation characteristics of the feature components, perform kernel density estimation operation on the feature components to obtain the feature distribution curve, calculate the JS divergence between the feature distribution curve and the normal flow baseline distribution curve to obtain the degree of deviation, and calculate the comprehensive anomaly value by weighting the degree of deviation and the anomaly score to determine the interception threshold and interception duration. The fourth unit is used to execute network intrusion prevention strategies to intercept abnormal network data packets based on interception thresholds and interception durations, and to update the security policy library based on feature distribution curves and deviations.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images